Codex skills for Docker
With these skills Codex writes Dockerfiles that keep the dependency layer cached, build in separate stages and end on a numeric non-root user, then measures images with dive before slimming them. Compose stacks wait on healthchecks, dev containers share one setup script with CI and Codex cloud, and scans with Trivy or Grype point fixes at the base image.
Start with these 3
- Docker Compose for Local Dev One command up, every service healthy Codex writes compose.yaml files where the app waits for a healthy database instead of crashing on boot, migrations run as one-shot services, rarely used tools sit behind profiles, and Compose Watch syncs code or rebuilds on lockfile changes. Ports bind to loopback, secrets stay out of the file, and the stack is proven with docker compose up --wait.
- Docker Image Slimming Cut gigabytes from images without breaking them Codex measures an image before touching it, using docker history and dive to find the layers that matter, then applies one change at a time: multi-stage builds, slim or distroless bases, cache mounts, production-only dependencies. It states the libc and debuggability trade-off of each base, smoke-tests every platform, and reports before and after sizes, compressed and uncompressed.
- Docker Networking Find the broken hop between containers fast Codex debugs container connectivity layer by layer, testing DNS, listening address, port publishing and firewall from inside the network with netshoot instead of guessing. It moves services onto user-defined Compose networks, binds internal ports to localhost, resolves VPN subnet clashes and MTU hangs through daemon settings you approve, and audits which ports the host really exposes.
7 more Docker skills
-
Dockerfile Best Practices
Small, cached, non-root images that stop on SIGTERM -
Dev Containers
Clone, open, tests pass, same as CI -
VPS Deploys
One server, done properly, with tested backups -
Container Scanning
Fix the base, not one CVE at a time -
Testcontainers
Test against real Postgres, not a lookalike -
Kamal Deploys
Zero-downtime container deploys to your own servers -
Fly.io
Machines, volumes and regions without surprises
General skills with Docker guidance
Not built around Docker, but they include steps or tools for it. Not part of the install-all command.
-
uv Python Packaging
One lockfile from laptop to Docker to PyPI -
AWS Lambda
Faster cold starts, no reprocessed batches -
Git Worktrees
Two branches checked out at once, no stashing -
Vite Config
A vite.config.ts where every line earns its place -
Ktor Server
Kotlin APIs with plugins that tests can swap -
Bun Runtime
Adopt Bun without surprise Node fallbacks -
Streamlit Apps
Fast reruns, deliberate state, tested pages -
vLLM Serving
Size KV cache from traffic, then benchmark it -
CI Speedup
Measure the critical path, then cut it -
Caddy Server
HTTPS by default, a Caddyfile you can read -
Linux Server Hardening
Lock down a VPS without locking yourself out -
Container Registries
Immutable tags, digest deploys, safe cleanup
Every Docker skill in one command
Installs these 10 into ~/.agents/skills/. Add --project after -- to install into the current repository instead.
The installer is a 104-line POSIX shell script. It fetches the skills you name from codexskills.dev and unpacks each into its own folder in your skills directory. No sudo, no telemetry, and every skill page shows the full SKILL.md first. Read install.sh
curl -fsSL codexskills.dev/install.sh | sh -s -- docker-compose-dev docker-image-slimming docker-networking dockerfile-best-practices devcontainers vps-deploys container-scanning testcontainers kamal-deploys fly-io Docker FAQ
Can Codex build my Docker image if its sandbox has no network?
Dockerfile Best Practices notes that building and pulling base images needs network and a running Docker daemon. In a Codex sandbox with network off, it writes the Dockerfile, runs the bundled scripts/dockerfile_audit.py check, and asks you to run the build or approve network access.
Does Codex use Alpine or distroless base images?
Dockerfile Best Practices picks the base by language: slim Debian images for Node because Alpine's musl breaks native modules like sharp and bcrypt, and distroless static images with a nonroot user for Go and Rust binaries. It never ships a :latest tag. Docker Image Slimming states the libc and debuggability trade-off of each base and measures before and after sizes.
How do I stop my app container starting before Postgres is ready in Docker Compose?
Docker Compose for Local Dev adds a healthcheck to the database and uses depends_on with condition: service_healthy, since a plain depends_on only orders container start. It also binds ports to 127.0.0.1, keeps optional tools behind profiles, uses Compose Watch (Compose 2.22+) for live sync, and proves the stack with docker compose up --wait.
How do I install all 10 Docker skills at once?
Pass every name to the installer in one command: curl -fsSL https://codexskills.dev/install.sh | sh -s -- docker-compose-dev docker-image-slimming docker-networking dockerfile-best-practices devcontainers vps-deploys container-scanning testcontainers kamal-deploys fly-io. Add --project right after -- to put them in the current repository's .agents/skills/ so your team gets them too.
Which Docker skill should I try first?
Docker Compose for Local Dev is the closest fit for most Docker work. Mention it with $docker-compose-dev in a prompt to load it on purpose; after that, Codex picks it up on its own whenever a task matches.