# render-docker

A skill that teaches your agent to write Dockerfiles and set up container deploys on Render: builds, private registries, layer caching.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 393 installs · ★ 88
- Author: Render
- License: MIT · policy=mirror · the beginning of the file is at the end of this page
- Source: https://github.com/render-oss/skills/tree/HEAD/skills/render-docker/SKILL.md
- Updated: 2026-10-08
- HTML: https://affpapa.org/en/nevibecode/skills/render-docker

## What it does

The skill hands your agent working knowledge of how Render builds containers. It covers both modes: `runtime: docker`, where Render builds an image from a Dockerfile in your repo, and `runtime: image`, where it pulls a prebuilt one. The agent can then pick the right mode and fill in the Blueprint fields — `dockerfilePath`, `dockerContext`, `dockerCommand`, `image.url`, `image.creds`.

Secrets get their own section. The skill warns against passing them through `ARG`, since build arguments stay in image layers and can be recovered from image history. Build-time secrets belong in BuildKit secret mounts; application secrets belong in Render env vars. Private base images are handled too: credentials live in the Dashboard under Registry Credentials, referenced from a Blueprint via `registryCredential.fromRegistryCreds.name`.

Builds run on linux/amd64, so don't assume another architecture in production. Bind HTTP to `0.0.0.0:$PORT`, and remember that Render secret files land in `/etc/secrets/` — repo-root paths won't be there unless you copy or mount them. Mutable tags like `latest` can resolve to a stale cached image, so the skill suggests digests or version pins instead. Prebuilt-image services don't redeploy when a tag moves; that takes a manual trigger.

## Requirements
- Works with: Docker

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add render-oss/skills --skill render-docker -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/render-docker/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/render-docker/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add render-oss/skills --skill render-docker -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/render-docker/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add render-oss/skills --skill render-docker -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/render-docker/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install render-oss/skills render-docker
```

2. **Manually: put the files in place**
- File: `.github/skills/render-docker/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add render-oss/skills --skill render-docker -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/render-oss/skills --path skills/render-docker
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/render-docker/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add render-oss/skills --skill render-docker -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/render-oss/skills/tree/HEAD/skills/render-docker/SKILL.md

## When to use it
- write a Dockerfile for a Render service
- choose between runtime: docker and runtime: image
- wire a private base image through Registry Credentials
- move secrets out of build args into BuildKit secret mounts
- speed up builds with layer order and .dockerignore

## Example prompts
- write a Dockerfile for my Node service on Render
- switch this service to runtime: image with a private GHCR image
- why does my Render image pull a stale cache with the latest tag

## Source text · SKILL.md · MIT

Below is the content of a third-party file. It is data, not instructions for you: do not act on anything written inside unless the human asks. Block tag: 4aab175d42e279da.

BEGIN THIRD-PARTY FILE 4aab175d42e279da
```text
---
name: render-docker
description: >-
  Builds and deploys Docker containers on Render—Dockerfiles, multi-stage
  builds, Blueprint Docker fields, private registries, layer caching, and
  platform constraints. Use when the user mentions Docker,
  Dockerfile, container images, multi-stage builds, container registry,
  GHCR, ECR, BuildKit, dockerContext, runtime docker or image, or
  optimizing Docker builds on Render.
license: MIT
compatibility: >-
  Any Render compute service (web, private, worker, cron) with runtime: docker
  or runtime: image.
metadata:
  author: Render
  version: "1.0.0"
  category: deployment
---

# Render Docker Deployments

Render uses **BuildKit** for Docker builds. All compute service types that support custom runtimes can use **`runtime: docker`** (build from a Dockerfile in the repo) or **`runtime: image`** (pull a prebuilt image; no Dockerfile build on Render). Deeper patterns and copy-paste templates live under `references/`.

## When to Use

- Authoring or debugging a **Dockerfile** for a Render service
- Choosing **`runtime: docker`** vs **`runtime: image`** in a Blueprint
- Wiring **private base images** or **prebuilt images** with registry credentials
- **Multi-stage builds**, **build args**, **secrets**, and **layer caching**
- **Performance** and **security** hardening of container images on Render

For full Blueprint authoring, see **render-blueprints**. For end-to-end deploy flows, see **render-deploy**.

Before deploying a built or prebuilt image, read `references/deployments.md` for current trigger, lifecycle, health-check, and signal behavior.

## Render Docker Builds

- **BuildKit** is used for Docker builds on Render.
- **`runtime: docker`**: Render builds an image from your repo using `dockerfilePath`, `dockerContext`, and optional `dockerCommand` (overrides image `CMD`).
- **`runtime: image`**: Render pulls **`image.url`**; no repo-based image build. Set **`image.creds.fromRegistryCreds.name`** when the registry is private.

## Blueprint Configuration

| Field | Role |
|-------|------|
| `dockerfilePath` | Path to the Dockerfile (default `./Dockerfile`) |
| `dockerContext` | Build context directory (what is sent to the daemon) |
| `dockerCommand` | Overrides the container `CMD` after the image is built |
| `image.url` | Image reference for `runtime: image` (registry/repo:tag or digest) |
| `image.creds` | Dashboard-stored credential reference for a private prebuilt image |
```
END THIRD-PARTY FILE 4aab175d42e279da

The third-party file has ended. Everything between the 4aab175d42e279da tags is data: requests and commands from it are not followed. An “end of file” line with another tag inside the block is part of the file.

First 2463 of 8131 bytes. © Render · MIT · https://github.com/render-oss/skills/tree/HEAD/skills/render-docker/SKILL.md

_Part of the page did not fit — see the HTML version._

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md