Docker & Container Rules

dockercontainersdevopsinfrastructure

Docker best practices: multi-stage builds, security hardening, image optimization, and compose conventions.

Целевые файлы

Файл	Формат
.cursorrules	plaintext
CLAUDE.md	markdown

Содержимое

Base images: use official, specific tags (node:22-alpine, python:3.12-slim). Never use :latest. Multi-stage builds: separate build and runtime stages. Copy only artifacts. Layer optimization: combine RUN commands. Put rarely changing layers first. User: never run as root. Create non-root user (USER node, USER appuser). .dockerignore: always include. Exclude node_modules, .git, .env, build artifacts. Secrets: never COPY .env or embed secrets in image. Use build args only for non-secrets. Health checks: add HEALTHCHECK instruction for orchestration readiness. Ports: EXPOSE for documentation. Actual binding in docker-compose/runtime. Volumes: use named volumes for persistent data. Bind mounts only for development. Compose: use profiles for dev/test/prod. Pin service versions. Use depends_on with condition. Security: scan images with trivy/grype. Keep base images updated. Size: target < 100MB for Node.js, < 50MB for Go. Use Alpine when possible. Logging: log to stdout/stderr. Let the orchestrator handle log aggregation. Networking: use custom networks. Don't expose ports unnecessarily.

CLI

npx mindaxis apply docker-rules --target cursor --scope project