The Agent Skills Directory

[SAFE]: The skill implements strong security defaults for containerization.
Least Privilege: The Dockerfile creates and uses a non-root user (appuser) for the production runtime, reducing the risk of container breakouts.
Hardened Runtime: Docker Compose configurations include security_opt: [no-new-privileges:true], preventing processes from gaining new privileges via suid or sgid bits.
Network Isolation: In production and QA stacks, no ports are published to the host for the application or database services. All communication occurs over an internal Docker network, with entry only via an Nginx proxy.
Resource Limits: Docker Compose files include CPU and memory limits to prevent Denial of Service (DoS) through resource exhaustion.
Safe Secret Management: The skill explicitly instructs users to define secrets via the orchestrator's UI rather than storing them in .env files or images. The .dockerignore file correctly excludes .env and node_modules.
Health Checks: Implements robust health checks using native tools (Node's fetch, PostgreSQL's pg_isready, and Nginx's wget) without introducing unnecessary dependencies.

dockerizar-app