The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The skill enforces security best practices by explicitly creating a non-privileged rails user in the production Dockerfile and switching to it using the USER instruction, ensuring the application does not run as root.
[CREDENTIALS_UNSAFE]: The instructions and templates provide guidance on secure secret management, recommending the use of encrypted Rails credentials and git-ignored environment files (.kamal/secrets) rather than hardcoding secrets in the Dockerfile or configuration files.
[EXTERNAL_DOWNLOADS]: The skill utilizes official, well-known base images from Docker Hub (ruby:3.x-slim, postgres:16-alpine, redis:7-alpine) and standard package managers (apt-get, bundle) for dependencies, which are considered safe sources.
[COMMAND_EXECUTION]: Shell instructions provided for the Docker entrypoint and Kamal hooks (db:prepare, db:migrate) are standard application maintenance tasks and follow idempotent patterns to prevent deployment races.

kamal-docker-production