From infrastructure
Docker and Podman container management: Dockerfile optimization, multi-stage builds, Compose v2 orchestration, networking, volumes, security hardening, supply chain integrity, health checks, resource limits, Quadlet systemd integration, and debugging. Invoke whenever task involves any interaction with containers — writing Dockerfiles, configuring Compose, managing Podman Quadlets, reviewing container security, debugging container issues, or setting up image signing and scanning.
npx claudepluginhub xobotyi/cc-foundry --plugin infrastructureThis skill uses the workspace's default tool permissions.
Security is not optional. Every container runs non-root, with dropped capabilities, on a minimal base image. Convenience
Generates design tokens/docs from CSS/Tailwind/styled-components codebases, audits visual consistency across 10 dimensions, detects AI slop in UI.
Records polished WebM UI demo videos of web apps using Playwright with cursor overlay, natural pacing, and three-phase scripting. Activates for demo, walkthrough, screen recording, or tutorial requests.
Delivers idiomatic Kotlin patterns for null safety, immutability, sealed classes, coroutines, Flows, extensions, DSL builders, and Gradle DSL. Use when writing, reviewing, refactoring, or designing Kotlin code.
Security is not optional. Every container runs non-root, with dropped capabilities, on a minimal base image. Convenience defaults that weaken security posture are bugs, not trade-offs.
These are non-negotiable defaults for every container configuration. Apply unconditionally — no exceptions for development, convenience, or "temporary" setups.
USER instruction with explicit UID/GID. Never run production containers as root.--cap-drop=ALL, then add back only what the application genuinely requires. Most
applications need zero.--security-opt=no-new-privileges prevents setuid/setgid escalation.--read-only with tmpfs mounts for /tmp, /run, and any directories the app writes
to.docker inspect, logs, and child processes. Use mounted secret files or
Docker secrets.--privileged. It removes almost all security restrictions. If a workload claims to need it, decompose
the requirement into specific capabilities./var/run/docker.sock) into containers. It grants root-equivalent control over the
host. Use purpose-built APIs or socket proxies with restricted access.--init or tini/dumb-init for PID 1. Regular applications don't reap zombie processes or handle signals
correctly as PID 1. Use docker run --init, RunInit=true in Quadlets, or install tini in the Dockerfile. Without
this, docker stop waits for the kill timeout and zombies accumulate.${CLAUDE_SKILL_DIR}/references/dockerfile-patterns.md]: Multi-stage templates, layer
optimization, base image selection, .dockerignore, ENTRYPOINT/CMD, BuildKit cache mounts, signal handling, OCI labels${CLAUDE_SKILL_DIR}/references/compose-orchestration.md]: Service structure, depends_on
conditions, env vars, secrets, networks, volumes, profiles, restart policies, override files, zero-downtime patterns${CLAUDE_SKILL_DIR}/references/security-hardening.md]: Non-root patterns, read-only FS,
capabilities, distroless, secrets, scanning, supply chain security, SBOM, image signing, VEX, hardening checklist${CLAUDE_SKILL_DIR}/references/networking.md]: Driver selection, bridge/host/macvlan/ipvlan usage,
port publishing, DNS, multi-network, common mistakes, iptables bypass${CLAUDE_SKILL_DIR}/references/storage-and-volumes.md]: Volume types, named/bind/tmpfs,
NFS/CIFS drivers, backup/restore, permissions, storage drivers, performance${CLAUDE_SKILL_DIR}/references/operations.md]: Health checks, resource constraints, logging
drivers, structured logging, debugging, monitoring, Quadlet patterns, Docker/Podman CLI compatalpine, *-slim, distroless, or scratch for static binaries. Never use full OS
images in production.@sha256:...) in CI for reproducibility. Use minor version tags
(3.13-slim) in development. Never use :latest.apt-get update with apt-get install in the same RUN. Clean caches in the same
layer. Sort packages alphabetically.COPY for local files. ADD only when you need remote URL fetching or automatic tar
extraction.CMD ["app", "--flag"] — not CMD app --flag. Shell form wraps in
/bin/sh -c, making the shell PID 1. Shells don't forward signals to children — your app never receives SIGTERM on
docker stop.exec "$@" in entrypoint scripts. Without exec, the shell spawns the app as a child and swallows signals.
exec replaces the shell process with the app, making it PID 1..git, node_modules, .env, build artifacts, and documentation from the
build context.--mount=type=secret for build-time secrets. Never COPY or ENV secrets — they persist in image layers.RUN cd ... && ....RUN --mount=type=cache,target=/root/.cache/pip pip install -r requirements.txt. Avoids re-downloading dependencies
on every build.docker buildx for multi-platform images. docker buildx build --platform linux/amd64,linux/arm64 produces
images for multiple architectures. Required for ARM/x86 portability.LABEL org.opencontainers.image.* for source, version, description. Enables registry
identification and automated tooling.version: field. Use compose.yml (not docker-compose.yml).depends_on with condition: service_healthy for services that need initialization time (databases, caches).service_completed_successfully for one-shot dependencies like migrations.internal: true on backend networks to
block outbound internet access.deploy.resources.limits for memory and CPU. A container without memory limits can
OOM-kill the host.local logging driver, or configure json-file with max-size and max-file.
Default has no rotation.unless-stopped for production services. on-failure for tasks that should retry but
eventually stop.profiles: — not started by
default..env.example in version control, .env in .gitignore.secrets: mounts files at /run/secrets/<name> — granular per-service access,
not visible in docker inspect or process listings like env vars.compose.yml for common defaults, compose.prod.yml for production
overrides. Use explicit -f flags in production — never rely on automatic compose.override.yml loading.host network only for performance-critical workloads that bind many dynamic ports. Not available on Docker
Desktop.macvlan when containers need LAN presence with unique MAC addresses. Use ipvlan when the switch limits MAC
count.127.0.0.1 when the service should not be externally accessible. Docker port mapping
bypasses host firewall rules.internal: true on backend Compose networks to prevent outbound internet access from database and cache
containers.0.0.0.0 inside containers. A service bound to localhost inside a container is unreachable
from other containers — localhost refers to the container's own namespace.:ro when the container
should not modify.RUN mkdir && chown before USER instruction. Avoids permission denied
errors at runtime.docker system df shows space used by images, containers, and volumes. Dangling
anonymous volumes accumulate silently — run docker volume prune periodically.:U to chown volume contents to match container user, :Z/:z for SELinux relabeling.HEALTHCHECK in Dockerfile or healthcheck: in Compose.curl -f for HTTP services, pg_isready for Postgres, redis-cli ping for
Redis, nc -z for TCP ports.start_period for services with slow initialization. Failures during start period don't count toward retry
limit.--memory or deploy.resources.limits.memory. Prevents OOM cascade.--memory-swap equal to --memory to disable swap. Swapping containers cause unpredictable latency.--cpus for CPU limits. Simpler than --cpu-period/--cpu-quota. --cpus=1.5 means 150% of one core.--cpu-shares for relative priority under contention. Not a hard limit — only enforced when CPU is scarce./etc/subuid and /etc/subgid ranges for the user running containers. Run podman system migrate after
changes.net.ipv4.ip_unprivileged_port_start sysctl.pasta or slirp4netns — not kernel bridging. Performance differs from Docker's bridge
driver. DNS resolution within custom networks is handled by aardvark-dns; network setup by netavark..container, .volume, .network, .pod files in
~/.config/containers/systemd/ (rootless) or /etc/containers/systemd/ (rootful). Replaces deprecated
podman generate systemd. Run systemctl --user daemon-reload after changes. Enable user lingering
(loginctl enable-linger) for rootless services to survive logout.AutoUpdate=registry in Quadlet containers. Requires fully-qualified image names. Enable the timer:
systemctl --user enable --now podman-auto-update.timer. Podman pulls new images and restarts affected services.
Dry-run with podman auto-update --dry-run.RunInit=true in Quadlet containers. Equivalent to docker run --init — adds tini as PID 1 for signal
forwarding and zombie reaping.TimeoutStartSec=900 for slow image pulls. Systemd defaults to 90s — large images will fail the service
start.podman pod groups containers sharing a network namespace, similar to Kubernetes pods. Containers in a pod
communicate over localhost. Use .pod Quadlet files with Pod= directive in container files to join.:Z (private) or :z (shared) volume flags. :Z applies MCS labels
isolating containers from each other. Always use :Z on SELinux systems.Secret= in Quadlets for credentials. Create with podman secret create, reference with
Secret=name,type=env,target=VAR. Cleaner than env files for sensitive data.podman compose wraps docker-compose. Use fully-qualified image names for registry
operations. Most Docker CLI commands work identically with Podman.When writing Dockerfiles or Compose files: Apply all rules silently. Produce secure, optimized configurations by
default — multi-stage builds, non-root users, minimal images, init process, health checks, resource limits, log
rotation, and file-based secrets. Never produce a Dockerfile without a USER instruction or a Compose service without
deploy.resources.limits.
When reviewing container configurations: Check every security rule first. Cite the specific rule violated and show the fix inline. Review priority: security violations > missing resource limits > missing health checks > missing log rotation > layer optimization.
When debugging container issues:
docker logs -f --tail 100 <container> — check application outputdocker inspect <container> — verify config, mounts, network, envdocker exec -it <container> sh — interactive inspection (if shell available)docker run -it --rm --network container:<target> nicolaka/netshoot — network debugging with full toolkitdocker run -it --rm --pid container:<target> --network container:<target> busybox — ephemeral debug
sidecarthe-coder provides overall coding discipline for configuration filesnetworking skill in this plugin covers network infrastructure beyond container networking (VLANs, firewalls, reverse
proxies)Every container is non-root, read-only filesystem, all capabilities dropped, with an init process for signal handling. Every image is minimal, scanned, signed, and pinned. Every service has health checks, resource limits, log rotation, and structured logging. No exceptions.