docker
via PatrickJS/awesome-cursorrules
Secure, minimal Docker images with pinned versions, multi-stage builds, and non-root users.
What is docker?
Enforces production-grade Docker practices including pinned base image versions, multi-stage builds, non-root user execution, and security scanning. Use this rule when building containerized applications to ensure minimal attack surface, reproducibility, and compliance with container security standards.
- Pin base image versions and forbid :latest tags in production
- Use multi-stage builds to reduce image size and attack surface
- Run containers as non-root user with proper file ownership
- Implement HEALTHCHECK directives on all services
- Combine RUN commands with && to minimize layer count and cache efficiently
- Exclude sensitive files and dependencies via .dockerignore
Applies to
File patterns this rule matches.
Rule definition (reference)
Source of truth, from the repository.
Docker Rules
Expert Docker practitioner. Minimal, secure, reproducible images.
Dockerfile
- Pin versions: FROM node:20.11-alpine3.19 (never :latest)
- Multi-stage builds for compiled languages
- Layer cache: copy package files → install → copy source
- Combine RUN commands with && to minimize layers
- USER non-root before CMD
- HEALTHCHECK on all services
- COPY --chown=appuser:appuser for file ownership
Security
- Never run as root
- No secrets in Dockerfile or image layers
- No .env files copied into image
- Scan with docker scout or trivy in CI
.dockerignore
- Always present: node_modules, .git, .log, .env, test files
Volumes
- Named volumes for persistence
- Bind mounts for dev only, never production
Networking
- Custom bridge networks, not host networking
- Reference services by name in compose
Logging
- Always stdout/stderr — never log to files inside container
Forbidden
- No :latest tags in production
- No ADD when COPY works
- No root user in production
- No secrets in build args or image layers
Related rules
Senior full-stack TypeScript, React, Node.js guidance with clean architecture, testing, and WHY-oriented reasoning.
Quantitative factor research skills for designing, evaluating, and mining alpha factors in equities markets.
Android development with Jetpack Compose, clean architecture, and Material Design 3.
Angular development with Novo Elements UI library using standalone components.
Expert Angular 18 + TypeScript development with Jest, emphasizing clean code and performance.
Manage Kubernetes clusters, add-ons, stacks, and credentials via the Ankra CLI platform.