Docker skill for Claude Code: the multi-stage Dockerfile skill and how to install it

Source: github/awesome-copilot · Maintainer: GitHub (awesome-copilot, community-contributed) · License: MIT · Checked: 23 October 2026

What is the multi-stage Dockerfile skill?

The multi-stage-dockerfile skill is a short checklist that makes an agent write Dockerfiles with a separate build stage and a lean runtime stage, so images come out smaller and with less attack surface. It is for developers who ask Claude Code or Copilot to containerize an app and want a sensible default instead of a single fat FROM node image.

It lives in github/awesome-copilot, GitHub's MIT-licensed collection of community-contributed agents, instructions and skills. The README says it is "sourced from third-party developers" and asks you to inspect anything before installing. The skill's description reads: "Create optimized multi-stage Dockerfiles for any language or framework".

Be clear about its size. The whole skill is one SKILL.md of roughly 330 words, five bulleted sections and nothing else. The repo history shows it began as a Copilot prompt file and was converted to a skill in February 2026, in a commit titled "Convert all prompts to skills and update plugin manifests". That explains the tone: it opens with "Your goal is to help me create efficient multi-stage Dockerfiles", like a prompt rather than a reference guide.

Even so, it's popular. As of 23 October 2026 its skills.sh page listed about 29,700 installs, with Pass results from Gen Agent Trust Hub, Socket and Snyk.

What does it do?

The SKILL.md gives the agent five groups of rules:

• Multi-stage structure. A builder stage for compiling and installing dependencies, a separate runtime stage with only what's needed to run, named stages with AS, and an order of dependencies, build, test, runtime.
• Base images. Official, minimal images; exact version tags such as python:3.11-slim rather than python; distroless or Alpine runtimes where they fit.
• Layer optimization. Put rarely changing steps (dependency installs) before often changing ones (your code), use .dockerignore, combine related RUN commands with &&, and use COPY --chown.
• Security. Run as a non-root USER, remove build tools from the final image, scan the image, set restrictive permissions, and keep build secrets out of the final stage.
• Performance. Build arguments for per-environment settings, cache-aware ordering, NODE_ENV=production-style runtime variables, and a HEALTHCHECK.

There are no supporting files: no example Dockerfiles, templates or scripts. The agent applies the bullets to whatever language it finds in your project.

What it does well

The rules match Docker's own guidance. Docker's building best practices open with multi-stage builds and also cover .dockerignore, minimal base images, pinning versions and running as a non-root USER. For a short skill, it gets the important defaults right, and being short means it costs little context when it loads.

What it misses

Measured against Docker's docs, a few gaps stand out:

• Build secrets. The skill relies on multi-stage builds to keep secrets out of the final image. Docker's build secrets page says build arguments and environment variables "are inappropriate for passing secrets" because they persist in the image, and recommends secret mounts (RUN --mount=type=secret) or SSH mounts instead.
• Cache mounts. Docker's cache optimization guide shows RUN --mount=type=cache for package manager caches such as npm, Go modules and apt. The skill doesn't mention it.
• Digest pinning. The skill pins tags. Docker notes tags are mutable and suggests pinning to a digest (image:tag@sha256:...) for full supply chain integrity, with Dependabot or Docker Scout to keep pins current.
• Dated example. It uses node:18 as a stage example. Node.js 18 reached end of life on 30 April 2025, per the Node.js release schedule. Treat it as syntax, not a version recommendation.
• No verification step. It doesn't tell the agent to build the image, run Docker's build checks, or name a scanner.

How do you install the Docker skill?

With the skills CLI, as shown on the skills.sh page (see the skills CLI README):

npx skills add https://github.com/github/awesome-copilot --skill multi-stage-dockerfile

Add -g for all projects and -a claude-code to target Claude Code. The folder lands in .claude/skills/multi-stage-dockerfile/, or ~/.claude/skills/multi-stage-dockerfile/ with -g, the standard Claude Code skill locations.

With GitHub CLI. The awesome-copilot skills index lists a gh command for every skill. The gh skill command needs GitHub CLI 2.90.0 or later, per GitHub's changelog, and the manual documents --agent and --scope:

gh skill install github/awesome-copilot multi-stage-dockerfile --agent claude-code --scope user

Without --agent, non-interactive installs default to GitHub Copilot. You can also copy the folder by hand. Codex and Cursor read the same SKILL.md format; see Codex skills and Cursor skills.

How do you use it?

Example prompts (suggestions, not quotes from the repo):

• Containerize this Next.js app with a multi-stage Dockerfile and a .dockerignore.
• Rewrite our Python Dockerfile so the runtime image has no compilers and runs as a non-root user.
• Make this Go service's image as small as possible, distroless if it works.
• Reorder the Dockerfile so dependency installs stay cached when only source files change.

Requirements: none in the skill itself. You need Docker (or another builder) to build and test the result.

How do you extend it?

Because it is one file under the MIT License, the practical move is to copy it and add the rules your team cares about. A few lines grounded in Docker's docs cover the gaps above:

## Build secrets and caching
- Never pass secrets with ARG or ENV. Use RUN --mount=type=secret,id=<name> and build with --secret.
- Use RUN --mount=type=cache,target=<cache dir> for package manager caches (npm, pip, Go, apt).

## Pinning and checks
- Pin base images to a tag plus digest, e.g. alpine:3.21@sha256:<digest>, and note how pins get updated.
- After writing the Dockerfile, run docker build --check . and fix any warnings.
- Build the runtime target and confirm the container starts and passes its HEALTHCHECK.

docker build --check . runs Docker's build checks without building. You might also add a references/ folder with one tested Dockerfile per language you ship, which gives the agent concrete patterns instead of general bullets. Our guide on how to write a SKILL.md covers structure and descriptions.

Tips and limits

• Short by design. Expect sound defaults, not deep, language-specific tuning.
• Nothing runs. No scripts or binaries, so the risk is low; it only changes what the agent writes.
• Community content. awesome-copilot is curated by GitHub but contributed by many authors. Read the file, which takes a minute.
• License. MIT, copyright GitHub, Inc. Keep the notice if you copy it.

Save it in your Kipt library

In Kipt, open Skills and paste the skill's GitHub folder link into the import box. Kipt reads the SKILL.md; for a repo with many skills it shows a list to pick from. You can also drop the folder or a .zip, which suits this skill well: extend it on your machine, then import your version. Your skills live in your own private GitHub repo and install into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with GitHub or awesome-copilot.

Similar skills

• Terraform skill: HashiCorp's official skill for the infrastructure that runs your containers.
• Security and hardening skill: secrets, headers and dependency checks for the app inside the image.
• Semgrep skill: Trail of Bits' scanner skill, whose ruleset catalog includes Dockerfile rules.
• Best Claude Code skills: more skills worth adding.