Compatible with Cursor, Claude Code, Cline, Roo Code, Antigravity

Multi-Stage Dockerfile Hardening & Layer Caching

Optimize Dockerfiles for minimal image size, non-root security, layer caching, and CVE vulnerability reduction.

DockerContainersDevOpsSecurityCI/CD

v1.1.0 · Updated 2026-08

Skill Objective

Harden container images for production deployment: implement multi-stage builds, switch to non-root users, optimize layer caching, and eliminate CVE vulnerabilities.

Execution Workflow Procedure

Ordered steps the coding agent executes when performing this skill.

Separate Build and Runtime Stages

Isolate compilers, SDKs, and devDependencies in build stages, copying only production artifacts into minimal runtime base images (distroless/alpine).

Optimize Layer Caching Hierarchy

Order COPY commands so package manifests are cached before frequently changing application source code.

Enforce Non-Root Execution & Signal Forwarding

Switch to dedicated non-root users (USER node/nonroot) and format ENTRYPOINT so PID 1 properly forwards SIGTERM signals.

Agent Safety Guardrails & Anti-Hallucination Rules

DO NOT run production containers as the root user.
DO NOT include secrets, SSH keys, or development dependencies in final production images.

Expected Output Format

Multi-stage Dockerfile with inline annotations.

🐳 Production Dockerfile: Multi-stage, non-root Dockerfile.

⚡ Caching & Size Breakdown: Layer optimization summary.

Domain Verification Checks

Non-Root User: Enforces unprivileged container execution.

Distroless / Lean Base: Reduces image attack surface by 80%+.

Layer Cache Invalidation: Caches package installations across builds.

Example Agent Invocations

"Optimize this Node.js Dockerfile for faster CI layer caching and non-root execution."

"Harden this Spring Boot container image using distroless Java 21 base."

Install / Configure This Skill

# Place in .cursorrules or create .cursor/rules/dockerfile-hardening-caching.mdc
# Trigger: Whenever you perform multi-stage dockerfile hardening & layer caching

---
name: dockerfile-hardening-caching
description: Harden Dockerfiles with multi-stage builds, non-root user execution, layer caching, and distroless bases.
version: 1.1.0
compatibility: [Cursor, Claude Code, Cline, Roo Code, Antigravity]
---

# Multi-Stage Dockerfile Hardening & Layer Caching

## Objective
Build minimal, hardened container images with fast CI layer caching and zero root user vulnerabilities.

## Workflow
1. **Multi-Stage Build**: Separate build-time dependencies from minimal production runtime images.
2. **Layer Caching**: Copy package manifests before source code to maximize cache hits.
3. **Security Hardening**: Enforce `USER nonroot` and remove package managers from the final image.

Complementary Agent Prompt

Need a quick one-time prompt for chat?

Try the Production Dockerfile Multi-Stage Optimization & Hardening — a lightweight version designed for 1-click copying directly into Claude, ChatGPT, or Cursor chat.

View Prompt