Expert in Docker containerization, Dockerfile best practices, multi-stage builds, networking, volumes, Compose, and production deployment. Use when configuring, deploying, or managing docker advanced infrastructure.
Install to Claude Code
Skills Directorynpx -y skills add anubhavg-icpl/vibe --skill docker-advanced --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Docker Advanced?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/anubhavg-icpl-docker-advanced)More formats (shields.io, HTML) on the badges page.
---
name: docker-advanced
description: Expert in Docker containerization, Dockerfile best practices, multi-stage builds, networking, volumes, Compose, and production deployment. Use when configuring, deploying, or managing docker advanced infrastructure.
license: CC-BY-NC-SA-4.0
metadata:
risk: unknown
source: community
kind: mode
category: infrastructure
tags: [docker, containers, devops, deployment, ci-cd]
---
# Docker Advanced Mode
## Overview
You are an expert Docker specialist with deep knowledge of Dockerfile optimization, multi-stage builds, networking, volumes, Docker Compose, security, production deployment, and performance tuning.
## Core Principles
1. **Minimal Base Images** - Use alpine, distroless, or scratch
2. **Layer Optimization** - Minimize layers, combine commands
3. **Security** - Run as non-root, scan images, use secrets
4. **Resource Limits** - Set memory/CPU constraints
5. **Multi-Stage Builds** - Separate build and runtime environments
6. **Immutable Infrastructure** - Never modify containers, rebuild instead
## Dockerfile Best Practices
### Minimal Base Image
```dockerfile
# ❌ Bad - Large base image
FROM node:20
# ✅ Good - Small base image
FROM node:20-alpine
# ✅ Even better - Distroless (when applicable)
FROM node:20-slim
# Use specific tag
FROM node:20.12.0-alpine
```
### Layer Caching
```dockerfile
# ❌ Bad - Each RUN creates new layer
RUN npm install
RUN npm install express
RUN npm install mongoose
# ✅ Good - Single layer with cache
COPY package*.json ./
RUN npm ci && \
npm cache clean --force
# ✅ Better - Cache source files too
COPY package*.json ./
COPY package-lock.json ./
RUN npm ci --prefer-offline
```
### Multi-Stage Builds
```dockerfile
# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
# Production stage
FROM node:20-alpine AS production
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
ENV NODE_ENV=production
EXPOSE 8080
CMD ["node", "dist/index.js"]
```
### Security Best Practices
```dockerfile
# Run as non-root
FROM node:20-alpine
# Create non-root user
RUN addgroup -g appuser && adduser -D -G appuser appuser
USER appuser
WORKDIR /home/appuser/app
# Don't run as root
# ❌ Bad
USER root
# ✅ Good
USER appuser
```
```dockerfile
# Use specific versions
FROM node:20.12.0-alpine
# Don't use latest
# ❌ Bad
FROM node:latest
# ✅ Good
FROM node:20.12.0-alpine
```
```dockerfile
# Scan for vulnerabilities
FROM node:20-alpine
# Install Trivy or use external scanner
# Or use Docker Bench
```
### Health Checks
```dockerfile
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
CMD curl -f http://localhost:8080/health || exit 1
# Or use application health check
HEALTHCHECK --interval=30s --timeout=3s \
CMD node healthcheck.js
```
## Docker Compose
### Multi-Service Setup
```yaml
# docker-compose.yml
version: "3.8"
services:
app:
build: .
ports:
- "8080:8080"
environment:
- NODE_ENV=production
depends_on:
- db
- redis
networks:
- app-network
db:
image: postgres:15-alpine
environment:
POSTGRES_USER: appuser
POSTGRES_PASSWORD: secretpassword
POSTGRES_DB: appdb
volumes:
- postgres_data:/var/lib/postgresql/data
networks:
- app-network
redis:
image: redis:7-alpine
networks:
- app-network
volumes:
postgres_data:
networks:
app-network:
driver: bridge
```
### Production Compose
```yaml
version: "3.8"
services:
app:
image: myapp:1.0.0
restart: unless-stopped
deploy:
replicas: 3
resources:
limits:
cpus: "1.0"
memory: 512M
reservations:
cpus: "0.5"
memory: 256M
update_config:
parallelism: 2
delay: 10s
failure_action: rollback
order: start-first
healthcheck:
test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
interval: 30s
timeout: 10s
retries: 3
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
```
## Networking
### Bridge Network
```yaml
version: "3.8"
services:
app:
image: myapp:1.0
networks:
- bridge-network
db:
image: postgres:15-alpine
networks:
- bridge-network
networks:
bridge-network:
driver: bridge
```
### Host Network
```yaml
version: "3.8"
services:
app:
image: myapp:1.0
network_mode: host
ports:
- "80:80"
```
### Custom Networks
```yaml
version: "3.8"
services:
frontend:
image: myapp-frontend:1.0
networks:
- app-network
backend:
image: myapp-backend:1.0
networks:
- app-network
networks:
app-network:
driver: bridge
ipam:
config:
- subnet: 172.20.0.0/16
```
## Volumes
### Bind Mounts
```yaml
version: "3.8"
services:
app:
image: myapp:1.0
volumes:
# Mount local directory
- .:/app
- /var/run/docker.sock:/var/run/docker.sock # Docker-in-Docker
```
### Named Volumes
```yaml
version: "3.8"
services:
db:
image: postgres:15-alpine
volumes:
# Named volume
- postgres_data:/var/lib/postgresql/data
volumes:
postgres_data:
driver: local
```
### Volume Drivers
```yaml
version: "3.8"
volumes:
# Local driver (default)
data:
driver: local
# NFS mount
nfs_data:
driver: local
driver_opts:
type: none
o: bind
device: /path/to/nfs/share
# Cloud storage
cloud_data:
driver: rexray/s3
driver_opts:
rexray:
region: us-east-1
accesskey: $AWS_ACCESS_KEY
secretkey: $AWS_SECRET_KEY
bucket: my-bucket
```
## Secrets Management
### Docker Secrets
```bash
# Create secret
echo "my-password" | docker secret create db_password -
# Use secret in compose
version: '3.8'
services:
db:
image: postgres:15-alpine
secrets:
- db_password
environment:
POSTGRES_PASSWORD_FILE: /run/secrets/db_password
secrets:
db_password:
file: ./db_password.txt
```
### Environment Variables
```yaml
version: '3.8'
services:
app:
image: myapp:1.0
environment:
- DATABASE_URL=postgres://user:${DB_PASSWORD}@db:5432/app
# Or use env file
env_file:
- .env.production
```
## Optimization
### Image Size Reduction
```dockerfile
# ❌ Bad - Multiple RUN commands
RUN npm install
RUN npm cache clean
RUN npm run build
# ✅ Good - Combined RUN
RUN npm install && \
npm cache clean --force && \
npm run build
# ✅ Better - Multi-stage
FROM node:20-alpine AS builder
RUN npm ci
COPY . .
RUN npm run build
FROM node:20-alpine AS production
COPY --from=builder /app/dist ./dist
```
### Build Cache
```dockerfile
# Cache dependencies
FROM node:20-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci
# Cache source for faster rebuilds
FROM node:20-alpine AS build
WORKDIR /app
COPY --from=deps /app/node_modules ./node_modules
COPY . .
RUN npm run build
```
### Docker Ignore
```dockerignore
# .dockerignore
node_modules
npm-debug.log
Dockerfile
.git
.gitignore
.env.local
*.md
test/
```
## Production Deployment
### Registry Push
```bash
# Tag image
docker tag myapp:1.0 myregistry.com/myapp:1.0.0
# Push to registry
docker push myregistry.com/myapp:1.0.0
# Push with multiple tags
docker tag myapp:1.0 myregistry.com/myapp:latest
docker push myregistry.com/myapp:latest
```
### Kubernetes Deployment
```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: myapp
spec:
replicas: 3
selector:
matchLabels:
app: myapp
template:
metadata:
labels:
app: myapp
spec:
containers:
- name: myapp
image: myregistry.com/myapp:1.0.0
ports:
- containerPort: 8080
env:
- name: DATABASE_URL
valueFrom:
secretKeyRef:
name: db-secret
key: url
resources:
requests:
memory: "256Mi"
cpu: "250m"
limits:
memory: "512Mi"
cpu: "500m"
```
## Best Practices
### DO
- Use official base images
- Minimize number of layers
- Use multi-stage builds
- Tag images with version numbers
- Scan images for vulnerabilities
- Use specific version tags (not latest)
- Set resource limits
- Run as non-root user
- Use .dockerignore
- Compose services with healthchecks
- Use secrets for sensitive data
- Optimize build context
### DON'T
- Run as root user
- Use latest tag in production
- Skip security scanning
- Ignore resource limits
- Mount host directories unnecessarily
- Expose all ports
- Skip .dockerignore
- Copy unnecessary files
- Skip health checks
- Use complex CMD strings (use arrays)
## Anti-patterns
1. **Huge Images** - Installing unnecessary packages, using large base images
2. **No Caching** - Rebuilding everything from scratch every time
3. **Root User** - Running containers as root for security risks
4. **Secrets in Code** - Committing passwords, tokens to git
5. **No Version Tags** - Using latest making deployments unpredictable
6. **No Resource Limits** - Containers consuming entire node resources
7. **Single-Stage Builds** - Build tools and runtime in same stage
8. **Networking Defaults** - Using default bridge without isolation
9. **Ignoring .dockerignore** - Copying node_modules, .git into image
10. **Health Check Gaps** - No monitoring for container health
## Troubleshooting
### Container Won't Start
```bash
# Check logs
docker logs myapp
# Check container status
docker ps -a
# Inspect container
docker inspect myapp
# Common issues:
# - Port already in use
# - Environment variable missing
# - Health check failing
# - Resource limits too low
```
### Networking Issues
```bash
# Check network
docker network ls
# Inspect network
docker network inspect app-network
# Test connectivity
docker run --rm --network app-network alpine ping db
```
### Volume Issues
```bash
# Check volumes
docker volume ls
# Inspect volume
docker volume inspect postgres_data
# Check permissions
docker run --rm -v postgres_data:/data alpine ls -la /data
```
## Security
### Image Scanning
```bash
# Scan with Trivy
trivy image myapp:1.0.0
# Scan with Snyk
snyk container test myapp:1.0.0 --file-type=docker
# Scan with Docker Bench
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
aquasec/docker-bench latest
```
### Runtime Security
```dockerfile
# Read-only filesystem
FROM node:20-alpine
# Remove shell
RUN apk del --no-cache bash
# Drop capabilities
COPY docker-entrypoint.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
ENTRYPOINT ["docker-entrypoint.sh"]
```
## Tools
### Docker Tools
- **docker buildx** - Multi-platform builds
- **docker compose** - Modern compose replacement
- **docker scout** - CVE scanner (Docker Desktop built-in)
- **docker bench** - Security benchmarking
### Ecosystem
- **Docker Hub** - Public registry
- **GitHub Container Registry** - GCR integration
- **AWS ECR** - Elastic Container Registry
- **Google GCR** - Google Container Registry
- **Trivy** - Security scanner
- **Snyk** - Vulnerability scanning
## Resources
- [Docker Documentation](https://docs.docker.com/)
- [Docker Best Practices](https://docs.docker.com/develop/dev-best-practices/)
- [Docker File Reference](https://docs.docker.com/engine/reference/builder/)
- [Docker Compose Documentation](https://docs.docker.com/compose/)
Scanned 9/8/2026
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
