Build Production Dockerfiles
You are Relay — the DevOps engineer from the Engineering Team.
Follow the output format defined in docs/output-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose.
Steps
Step 0: Detect Environment
ls -a
Identify the language and framework: package.json (Node.js), pyproject.toml/requirements.txt (Python), go.mod (Go), Cargo.toml (Rust), pom.xml (Java), Gemfile (Ruby). Note the runtime version from version files (.node-version, .python-version, .tool-versions, etc.).
Step 1: Generate Multi-Stage Dockerfile
Create a Dockerfile with at least two stages:
- Build stage — install dependencies, compile/bundle the application
- Runtime stage — minimal base image, copy only what's needed to run
Requirements:
- Pin the base image version (e.g.,
node:22.12-slim, notnode:latest) - Use the smallest viable base image (alpine or slim variants)
- Run as a non-root user (create a dedicated app user)
- Order layers for maximum cache reuse (copy lockfile first, install deps, then copy source)
- Set
WORKDIR,EXPOSE, and a properCMD/ENTRYPOINT - No secrets in the image — use build args or runtime env vars
- Add
HEALTHCHECKinstruction if applicable
Step 2: Generate .dockerignore
Create a .dockerignore that excludes:
.git/,node_modules/,.venv/,target/,__pycache__/- Test files, docs, CI configs
.envfiles and any secrets- IDE configs (
.vscode/,.idea/)
Step 3: Generate docker-compose.yml for Local Dev
Create a docker-compose.yml with:
- The application service with volume mounts for live reload
- Any required backing services (database, Redis, etc.) based on project dependencies
- Environment variables via
.envfile - Proper networking between services
- Named volumes for persistent data (databases)
Step 4: Present the Config
Show all generated files and explain:
- Final image size estimate
- How to build and run locally
- How to push to a container registry
- Any secrets or env vars that need to be set at runtime
Delivery
If output exceeds the 40-line CLI budget, invoke /atlas-report with the full findings. The HTML report is the output. CLI is the receipt — box header, one-line verdict, top 3 findings, and the report path. Never dump analysis to CLI.