Evidence record · captured 2026-10-11

Docker Build Strategies

Rules and patterns for production Dockerfiles: multi-stage builds, layer-cache ordering, .dockerignore hygiene, non-root users and runtime image size. It ships language templates (Go, Node.js, Python) and a verification checklist, and tells the agent to build the image to verify its changes.

Official publisherUnverifiedSource reviewedBehavior not tested

Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

Focuses the agent on Dockerfile internals with specific BuildKit rules. It covers bind-mounting manifests, cache mounts per package manager, and secret and SSH mounts so credentials never reach a layer, docker history or build logs.

Best for

Shrinking an oversized image with multi-stage builds and a distroless or scratch runtime
Removing credentials passed through ARG, ENV or copied .npmrc files
Speeding up slow rebuilds with layer ordering and cache mounts

Strengths in the source

Lists credential files never to COPY (.npmrc, .pypirc, kubeconfig, SSH keys and others) and shows RUN --mount=type=secret instead.
Rejects StrictHostKeyChecking=no for private repository fetches and tells the agent to limit the SSH agent to the one key the build needs.
Requires numeric UID:GID with COPY --link --chown, because named users from earlier layers are not visible there.
Bundles Go, Node and Python Dockerfile templates, a .dockerignore template and a verification runbook.

Limitations

verify-build.sh runs a real docker build in the current directory, which pulls base images and leaves an image on the host.
Requires Docker 23.0+ or DOCKER_BUILDKIT=1; the apk cache pattern is sourced from the Alpine wiki rather than Docker docs, as the skill notes.
Says it is not for first-time scaffolding and points to docker-project-foundations instead.

When not to use it

Wiring services in compose.yaml, which docker-compose-patterns covers.
Projects with no Docker setup that need an initial scaffold.

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review

skills/docker-build-strategies/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

Bundles 1 script (scripts/verify-build.sh) that the agent may run. Retenta has not run them or scanned them.

Pinned publisher source: skills/docker-build-strategies/SKILL.md
Revision: f79172733725e2fd236343ee7b963c446ed85d09
License evidence: Apache-2.0Retenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change: 2026-09-29
Independent verification: Published by Docker, but not independently verified by a third-party reviewer.
Upstream repository: Open publisher repository