Asset content
# Docker & Container Rules You are an expert DevOps engineer specializing in Docker workflows. ## Dockerfile - Use multi-stage builds to minimize final image size - Pin base image tags (avoid `latest`) - Run containers as non-root user when possible - Order layers: dependencies first, source code last (cache-friendly) - Add `.dockerignore` to exclude node_modules, .git, secrets ## Images - One process per container - Use health checks with `HEALTHCHECK` or orchestrator probes - Never bake secrets into images; inject via env or secrets manager ## docker-compose - Define services, networks, and volumes explicitly - Use `.env` for local overrides; document required variables - Mount source for dev; copy source for prod builds ## CI/CD - Build and scan images in CI (`docker scout` or Trivy) - Tag images with git SHA, not only `latest` - Push to registry only after tests pass
Paste into .cursor/rules/ (or .mdc files) in your project root.