docker — Cursor rule: what it does, how to install
Cursor rule enforcing production Docker practices. Generates minimal, hardened containers with non-root users, layer caching, and pinned base images.
.cursor/rules/docker.mdcWhat docker does
The rule triggers on Dockerfile, docker-compose*.yml, docker-compose*.yaml, and .dockerignore. It instructs Cursor to avoid :latest tags, pinning images to exact versions such as node:20.11-alpine3.19. Compiled projects are split into multi-stage builds. To keep layers small, it chains RUN commands with && and structures copying: dependency manifests first, then package install, then application source.
Security requirements are strict. Running containers as root in production is banned. Containers must switch to a non-root user before CMD and assign permissions via COPY --chown. Build arguments cannot contain secrets, and .env files must stay out of image layers. For scanning vulnerabilities in CI, it recommends docker scout or trivy.
Logging stays strictly on stdout and stderr. Containers must never write log files to internal disk paths.
What it helps with
- prevent production containers from running under the root user
- structure Dockerfile layer caching for package installation
- populate
.dockerignoreto filter out.envandnode_modules - configure bridge networking and named volumes in Docker Compose
Example prompts for the agent
- Generate a multi-stage
Dockerfilefor a Go backend using non-root permissions. - Review my
docker-compose.ymlfor forbidden bind mounts and host networking. - Create a
.dockerignorefile that blocks secrets and local build artifacts.
How to install docker
Manually: put the files in place
.cursor/rules/docker.mdcFrontmatter: description, globs, alwaysApply
Manually: put the files in place
.claude/rules/docker.mdThe paths frontmatter field limits the files: move globs from the source into paths
AGENTS.md
Codex reads AGENTS.md: paste the rule text there
Manually: put the files in place
.github/instructions/docker.instructions.mdThe applyTo field sets which files it applies to: move globs from the source into applyTo
Manually: put the files in place
.devin/rules/docker.mdManually: put the files in place
.clinerules/docker.mdStep by step, with commands for each platform: Cursor rules: .mdc files, four modes and what replaced .cursorrules
Questions about docker
How do I install the docker rule in Cursor?
Create a file at .cursor/rules/docker.mdc in your workspace and paste the rule contents into it. Cursor reads the file when editing Docker-related configs.
What practices does this rule forbid?
It forbids the :latest tag in production, root execution, and passing secrets into build args. It also bans using ADD when COPY works.
How does the rule handle container storage and networking?
Persistent data must use named volumes, reserving bind mounts strictly for local development. Network communication requires custom bridge networks instead of host mode.
Source text
docker.mdc · CC0-1.0
--- description: "Docker production rules. Pinned versions, multi-stage builds, non-root user, minimal attack surface." globs: Dockerfile, Dockerfile.*, docker-compose*.yml, docker-compose*.yaml, .dockerignore alwaysApply: false --- # Docker Rules Expert Docker practitioner. Minimal, secure, reproducible images. ## Dockerfile - Pin versions: FROM node:20.11-alpine3.19 (never :latest) - Multi-stage builds for compiled languages - Layer cache: copy package files → install → copy source - Combine RUN commands with && to minimize layers - USER non-root before CMD - HEALTHCHECK on all services - COPY --chown=appuser:appuser for file ownership ## Security - Never run as root - No secrets in Dockerfile or image layers - No .env files copied into image - Scan with docker scout or trivy in CI ## .dockerignore - Always present: node_modules, .git, *.log, .env*, test files ## Volumes - Named volumes for persistence - Bind mounts for dev only, never production ## Networking - Custom bridge networks, not host networking - Reference services by name in compose ## Logging - Always stdout/stderr — never log to files inside container ## Forbidden - No :latest tags in production - No ADD when COPY works - No root user in production - No secrets in build args or image layers
© PatrickJS · CC0-1.0 · PatrickJS/awesome-cursorrules
