Dockerfile Optimizer
Smaller, faster, safer images — multi-stage, manifest-before-source caching, non-root, no secrets in layers. Verified still-runs.
v1.0.0 · ~558 tokens · ⬇ 0 · Updated July 6, 2026
What it does
Optimizes a Dockerfile on three axes: size (multi-stage, slim/distroless base, prod-only deps, .dockerignore), build speed (copy manifests + install before source for cache, pinned versions), and security (non-root USER, no secrets baked into layers, digest-pinned base, minimal surface). Verifies the optimized image still builds and runs.
Example uses
Shrink a bloated Node image
The image ships build tools and dev dependencies it doesn't need at runtime.
Our Node API image is 1.9 GB because the Dockerfile copies the whole repo and runs npm install in a single stage. Convert it to a multi-stage build on node:22-slim with production deps only and a proper .dockerignore — then verify the image still builds and boots.Stop cache-busting rebuilds
Every small code change reinstalls all dependencies and the build crawls.
Every code change triggers a full pip install in our Docker build and adds four minutes. Reorder the Dockerfile so requirements.txt is copied and installed before the source, and pin the base image so the cache stops busting at random.Harden a container for production
A security review flagged root execution and a secret baked into a layer.
A security review flagged our container: it runs as root and an API key was passed as a build ARG. Rework the Dockerfile with a non-root USER, move the secret to runtime injection, and pin the base image by digest — then confirm the app still runs.Install
# 1. Create the skill folder in your Claude setup mkdir -p ~/.claude/skills/dockerfile-optimizer # 2. Download SKILL.md into it (or move the file you just downloaded) # → ~/.claude/skills/dockerfile-optimizer/SKILL.md # 3. Claude Code auto-discovers it on next launch.
Inside the skill
--- name: dockerfile-optimizer description: Optimize a Dockerfile for size, build speed, and security. Use when writing or reviewing a Dockerfile, when images are huge or builds are slow, or asked "optimize this Dockerfile", "reduce image size", "why is my build slow". Multi-stage, cache-friendly, non-root. --- # Dockerfile Optimizer A good image is small, builds fast on cache, and doesn't ship a root shell and your build tools to production. Fix all three. ## Size - **Multi-stage build**: build in a fat stage, copy only the artifacts into a slim runtime stage. Ship the binary/dist, not the compiler, dev deps, and source. - **Slim base**: `-slim`/`alpine`/distroless where viable. Don't ship a full OS to run one binary. - **Prune**: production deps only (`npm ci --omit=dev`, `pip --no-cache-dir`); clean package caches in the SAME layer you install (a separate `rm` layer doesn't shrink the image). - `.dockerignore`: exclude `.git`, `node_modules`, tests, secrets — smaller context, faster build, safer. ## Build speed (layer caching) - **Order by change frequency**: copy dependency manifests and install BEFORE copying source. Then a source edit doesn't reinstall every dependency. This is the single biggest win. - Combine related `RUN`s; each instruction is a layer. - Pin versions for reproducibility (a floating `latest` base busts cache and drifts). ## Security - **Non-root**: create and `USER` a non-root user; don't run the app as root. - No secrets in layers (build args/ENV bake into the image and history) — use build secrets or runtime injection. A secret in any layer is a secret in the shipped image. - Pin the base by digest for supply-chain integrity; scan for known CVEs. - Minimal surface: no shell/package manager in the runtime image if you don't need it (distroless). ## Rules - Multi-stage + manifest-before-source caching are the two highest-value changes — start there. - Never bake a secret into an image layer; layers are forever and extractable. - Verify the optimized image still runs (build + run + smoke) — don't ship a smaller broken image. ## Output The optimized Dockerfile, what changed and why (size/speed/security), and the before→after image size if measurable.
Changelog
- v1.0.02026-07-03Initial clean-room write.
Frequently asked questions
Is Dockerfile Optimizer free?
Yes. Dockerfile Optimizer is free to download and MIT-licensed.
Where do I install Dockerfile Optimizer?
Place the SKILL.md file in ~/.claude/skills/dockerfile-optimizer/ and Claude Code auto-discovers it on next launch.
How many tokens does Dockerfile Optimizer use?
About 558 tokens — it is designed to be token-lean.
We're developers and SaaS builders who use these tools daily in production. Every review comes from hands-on experience building real products — DealPropFirm, ThePlanetIndicator, PropFirmsCodes, and many more. We don't just review tools — we build and ship with them every day.
Written and tested by developers who build with these tools daily.