Dockerfile Optimizer — analyzer + hardened templates

    1

    Shrink image sizes and accelerate build caching with automated multi-stage Dockerfile refactoring.

    Free

    0 installsSecurity scanned

    Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    Dockerfile Optimizer — analyzer + hardened templates

    Example session with this skill installed

    Review my Dockerfile. It's a Node/Express API, the image is huge and every code change reinstalls dependencies.

    FROM node:latest
    ENV NPM_TOKEN=npm_abc123
    WORKDIR /app
    COPY . .
    RUN apt-get update && apt-get install -y python3 make g++
    RUN npm install
    RUN npm run build
    CMD npm start

    • Read your context and instructions
    • Compiled the dockerfile optimizer
    • Generated the document

    Analyzer report on your Dockerfile (python scripts/analyze.py Dockerfile):

    score 0/100 - 1 stage, runs as root
    ERROR D001 line 1 - base image node:latest has no tag or uses :latest
    ERROR D002 line 1 - build step present but single-stage image; use a multi-stage build
    ERROR D011 line 1 - no .dockerignore next to the Dockerfile
    ERROR D009 line 2 - secret-looking value in ENV is stored in image history; use BuildKit --mount=type=secret or runtime env
    ERROR D004 line 4 - COPY . . runs before dependency install; copy manifests/lockfile first so the deps layer is cached
    ERROR D005 line 5 - apt-get install without --no-install-recommends and/or apt cache cleanup (apt-get clean) in the same RUN
    ERROR D008 line 6 - use npm ci (lockfile-exact) instead of npm install
    ERROR D003 line 8 - image runs as root; add a non-root USER in the final stage
    ERROR D007 line 8 - no HEALTHCHECK for a service image
    ERROR D012 line 8 - no EXPOSE on a service image
    WARN W002 line 8 - shell-form CMD: PID 1 is /bin/sh, signals are not forwarded
    10 error(s), 1 warning(s)

    Rewritten Dockerfile (assets/node.Dockerfile adapted; python3/make/g++ dropped because no native modules are in package.json - tell me if there are):

    syntax=docker/dockerfile:1.7

    ARG NODE_VERSION=20.18
    FROM node:${NODE_VERSION}-alpine AS deps
    WORKDIR /app
    COPY package.json package-lock.json ./
    RUN --mount=type=cache,target=/root/.npm npm ci --omit=dev

    FROM node:${NODE_VERSION}-alpine AS build
    WORKDIR /app
    COPY package.json package-lock.json ./
    RUN --mount=type=cache,target=/root/.npm npm ci
    COPY . .
    RUN npm run build

    FROM node:${NODE_VERSION}-alpine AS runtime
    ENV NODE_ENV=production
    RUN addgroup -g 10001 -S app && adduser -u 10001 -S app -G app
    WORKDIR /app
    COPY --from=deps --chown=app:app /app/node_modules ./node_modules
    COPY --from=build --chown=app:app /app/dist ./dist
    COPY --chown=app:app package.json ./
    USER app
    EXPOSE 3000
    HEALTHCHECK --interval=30s --timeout=3s --start-period=10s CMD wget -qO- http://127.0.0.1:3000/healthz || exit 1
    CMD ["node", "dist/server.js"]

    Plus a .dockerignore (node_modules, .git, dist, .env*, Dockerfile*).

    Analyzer report on the rewrite: score 100/100 - 3 stages, runs as app - 0 error(s), 0 warning(s)

    Before / after

    • Stages: 1 -> 3 (deps, build, runtime)
    • Final base: node:latest (~1.1 GB) -> node:20.18-alpine (~180 MB + app). Estimate; run docker image ls to confirm.
    • Runs as: root -> app (uid 10001)
    • Code change: reinstalls everything -> deps layer cached, only build stage reruns
    • Secret: baked into image history -> removed; rotate NPM_TOKEN now, it is already in your registry

    Next: add /healthz to the app if it does not exist, and set NPM_TOKEN via --mount=type=secret in the build stage if you need private packages.

    dockerfile-optimizer-analyzer-hardened-t.pdf

    PDF · document

    Generated

    Example file from a real run - the skill writes it into your workspace.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The problem

    Docker images are often bloated, slow to build and run as root. Most Dockerfiles copy the whole source before installing dependencies, so every code change reinstalls everything, and compilers ship to production.

    What this skill does

    It makes the agent prove the result instead of describing it. scripts/analyze.py (python3, no dependencies, read-only: it only reads the Dockerfile and prints a report) scores any Dockerfile 0-100 against 12 rules: root user, :latest or untagged base, secrets in ENV/ARG, COPY . . before dependency install, apt cache left in the layer, npm install instead of npm ci, remote scripts piped into a shell, ADD for local files, missing HEALTHCHECK/EXPOSE/.dockerignore, single-stage image with a build step. It reports line numbers and exits non-zero on errors, so it also works in CI.

    The SKILL.md workflow: analyze the original, classify the app, adapt one of five reviewed templates (Node, Python, Go on distroless, Java on Temurin JRE, Rust on distroless cc; all multi-stage, non-root with fixed UID 10001, BuildKit cache mounts), write a .dockerignore, re-run the analyzer until it reports 0 errors, then show a before/after table with an honest size estimate (measured with docker image ls when Docker is available).

    What's in the zip

    SKILL.md, README.md, scripts/analyze.py, assets/ (5 Dockerfile templates + dockerignore), examples/ (a 0/100 Dockerfile, its 100/100 rewrite, both analyzer reports). Nothing in the zip executes system commands, deletes files or changes permissions; the analyzer is a pure text parser.

    Why it's free

    This is one of five skills built the same way (each ships a script the agent must run). The other four - OWASP security review with a hotspot scanner, Playwright E2E generator, hardened GitHub Actions with a linter and SHA pinner, PR/changelog writer from the real git range - are on my Gumroad profile. Try this one first.

    Known limitations

    The analyzer is static: it cannot tell whether native modules are needed at runtime or measure image size without Docker. Distroless/scratch bases get a warning instead of an error for missing HEALTHCHECK (no shell); use an orchestrator probe.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Free forever

    No account required to browse

    Trust & safety

    Security scanned

    Verified clean today

    • Free to download with an account

    Listedtoday

    Frequently Asked Questions