docker-review

Docker Review Skill

Review container configurations for security, performance, image size optimization, and production best practices.

When to Use

This skill activates when:

• User requests "review my Dockerfile", "docker review"
• After creating or modifying Dockerfile
• After updating docker-compose configuration
• Before deploying containers to production
• When optimizing container image size
• When setting up CI/CD container builds

What It Does

Delegates to the ops-engineer agent (Opus model) with container-specific review criteria:

1. Dockerfile Best Practices

   • Multi-stage builds (separate build and runtime stages)
   • Minimal base images (alpine, distroless, slim)
   • Layer ordering optimization (dependency install before code copy)
   • .dockerignore file presence and completeness
   • Non-root user execution
   • HEALTHCHECK instruction
   • Proper ENTRYPOINT vs CMD usage

2. Security

   • No secrets in build args or ENV
   • No root user in final stage
   • Read-only filesystem where possible
   • Pinned base image versions (no :latest)
   • Minimal installed packages (no extraneous tools)
   • No SUID/SGID binaries in final image
   • Security scanning integration (Trivy, Snyk)

3. Performance & Size

   • Unnecessary files excluded from image
   • Build cache utilization
   • Layer count minimization
   • Final image size assessment
   • Resource limits (memory, CPU) in compose/k8s
   • Connection limits and pool configurations

4. docker-compose Configuration

   • Service dependency management (depends_on with healthcheck)
   • Volume mount security (no host path escapes)
   • Network isolation between services
   • Environment variable management
   • Restart policies
   • Resource limits (deploy.resources)
   • Logging driver configuration

5. Production Readiness

   • Health check endpoints configured
   • Graceful shutdown support (stop_grace_period)
   • Log aggregation setup
   • Secrets management (Docker secrets, external vaults)
   • Rolling update strategy
   • Backup and restore procedures for volumes

Agent Delegation

Task(
  subagent_type="oh-my-claudecode:ops-engineer",
  model="opus",
  prompt="DOCKER REVIEW TASK

Review Dockerfile and container configuration for security, performance, and production readiness.

Scope: [Dockerfile, docker-compose.yml, or k8s manifests]

Review Checklist:
1. Multi-stage build usage
2. Security (non-root, no secrets in image, pinned versions)
3. Image size optimization
4. docker-compose service configuration
5. Health checks and graceful shutdown
6. Resource limits and logging

Output: Docker review report with:
- Line-by-line Dockerfile assessment
- Security vulnerabilities found
- Image size optimization suggestions
- docker-compose configuration issues
- Production readiness checklist"
)

Output Format

DOCKER REVIEW REPORT
====================

Image: myapp:latest
Base: node:20 → Recommendation: node:20-alpine
Estimated Size: ~1.2GB → Optimized: ~150MB

DOCKERFILE ANALYSIS
-------------------

Line 1: FROM node:20
  ⚠️  Use node:20-alpine for 10x smaller image
  ⚠️  Pin exact version: node:20.11.0-alpine

Line 5: COPY . .
  ❌ Copies everything including node_modules, .git, tests
  Fix: Add .dockerignore or COPY package*.json first

Line 8: RUN npm install
  ⚠️  Use npm ci --only=production for reproducible builds
  ⚠️  Should be before COPY . . for layer caching

Line 12: USER root
  ❌ CRITICAL: Running as root in production
  Fix: Add USER node or create custom non-root user

Line 15: (missing)
  ❌ No HEALTHCHECK instruction
  Fix: HEALTHCHECK CMD curl -f http://localhost:3000/health || exit 1

SECURITY ISSUES
---------------
1. Running as root (CRITICAL)
2. Base image not pinned (MEDIUM)
3. No .dockerignore file (LOW)

DOCKER-COMPOSE ISSUES
-----------------------
1. No resource limits set (services.app)
   Fix: deploy.resources.limits: { memory: 512M, cpus: '0.5' }

2. No health check in depends_on
   Fix: depends_on: { db: { condition: service_healthy } }

3. Secrets in environment variables
   Fix: Use Docker secrets or external vault

OPTIMIZED DOCKERFILE
--------------------
(Provides rewritten Dockerfile with all fixes applied)

RECOMMENDATION: Fix CRITICAL security issues before deployment.

Review Checklist

Dockerfile

• Uses multi-stage build
• Minimal base image (alpine/distroless/slim)
• Base image version pinned (not :latest)
• .dockerignore file present
• Dependencies installed before copying source
• Uses npm ci (not npm install) for Node.js
• Non-root user in final stage
• HEALTHCHECK instruction present
• No secrets in ENV or ARG
• Proper ENTRYPOINT/CMD usage

docker-compose

• Resource limits defined
• Health checks configured
• depends_on uses condition: service_healthy
• Network isolation between services
• Restart policy set
• Logging driver configured
• No host path volumes that escape project dir
• Environment variables from .env or secrets

Production

• Image scan passing (no critical CVEs)
• Graceful shutdown configured (stop_grace_period)
• Rolling update strategy defined
• Volume backup plan documented
• Log aggregation configured

Use with Other Skills

Full Infrastructure Review:

/docker-review then /ops-check

Container + operational readiness review.

With Ralph:

/ralph docker-review then optimize Dockerfile

Review, fix, re-review until optimal.

Best Practices

• Build small — Alpine or distroless base, multi-stage builds
• Pin versions — Exact versions for reproducible builds
• No root — Always run as non-root user
• Cache layers — Copy dependency files before source code
• Scan images — Run Trivy/Snyk in CI pipeline
• Limit resources — Always set memory and CPU limits