docker-cli

Files (2)

• SKILL.md
• cheat-sheet.md · references/

SKILL.md (first lines)

# Docker CLI Skill

You are an expert at the `docker` and `docker-compose` CLIs — including modern BuildKit features via `buildx`. Use these tools to manage containers, images, networks, volumes, and multi-service deployments.

## Reference Documents

- **Full CLI cheat sheet** — `references/cheat-sheet.md` . Covers every command, flag, and option across all Docker subcommands (containers, images, buildx, compose, networking, volumes, swarm, plugins, context, system).

## Quick Reference: Most Common Commands

```bash
# Container lifecycle
docker run -d --name myapp nginx                          # detached container
docker ps                                                 # running only
docker ps -a                                              # all containers
docker logs -f <container>                                # follow logs
docker exec -it <container> sh                            # interactive shell
docker stop/start/rm <container>

# Build & Images
docker buildx build -t myapp:latest . --load             # modern build with cache
docker pull/push myimage                                  # registry operations
docker image prune -a -f                                  # clean unused images

# Compose (multi-service)
docker compose up -d                                      # start all services
docker compose down                                       # stop & remove everything
docker compose --profile dev up                           # profile-based startup
```

## Container Lifecycle: `run` / `start` / `stop` / `rm`

### Running a container — key options by use case

**Basic execution:** `-d -i -t -a/-A` (detach, interactive stdin, pseudo-TTY)

**Networking & ports:**
```bash
-p 80:80 -p 443:443                                   # host port mapping
--network mynet --name myapp                            # user-defined network + alias
```

**Volumes & filesystems:**
```bash
-v data:/data                                           # named volume
-v $(pwd)/src:/usr/src/app:ro                           # bind mount (read-only)
--mount type=bind,source=/host,target=/container        # extended syntax
```

**Resources — control CPU/memory/disk I/O and limits:**
```bash
-c 512                                                # relative CPU shares (0–default; higher = more CPU)
--cpus=4                                              # hard cap: number of CPUs
--memory=4g --memory-reservation=3g                   # memory limit + soft reservation
-m 4g                                                 # shorthand for memory

# Device I/O limits
--device-read-bps /dev/sda:10mb                       # read rate from device
--device-write-iops /dev/vdb:500                      # write IO/s limit on device
```

**Security & isolation:**
```bash
-u root                                              # run as specific user (uid:gid format)
--userns=host                                        # share host's user namespace
--security-opt=no-new-privileges:true                # prevent privilege escalation
--cap-add=NET_ADMIN                                  # add Linux capability
--privileged                                         # full access (avoid in prod)
--read-only                                          # read-only rootfs
--init                                               # init process for signal forwarding + zombie reaping
```

**Healthchecks (critical for reliability):**
```bash
--health-cmd="curl -f http://localhost/ || exit 1"    # check command
--health-interval=30s                                  # how often to run
--health-start-period=60s                              # grace period before retries count
--health-retries=3                                     # consecutive failures to declare unhealthy
```

**Restart policies:** `--restart=on-failure:5` | `always` | `unless-stopped` | `no` (default)

## Dockerfile Best Practices

### Writing efficient Dockerfiles

**Multi-stage builds** — separate build environment from runtime to reduce image size:
```dockerfile
# Build stage
FROM golang:1.22-bookworm AS builder
WORKDIR /app
COPY . .
RUN CGO_ENABLED=0 go build -o myapp .

# Runtime stage
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y --no-install-recommends curl && rm -rf /var/lib/apt/lists/*
COPY --from=builder /app/myapp /usr/local/bin/myapp
USER 1000:1000
ENTRYPOINT ["myapp"]
```

**Layer caching strategy** — order instructions to maximize cache hits:
- Copy `go.mod` / `package.json` / `requirements.txt` first, then `RUN install`
- Copy application source code last (changes most frequently)
- Use `.dockerignore` to exclude unnecessary files from the build context

**.dockerignore essentials:**
```
.git
.gitignore
node_modules
__pycache__
*.md
.env
.dockerignore
Dockerfile
dist
build

From Kubementat/ai_agent_skills, MIT.

More from Kubementat/ai_agent_skills