docker
覆盖多阶段构建与 BuildKit 技巧，适合部署与 CI 场景
提供生产级 Dockerfile 设计、镜像体积与安全优化与扫描建议
提供生产级的 Dockerfile 设计、镜像瘦身与安全加固建议，涵盖 multi-stage builds、distroless、BuildKit 缓存、多架构构建等实践。适合在写 Dockerfile、优化镜像体积、调试容器或做漏洞扫描与容器加固时使用（可对接 trivy、Docker Scout）。特别强调非 root 运行、seccomp/capabilities 限制和可落地的扫描流程，注重实用性与安全性。
▸ 展开 SKILL.md 英文原文
Optimize Docker images with multi-stage builds, distroless bases, BuildKit cache mounts, multi-arch builds, compose watch, security hardening (non-root, seccomp, capabilities drop), and vulnerability scanning via docker scout/trivy. Use when user asks to write a Dockerfile, optimize image size, set up docker-compose, debug containers, harden container security, or scan for CVEs. Do NOT use for Kubernetes deployments (use kubernetes), CI/CD pipeline design (use ci-cd), or Terraform (use terraform).
帮我安装这个 skill：https://raw.githubusercontent.com/EliasOulkadi/shokunin/master/.pack/skills/docker/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/EliasOulkadi/shokunin/master/.pack/skills/docker/SKILL.md"# Docker Architect Production-grade Dockerfiles, multi-stage builds, cache optimization, security scanning, and local development. Applies Google's distroless philosophy and Docker BuildKit best practices. ## Decision Framework Before containerizing, answer: - Does the app need process isolation? → Docker - Will it deploy to Kubernetes? → Docker + distroless + non-root - Is it a monolith with simple deployment? → Docker Compose - Is it a static site? → Consider nginx:alpine single-stage - Is the team already using Docker Compose in dev? → Start there, add K8s when needed - Is the app latency-sensitive (sub-ms)? → Bare metal or VM; container overhead matters at extreme scale ## Workflow