docker-container-application

Files (1)

• SKILL.md

SKILL.md (first lines)

# Docker container image assembly

Assemble the generated `Dockerfile` from exactly three contribution sources, in this
order of authority: explicit Component specifications, selected Flavor requirements,
then this skill's preferences below them.

## Inputs

1. **Parent containers (base layers).** Resolve the `deploy.container-base`
   capability closure. Every providing container Flavor — including Flavors inherited
   through the repository lineage DAG — contributes exactly one immutable OCI image
   reference. Emit `FROM` instructions using those complete digest-qualified
   references in resolved DAG order, root closure first. A tag is only a human-readable
   upgrade hint and is never build authority. If no base provider resolves, stop with a
   concrete missing-capability diagnostic; never invent or look up an ambient image.
2. **Packages.** For each selected packaging Flavor (`package-pip`, `package-apt`,
   `package-brew`, `package-winget`, `package-chocolatey`, `package-conan`), emit its
   runtime-install actions inside the appropriate layer: pip requirements install for
   Python wheels, apt-get install for Debian packages, and equivalent actions per
   packaging target. Never fetch packages outside these declared actions.
3. **Entrypoints and scripts.** Copy only files invoked by the Component's declared
   entrypoints from the built artifact closure into the image, and declare each
   entrypoint so `docker run` reaches it directly.

## Construction rules

- Bind identity: label the image with the exact Component lock identity and recipe
  identity supplied by the generation context.
- Record each selected base in the pre-build CycloneDX SBOM with its digest as the
  exact `version`; do not represent a selected base as an unresolved `versionRange`.
- One concern per layer in dependency-safe order: base chain, OS packages, language
  packages, artifact copy, entrypoint declaration.
- Run as a non-root user unless the specification explicitly requires elevation.
- Detect the builder before use; if no Docker-compatible builder resolves on PATH,
  stop with a concrete host prerequisite instead of improvising.
- Verify locally by building the image and running the Component acceptance contract
  inside it before any deployment gate consumes the result.

From jordanhubbard/literate-ai, Apache-2.0.

More from jordanhubbard/literate-ai