agentsclimarketplace
Sign in

Docker expert

Skill risadams/ink-and-agency/skills/infrastructure/docker-expert

Use when you need to build, optimize, or secure Docker container images and orchestration for production environments.From its SKILL.md

Install
npx -y skills add risadams/ink-and-agency --skill docker-expert

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

  • no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
  • 1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.0 KB, 589 tokens by cl100k_base, as published. Nobody here has run it

Docker Expert

You build and run containers. The defaults produce images that are large, slow to build, and running as root.

Multi-stage builds, small runtime base

Build dependencies do not belong in the runtime image. A compiled binary on a distroless or Alpine base is a fraction of the size and attack surface of the toolchain that produced it. Size is not vanity: it is pull time on every node and every scaled instance.

Layer order is build speed

Copy dependency manifests and install dependencies before copying source. Reversing this — a COPY . . above the install step — invalidates the dependency layer on every source change and turns a five-second rebuild into a five-minute one. This is the most common Dockerfile defect.

Use .dockerignore; without it the entire working tree including .git goes into the build context.

Never run as root

Create a user and USER to it. A container escape from a root process is a materially worse day than from an unprivileged one. Read-only root filesystem where the application permits it.

Secrets do not go in images

Build args and ENV are visible in the image history — a secret passed as a build arg is recoverable by anyone who can pull the image, including after a later layer removes it. Use build secrets mounts for build time and runtime injection for runtime.

Pin what you depend on

latest makes builds unreproducible and makes an upstream change indistinguishable from your own. Pin base image tags, ideally by digest. Scan images for known vulnerabilities in CI and rebuild on base image updates — an image built once and never rebuilt accumulates CVEs while appearing unchanged.

One process, signals handled, logs to stdout

The container lifecycle assumes a single foreground process that terminates on SIGTERM. Shell form CMD swallows signals, so containers get killed rather than shutting down gracefully. Log to stdout and let the platform collect it; writing log files inside a container is a disappearing act.

Reporting

State the image size, the base and why, the user it runs as, how secrets reach it, and the build cache behavior.

Host portability: tool names in this skill follow Claude Code conventions; on other hosts (Codex, opencode) map them by intent — see PORTABILITY.md.

<!-- self-evolve:start -->

Self-Evolve Loop

Journal: ~/.ink-and-agency/learnings/docker-expert.md (workspace-local .ink-and-agency/learnings/docker-expert.md where the sandbox confines writes). Read it first, append what the run taught last — SELF-EVOLVE.md.

<!-- self-evolve:end -->

What ships with it: 2 files

1.7 KB alongside SKILL.md

agents/

Gives 3 of the 12 instructions most containers cloud skills give in 589 tokens

Counted across 607 of the 657 authors here whose files we hold, read 2026-08-07

  • Run containers as a non-root userin 66 of 607, across 46 files
  • Use multi-stage buildshere, and in 53 of 607, across 44 files
  • Use Promise.all for independent operationsin 47 of 607, across 13 files
  • Import directly instead of barrel filesin 46 of 607, across 12 files
  • Use ternary instead of AND for conditionalsin 45 of 607, across 12 files
  • Use Set or Map for O(1) lookupsin 42 of 607, across 10 files
  • Create a .dockerignore filehere, and in 41 of 607, across 31 files
  • Read individual rule files for detailsin 39 of 607, across 9 files
  • Copy dependency files before source codehere, and in 36 of 607, across 23 files
  • Authenticate server actions like API routesin 35 of 607, across 7 files
  • Use next/dynamic for heavy componentsin 34 of 607, across 9 files
  • Use React.cache for per-request deduplicationin 34 of 607, across 10 files

Said here and by no other author read

  • Write logs to stdout
  • Read the learning journal first
  • Append run learnings to the journal

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.

Keep looking

Skills are one crate of 326,834. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.