dockerfile-patternslisted

> Migrated 2026-06-02 from `~/.claude/rules-library/dockerfile/` as part of the lazy-rules-loading plan. Phase H will delete the source files. # dockerfile-patterns <!-- ============================================================ Section: dockerfile/coding-style.md ============================================================ --> # Dockerfile Coding Style > Auto-fires on every `Dockerfile`, `Dockerfile.*`, `*.dockerfile`, > `Containerfile`, and `*.containerfile` file. Standards: **Dockerfile > reference (docs.docker.com)**, **OCI Image Specification 1.1.1** > (Sept 2024), **BuildKit syntax 1.20+**, **Hadolint** lint rule > catalogue, **CIS Docker Benchmark 1.7**, **NIST SP 800-190** > (Application Container Security Guide). ## Core Principle **Every Dockerfile is multi-stage by default; pins the base image to a versioned tag plus `@sha256:` digest; runs as a non-root user; declares an explicit `WORKDIR`; uses `COPY` over `ADD`; chains `apt-get update` with `apt-get install` and cleans the package cache in the same `RUN` layer; declares `HEALTHCHECK` and the runtime contract via `EXPOSE` (documentary), `CMD` (default command), and `ENTRYPOINT` (executable form); refuses `latest` tags, root accounts, secrets at build time, shell-form RUN with interpolated variables, and ADD with untrusted URLs.** A Dockerfile is the recipe for every replica that will ever run the service. Sloppy Dockerfiles produce 2 GB images, root-running containers, mystery dependency versio