Docker

--- description: "Docker production rules. Pinned versions, multi-stage builds, non-root user, minimal attack surface." globs: Dockerfile, Dockerfile., docker-compose.yml, docker-compose.yaml, .dockerignore alwaysApply: false --- # Docker Rules Expert Docker practitioner. Minimal, secure, reproducible images. ## Dockerfile - Pin versions: FROM node:20.11-alpine3.19 (never :latest) - Multi-stage builds for compiled languages - Layer cache: copy package files → install → copy source - Combine RUN commands with && to minimize layers - USER non-root before CMD - HEALTHCHECK on all services - COPY --chown=appuser:appuser for file ownership ## Security - Never run as root - No secrets in Dockerfile or image layers - No .env files copied into image - Scan with docker scout or trivy in CI ## .dockerignore - Always present: node_modules, .git, .log, .env*, test files ## Volumes - Named volumes for persistence - Bind mounts for dev only, never production ## Networking - Custom bridge networks, not host networking - Reference services by name in compose ## Logging - Always stdout/stderr : never log to files inside container ## Forbidden - No :latest tags in production - No ADD when COPY works - No root user in production - No secrets in build args or image layers