Evidence record · captured 2026-10-11

Docker Compose Patterns

Rules for creating, reviewing and debugging compose.yaml: service definitions, health checks with depends_on conditions, volumes and networks, environment variables, and compose.override.yaml for development. Includes example files, a bad-vs-good comparison and a verification checklist.

Official publisherUnverifiedSource reviewedBehavior not tested

Source review

Editorial assessment

This is a source-only assessment. It does not claim runtime or security testing.

What it does

Covers service wiring rather than images: readiness-gated depends_on, a healthcheck sidecar for distroless images, and Compose Watch, with an explicit stop before any command that deletes volume data.

Best for

Fixing a stack where the app starts before its database is ready
Adding health checks to services built on distroless or scratch images
Splitting development settings into compose.override.yaml with develop.watch

Strengths in the source

Requires depends_on with condition: service_healthy and a matching healthcheck, noting that bare depends_on only guarantees container start.
Shows a curl sidecar sharing the app's network namespace so distroless images get health checks without added tools.
Requires the agent to state what data will be deleted and get confirmation before docker compose down -v or volume removal.
verify-compose.sh validates with docker compose config --quiet so interpolated secrets are not printed.

Limitations

Assumes Compose v2 and treats docker-compose.yml as a legacy name, which may conflict with older tooling.
Targets local and single-host stacks; it does not address Swarm or Kubernetes deployment.
Compose warnings from the verify script can still contain sensitive details, as the skill itself notes.

When not to use it

Dockerfile size, caching or non-root user work, which belongs to docker-build-strategies.
Standalone docker system prune or volume cleanup outside a Compose project, which the skill routes to docker-destructive-guardrails.

Reviewed by Retenta editorial on 2026-10-11; scope: source only.

Files included in this review

skills/docker-compose-patterns/SKILL.md

Evidence and boundaries

Execution · not tested

Retenta has not executed this skill.

Security · not tested

Bundles 1 script (scripts/verify-compose.sh) that the agent may run. Retenta has not run them or scanned them.

Pinned publisher source: skills/docker-compose-patterns/SKILL.md
Revision: f79172733725e2fd236343ee7b963c446ed85d09
License evidence: Apache-2.0Retenta preserves the license text captured with this immutable upstream snapshot; no independent legal or security review is claimed.
Last source change: 2026-09-29
Independent verification: Published by Docker, but not independently verified by a third-party reviewer.
Upstream repository: Open publisher repository