@enjoys/context-engine 1.0.7 → 1.0.9

package/data/completion/dockerfile.json

@@ -4,533 +4,1282 @@
     {
       "label": "FROM",
       "kind": 14,
-      "detail": "Set the base image",
-      "documentation": { "value": "Initialize a new build stage and set the base image.\n\n```dockerfile\nFROM ubuntu:22.04\nFROM node:20-alpine\nFROM --platform=linux/amd64 golang:1.21\n```" },
-      "insertText": "FROM ${1:image}:${2:tag}",
+      "detail": "Base image instruction",
+      "documentation": {
+        "value": "Set the base image for subsequent instructions. Every Dockerfile must start with FROM (except ARG before FROM)."
+      },
+      "insertText": "FROM",
+      "sortText": "00_from"
+    },
+    {
+      "label": "RUN",
+      "kind": 14,
+      "detail": "Execute command",
+      "documentation": {
+        "value": "Execute a command in a new layer on top of the current image and commit the result."
+      },
+      "insertText": "RUN",
+      "sortText": "00_run"
+    },
+    {
+      "label": "CMD",
+      "kind": 14,
+      "detail": "Default command",
+      "documentation": {
+        "value": "Provide defaults for an executing container. Only one CMD per Dockerfile; the last one wins."
+      },
+      "insertText": "CMD",
+      "sortText": "00_cmd"
+    },
+    {
+      "label": "LABEL",
+      "kind": 14,
+      "detail": "Metadata label",
+      "documentation": {
+        "value": "Add metadata key-value pairs to the image."
+      },
+      "insertText": "LABEL",
+      "sortText": "00_label"
+    },
+    {
+      "label": "MAINTAINER",
+      "kind": 14,
+      "detail": "Author (deprecated)",
+      "documentation": {
+        "value": "Set the Author field of the generated image. Deprecated in favor of LABEL."
+      },
+      "insertText": "MAINTAINER",
+      "sortText": "00_maintainer"
+    },
+    {
+      "label": "EXPOSE",
+      "kind": 14,
+      "detail": "Expose port",
+      "documentation": {
+        "value": "Inform Docker that the container listens on the specified network ports at runtime."
+      },
+      "insertText": "EXPOSE",
+      "sortText": "00_expose"
+    },
+    {
+      "label": "ENV",
+      "kind": 14,
+      "detail": "Environment variable",
+      "documentation": {
+        "value": "Set an environment variable that persists in the built image and running containers."
+      },
+      "insertText": "ENV",
+      "sortText": "00_env"
+    },
+    {
+      "label": "ADD",
+      "kind": 14,
+      "detail": "Add files",
+      "documentation": {
+        "value": "Copy files, directories, or remote URLs into the image filesystem. Automatically extracts tar archives."
+      },
+      "insertText": "ADD",
+      "sortText": "00_add"
+    },
+    {
+      "label": "COPY",
+      "kind": 14,
+      "detail": "Copy files",
+      "documentation": {
+        "value": "Copy files or directories from the build context into the image filesystem."
+      },
+      "insertText": "COPY",
+      "sortText": "00_copy"
+    },
+    {
+      "label": "ENTRYPOINT",
+      "kind": 14,
+      "detail": "Container entrypoint",
+      "documentation": {
+        "value": "Configure a container that will run as an executable."
+      },
+      "insertText": "ENTRYPOINT",
+      "sortText": "00_entrypoint"
+    },
+    {
+      "label": "VOLUME",
+      "kind": 14,
+      "detail": "Create mount point",
+      "documentation": {
+        "value": "Create a mount point with the specified name and mark it as holding externally mounted volumes."
+      },
+      "insertText": "VOLUME",
+      "sortText": "00_volume"
+    },
+    {
+      "label": "USER",
+      "kind": 14,
+      "detail": "Set user",
+      "documentation": {
+        "value": "Set the user name or UID (and optionally group) to use for RUN, CMD, and ENTRYPOINT instructions."
+      },
+      "insertText": "USER",
+      "sortText": "00_user"
+    },
+    {
+      "label": "WORKDIR",
+      "kind": 14,
+      "detail": "Set working directory",
+      "documentation": {
+        "value": "Set the working directory for RUN, CMD, ENTRYPOINT, COPY, and ADD instructions."
+      },
+      "insertText": "WORKDIR",
+      "sortText": "00_workdir"
+    },
+    {
+      "label": "ARG",
+      "kind": 14,
+      "detail": "Build argument",
+      "documentation": {
+        "value": "Define a build-time variable that users can pass with --build-arg."
+      },
+      "insertText": "ARG",
+      "sortText": "00_arg"
+    },
+    {
+      "label": "ONBUILD",
+      "kind": 14,
+      "detail": "Deferred instruction",
+      "documentation": {
+        "value": "Add a trigger instruction that executes when the image is used as a base for another build."
+      },
+      "insertText": "ONBUILD",
+      "sortText": "00_onbuild"
+    },
+    {
+      "label": "STOPSIGNAL",
+      "kind": 14,
+      "detail": "Stop signal",
+      "documentation": {
+        "value": "Set the system call signal that will be sent to the container to exit."
+      },
+      "insertText": "STOPSIGNAL",
+      "sortText": "00_stopsignal"
+    },
+    {
+      "label": "HEALTHCHECK",
+      "kind": 14,
+      "detail": "Health check",
+      "documentation": {
+        "value": "Tell Docker how to test a container to check that it is still working."
+      },
+      "insertText": "HEALTHCHECK",
+      "sortText": "00_healthcheck"
+    },
+    {
+      "label": "SHELL",
+      "kind": 14,
+      "detail": "Default shell",
+      "documentation": {
+        "value": "Override the default shell used for the shell form of commands."
+      },
+      "insertText": "SHELL",
+      "sortText": "00_shell"
+    },
+    {
+      "label": "FROM image",
+      "kind": 15,
+      "detail": "FROM with image",
+      "documentation": {
+        "value": "Basic FROM with image name."
+      },
+      "insertText": "FROM ${1:image}",
       "insertTextRules": 4,
-      "sortText": "00_FROM"
+      "sortText": "01_from_basic"
     },
     {
-      "label": "FROM ... AS (multi-stage)",
+      "label": "FROM image:tag",
       "kind": 15,
-      "detail": "Multi-stage build base image",
-      "documentation": { "value": "Set a base image with a named build stage for multi-stage builds.\n\n```dockerfile\nFROM node:20-alpine AS builder\nRUN npm ci && npm run build\n\nFROM nginx:alpine AS production\nCOPY --from=builder /app/dist /usr/share/nginx/html\n```" },
-      "insertText": "FROM ${1:image}:${2:tag} AS ${3:stage_name}",
+      "detail": "FROM with tag",
+      "documentation": {
+        "value": "FROM with explicit image tag."
+      },
+      "insertText": "FROM ${1:image}:${2:tag}",
       "insertTextRules": 4,
-      "sortText": "00_FROM_AS"
+      "sortText": "01_from_tag"
     },
     {
-      "label": "FROM scratch",
+      "label": "FROM image AS stage",
       "kind": 15,
-      "detail": "Start from an empty image",
-      "documentation": { "value": "Use an empty base image. Commonly used for statically compiled binaries (Go, Rust).\n\n```dockerfile\nFROM scratch\nCOPY --from=builder /app/mybin /mybin\nENTRYPOINT [\"/mybin\"]\n```" },
-      "insertText": "FROM scratch",
+      "detail": "FROM multi-stage",
+      "documentation": {
+        "value": "FROM with AS alias for multi-stage builds."
+      },
+      "insertText": "FROM ${1:image}:${2:tag} AS ${3:builder}",
       "insertTextRules": 4,
-      "sortText": "00_FROM_scratch"
+      "sortText": "01_from_as"
     },
     {
       "label": "FROM --platform",
       "kind": 15,
-      "detail": "Set base image with platform",
-      "documentation": { "value": "Specify the target platform for the build stage.\n\n```dockerfile\nFROM --platform=linux/amd64 ubuntu:22.04\nFROM --platform=$BUILDPLATFORM golang:1.21 AS builder\n```" },
-      "insertText": "FROM --platform=${1|linux/amd64,linux/arm64,$BUILDPLATFORM,$TARGETPLATFORM|} ${2:image}:${3:tag}",
+      "detail": "FROM with platform",
+      "documentation": {
+        "value": "FROM with explicit platform for cross-compilation."
+      },
+      "insertText": "FROM --platform=${1|linux/amd64,linux/arm64,linux/arm/v7,\\$BUILDPLATFORM,\\$TARGETPLATFORM|} ${2:image}:${3:tag}",
       "insertTextRules": 4,
-      "sortText": "00_FROM_platform"
+      "sortText": "01_from_platform"
     },
     {
-      "label": "RUN",
-      "kind": 14,
-      "detail": "Execute a command in the build",
-      "documentation": { "value": "Execute a command in a new layer on top of the current image.\n\n```dockerfile\nRUN apt-get update && apt-get install -y curl\nRUN pip install --no-cache-dir -r requirements.txt\n```" },
+      "label": "FROM --platform AS",
+      "kind": 15,
+      "detail": "FROM platform + stage",
+      "documentation": {
+        "value": "FROM with platform and stage alias."
+      },
+      "insertText": "FROM --platform=${1|linux/amd64,linux/arm64,\\$BUILDPLATFORM,\\$TARGETPLATFORM|} ${2:image}:${3:tag} AS ${4:stage}",
+      "insertTextRules": 4,
+      "sortText": "01_from_platform_as"
+    },
+    {
+      "label": "FROM scratch",
+      "kind": 15,
+      "detail": "FROM scratch (empty)",
+      "documentation": {
+        "value": "Start from an empty image, used for statically linked binaries."
+      },
+      "insertText": "FROM scratch",
+      "insertTextRules": 4,
+      "sortText": "01_from_scratch"
+    },
+    {
+      "label": "RUN shell",
+      "kind": 15,
+      "detail": "RUN shell form",
+      "documentation": {
+        "value": "Execute command in shell form (/bin/sh -c)."
+      },
       "insertText": "RUN ${1:command}",
       "insertTextRules": 4,
-      "sortText": "01_RUN"
+      "sortText": "02_run_shell"
     },
     {
-      "label": "RUN (exec form)",
+      "label": "RUN exec",
       "kind": 15,
-      "detail": "Execute a command in exec form",
-      "documentation": { "value": "Execute a command using the exec form (JSON array). This avoids shell processing and is preferred when you don't need shell features.\n\n```dockerfile\nRUN [\"executable\", \"param1\", \"param2\"]\nRUN [\"apt-get\", \"install\", \"-y\", \"curl\"]\n```" },
-      "insertText": "RUN [\"${1:executable}\", \"${2:param1}\"]",
+      "detail": "RUN exec form",
+      "documentation": {
+        "value": "Execute command in exec form (no shell processing)."
+      },
+      "insertText": "RUN [\"${1:executable}\", \"${2:arg1}\", \"${3:arg2}\"]",
       "insertTextRules": 4,
-      "sortText": "01_RUN_exec"
+      "sortText": "02_run_exec"
     },
     {
-      "label": "RUN --mount=type=cache",
+      "label": "RUN --mount=cache",
       "kind": 15,
       "detail": "RUN with cache mount",
-      "documentation": { "value": "Mount a cache directory that persists across builds. Speeds up package manager installs.\n\n```dockerfile\nRUN --mount=type=cache,target=/var/cache/apt \\\n    apt-get update && apt-get install -y curl\n\nRUN --mount=type=cache,target=/root/.cache/pip \\\n    pip install -r requirements.txt\n```" },
-      "insertText": "RUN --mount=type=cache,target=${1:/var/cache/apt} \\\n    ${2:command}",
+      "documentation": {
+        "value": "Mount a persistent cache directory for package managers."
+      },
+      "insertText": "RUN --mount=type=cache,target=${1:/var/cache/apt} \\\n    ${2:apt-get update && apt-get install -y package}",
       "insertTextRules": 4,
-      "sortText": "01_RUN_cache"
+      "sortText": "02_run_mount_cache"
     },
     {
-      "label": "RUN --mount=type=secret",
+      "label": "RUN --mount=bind",
+      "kind": 15,
+      "detail": "RUN with bind mount",
+      "documentation": {
+        "value": "Bind mount a directory from the build context."
+      },
+      "insertText": "RUN --mount=type=bind,source=${1:src},target=${2:/app/src} \\\n    ${3:command}",
+      "insertTextRules": 4,
+      "sortText": "02_run_mount_bind"
+    },
+    {
+      "label": "RUN --mount=secret",
       "kind": 15,
       "detail": "RUN with secret mount",
-      "documentation": { "value": "Mount a secret file that won't be stored in the final image.\n\n```dockerfile\nRUN --mount=type=secret,id=mysecret,target=/run/secrets/mysecret \\\n    cat /run/secrets/mysecret\n\n# Build: docker build --secret id=mysecret,src=secret.txt .\n```" },
-      "insertText": "RUN --mount=type=secret,id=${1:secret_id},target=${2:/run/secrets/$1} \\\n    ${3:command}",
+      "documentation": {
+        "value": "Mount a secret file without persisting in the image layer."
+      },
+      "insertText": "RUN --mount=type=secret,id=${1:mysecret},target=${2:/run/secrets/mysecret} \\\n    ${3:cat /run/secrets/mysecret}",
       "insertTextRules": 4,
-      "sortText": "01_RUN_secret"
+      "sortText": "02_run_mount_secret"
     },
     {
-      "label": "RUN --mount=type=ssh",
+      "label": "RUN --mount=ssh",
       "kind": 15,
-      "detail": "RUN with SSH agent forwarding",
-      "documentation": { "value": "Mount the SSH agent socket for accessing private repositories.\n\n```dockerfile\nRUN --mount=type=ssh \\\n    git clone git@github.com:private/repo.git\n\n# Build: docker build --ssh default .\n```" },
+      "detail": "RUN with SSH mount",
+      "documentation": {
+        "value": "Forward SSH agent for private repo access during build."
+      },
       "insertText": "RUN --mount=type=ssh \\\n    ${1:git clone git@github.com:user/repo.git}",
       "insertTextRules": 4,
-      "sortText": "01_RUN_ssh"
+      "sortText": "02_run_mount_ssh"
     },
     {
-      "label": "CMD",
-      "kind": 14,
-      "detail": "Default command for the container",
-      "documentation": { "value": "Set the default command to run when the container starts. Only the last CMD takes effect.\n\n```dockerfile\nCMD [\"node\", \"server.js\"]\nCMD [\"python\", \"app.py\"]\nCMD [\"nginx\", \"-g\", \"daemon off;\"]\n```" },
-      "insertText": "CMD [\"${1:executable}\", \"${2:param1}\"]",
+      "label": "RUN --mount=tmpfs",
+      "kind": 15,
+      "detail": "RUN with tmpfs mount",
+      "documentation": {
+        "value": "Mount a tmpfs for temporary scratch space."
+      },
+      "insertText": "RUN --mount=type=tmpfs,target=${1:/tmp} \\\n    ${2:command}",
       "insertTextRules": 4,
-      "sortText": "02_CMD"
+      "sortText": "02_run_mount_tmpfs"
     },
     {
-      "label": "LABEL",
-      "kind": 14,
-      "detail": "Add metadata to an image",
-      "documentation": { "value": "Add metadata as key-value pairs to an image.\n\n```dockerfile\nLABEL maintainer=\"user@example.com\"\nLABEL version=\"1.0\" description=\"My app\"\nLABEL org.opencontainers.image.source=\"https://github.com/user/repo\"\n```" },
-      "insertText": "LABEL ${1:key}=\"${2:value}\"",
+      "label": "RUN heredoc",
+      "kind": 15,
+      "detail": "RUN with heredoc",
+      "documentation": {
+        "value": "Run multi-line script using heredoc syntax (BuildKit)."
+      },
+      "insertText": "RUN <<EOF\n${1:#!/bin/bash\nset -e\necho \"hello\"}\nEOF",
       "insertTextRules": 4,
-      "sortText": "03_LABEL"
+      "sortText": "02_run_heredoc"
     },
     {
-      "label": "MAINTAINER",
-      "kind": 14,
-      "detail": "Set the author (deprecated)",
-      "documentation": { "value": "**Deprecated.** Use `LABEL maintainer=\"...\"` instead.\n\n```dockerfile\n# Deprecated:\nMAINTAINER user@example.com\n\n# Preferred:\nLABEL maintainer=\"user@example.com\"\n```" },
-      "insertText": "MAINTAINER ${1:name}",
+      "label": "RUN apt-get install",
+      "kind": 15,
+      "detail": "RUN apt-get best practice",
+      "documentation": {
+        "value": "Best practice apt-get install: update + install + clean in one layer."
+      },
+      "insertText": "RUN apt-get update && apt-get install -y --no-install-recommends \\\n    ${1:package1} \\\n    ${2:package2} \\\n    && rm -rf /var/lib/apt/lists/*",
       "insertTextRules": 4,
-      "sortText": "04_MAINTAINER"
+      "sortText": "02_run_apt"
     },
     {
-      "label": "EXPOSE",
-      "kind": 14,
-      "detail": "Declare container listen port",
-      "documentation": { "value": "Inform Docker the container listens on the specified port(s) at runtime. This is documentation only — you still need `-p` to publish.\n\n```dockerfile\nEXPOSE 80\nEXPOSE 443\nEXPOSE 3000/tcp 3001/udp\n```" },
-      "insertText": "EXPOSE ${1:port}",
+      "label": "RUN pip install",
+      "kind": 15,
+      "detail": "RUN pip install",
+      "documentation": {
+        "value": "Install Python packages with no cache for smaller images."
+      },
+      "insertText": "RUN pip install --no-cache-dir ${1:-r requirements.txt}",
       "insertTextRules": 4,
-      "sortText": "05_EXPOSE"
+      "sortText": "02_run_pip"
     },
     {
-      "label": "ENV",
-      "kind": 14,
-      "detail": "Set environment variable",
-      "documentation": { "value": "Set an environment variable that persists in the running container.\n\n```dockerfile\nENV NODE_ENV=production\nENV APP_HOME=/app\nENV PATH=\"/app/bin:$PATH\"\n```" },
-      "insertText": "ENV ${1:KEY}=${2:value}",
+      "label": "RUN npm ci",
+      "kind": 15,
+      "detail": "RUN npm ci",
+      "documentation": {
+        "value": "Install Node.js dependencies for reproducible builds."
+      },
+      "insertText": "RUN npm ci --only=production",
       "insertTextRules": 4,
-      "sortText": "06_ENV"
+      "sortText": "02_run_npm_ci"
     },
     {
-      "label": "ADD",
-      "kind": 14,
-      "detail": "Add files to the image",
-      "documentation": { "value": "Copy files, directories, or remote URLs into the image. Supports auto-extraction of tar archives. Prefer COPY unless you need tar extraction or URLs.\n\n```dockerfile\nADD app.tar.gz /app/\nADD https://example.com/file.txt /data/\nADD --chown=1000:1000 files/ /app/\n```" },
-      "insertText": "ADD ${1:src} ${2:dest}",
+      "label": "RUN apk add",
+      "kind": 15,
+      "detail": "RUN apk add (Alpine)",
+      "documentation": {
+        "value": "Install packages on Alpine Linux."
+      },
+      "insertText": "RUN apk add --no-cache \\\n    ${1:package1} \\\n    ${2:package2}",
       "insertTextRules": 4,
-      "sortText": "07_ADD"
+      "sortText": "02_run_apk"
     },
     {
-      "label": "COPY",
-      "kind": 14,
-      "detail": "Copy files into the image",
-      "documentation": { "value": "Copy files or directories from the build context into the image.\n\n```dockerfile\nCOPY . /app/\nCOPY package.json package-lock.json ./\nCOPY --chown=node:node src/ /app/src/\n```" },
-      "insertText": "COPY ${1:src} ${2:dest}",
+      "label": "RUN --network=none",
+      "kind": 15,
+      "detail": "RUN without network",
+      "documentation": {
+        "value": "Run command with network disabled for security."
+      },
+      "insertText": "RUN --network=none ${1:command}",
       "insertTextRules": 4,
-      "sortText": "08_COPY"
+      "sortText": "02_run_network_none"
     },
     {
-      "label": "COPY --from",
+      "label": "RUN --security=insecure",
       "kind": 15,
-      "detail": "Copy files from another build stage",
-      "documentation": { "value": "Copy files from a named build stage or external image.\n\n```dockerfile\nCOPY --from=builder /app/dist /usr/share/nginx/html\nCOPY --from=0 /app/bin /usr/local/bin/\nCOPY --from=alpine:latest /etc/alpine-release /\n```" },
-      "insertText": "COPY --from=${1:stage} ${2:src} ${3:dest}",
+      "detail": "RUN insecure (privileged)",
+      "documentation": {
+        "value": "Run with elevated privileges (requires security.insecure entitlement)."
+      },
+      "insertText": "RUN --security=insecure ${1:command}",
       "insertTextRules": 4,
-      "sortText": "08_COPY_from"
+      "sortText": "02_run_security"
+    },
+    {
+      "label": "RUN useradd",
+      "kind": 15,
+      "detail": "RUN create user",
+      "documentation": {
+        "value": "Create a non-root user for running the application."
+      },
+      "insertText": "RUN groupadd -r ${1:appuser} && useradd -r -g ${1:appuser} -d /home/${1:appuser} -s /sbin/nologin ${1:appuser}",
+      "insertTextRules": 4,
+      "sortText": "02_run_useradd"
+    },
+    {
+      "label": "RUN adduser Alpine",
+      "kind": 15,
+      "detail": "RUN create user (Alpine)",
+      "documentation": {
+        "value": "Create a non-root user on Alpine."
+      },
+      "insertText": "RUN addgroup -S ${1:appuser} && adduser -S ${1:appuser} -G ${1:appuser}",
+      "insertTextRules": 4,
+      "sortText": "02_run_adduser_alpine"
+    },
+    {
+      "label": "CMD exec form",
+      "kind": 15,
+      "detail": "CMD exec form",
+      "documentation": {
+        "value": "Set default command in exec form (preferred)."
+      },
+      "insertText": "CMD [\"${1:executable}\", \"${2:arg1}\"]",
+      "insertTextRules": 4,
+      "sortText": "03_cmd_exec"
+    },
+    {
+      "label": "CMD shell form",
+      "kind": 15,
+      "detail": "CMD shell form",
+      "documentation": {
+        "value": "Set default command in shell form."
+      },
+      "insertText": "CMD ${1:command arg1 arg2}",
+      "insertTextRules": 4,
+      "sortText": "03_cmd_shell"
+    },
+    {
+      "label": "CMD as ENTRYPOINT params",
+      "kind": 15,
+      "detail": "CMD default parameters",
+      "documentation": {
+        "value": "Provide default parameters to ENTRYPOINT."
+      },
+      "insertText": "CMD [\"${1:--help}\"]",
+      "insertTextRules": 4,
+      "sortText": "03_cmd_params"
+    },
+    {
+      "label": "ENTRYPOINT exec form",
+      "kind": 15,
+      "detail": "ENTRYPOINT exec form",
+      "documentation": {
+        "value": "Set entrypoint in exec form (preferred)."
+      },
+      "insertText": "ENTRYPOINT [\"${1:executable}\", \"${2:arg1}\"]",
+      "insertTextRules": 4,
+      "sortText": "04_entrypoint_exec"
+    },
+    {
+      "label": "ENTRYPOINT shell form",
+      "kind": 15,
+      "detail": "ENTRYPOINT shell form",
+      "documentation": {
+        "value": "Set entrypoint in shell form."
+      },
+      "insertText": "ENTRYPOINT ${1:command arg1}",
+      "insertTextRules": 4,
+      "sortText": "04_entrypoint_shell"
+    },
+    {
+      "label": "ENTRYPOINT with tini",
+      "kind": 15,
+      "detail": "ENTRYPOINT with tini",
+      "documentation": {
+        "value": "Use tini as PID 1 for proper signal handling."
+      },
+      "insertText": "ENTRYPOINT [\"tini\", \"--\", \"${1:executable}\"]",
+      "insertTextRules": 4,
+      "sortText": "04_entrypoint_tini"
+    },
+    {
+      "label": "ENTRYPOINT with dumb-init",
+      "kind": 15,
+      "detail": "ENTRYPOINT with dumb-init",
+      "documentation": {
+        "value": "Use dumb-init as PID 1 for signal forwarding."
+      },
+      "insertText": "ENTRYPOINT [\"dumb-init\", \"--\", \"${1:executable}\"]",
+      "insertTextRules": 4,
+      "sortText": "04_entrypoint_dumb_init"
+    },
+    {
+      "label": "COPY basic",
+      "kind": 15,
+      "detail": "COPY files",
+      "documentation": {
+        "value": "Copy files from build context into the image."
+      },
+      "insertText": "COPY ${1:src} ${2:dest}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_basic"
     },
     {
       "label": "COPY --chown",
       "kind": 15,
-      "detail": "Copy files with ownership",
-      "documentation": { "value": "Copy files and set ownership in a single step.\n\n```dockerfile\nCOPY --chown=node:node . /app/\nCOPY --chown=1000:1000 config/ /etc/app/\n```" },
+      "detail": "COPY with chown",
+      "documentation": {
+        "value": "Copy files and set ownership."
+      },
       "insertText": "COPY --chown=${1:user}:${2:group} ${3:src} ${4:dest}",
       "insertTextRules": 4,
-      "sortText": "08_COPY_chown"
+      "sortText": "05_copy_chown"
     },
     {
-      "label": "ENTRYPOINT",
-      "kind": 14,
-      "detail": "Configure the container executable",
-      "documentation": { "value": "Set the main executable for the container. CMD arguments are appended to ENTRYPOINT.\n\n```dockerfile\nENTRYPOINT [\"docker-entrypoint.sh\"]\nENTRYPOINT [\"python\", \"-m\", \"flask\"]\nENTRYPOINT [\"java\", \"-jar\", \"app.jar\"]\n```" },
-      "insertText": "ENTRYPOINT [\"${1:executable}\"]",
+      "label": "COPY --chmod",
+      "kind": 15,
+      "detail": "COPY with chmod",
+      "documentation": {
+        "value": "Copy files and set permissions (BuildKit)."
+      },
+      "insertText": "COPY --chmod=${1:755} ${2:src} ${3:dest}",
       "insertTextRules": 4,
-      "sortText": "09_ENTRYPOINT"
+      "sortText": "05_copy_chmod"
     },
     {
-      "label": "VOLUME",
-      "kind": 14,
-      "detail": "Create a mount point",
-      "documentation": { "value": "Create a mount point for externally mounted volumes or other containers.\n\n```dockerfile\nVOLUME /data\nVOLUME [\"/var/log\", \"/data\"]\n```" },
+      "label": "COPY --from",
+      "kind": 15,
+      "detail": "COPY from stage",
+      "documentation": {
+        "value": "Copy files from a named build stage (multi-stage)."
+      },
+      "insertText": "COPY --from=${1:builder} ${2:/app/build} ${3:/usr/share/nginx/html}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_from"
+    },
+    {
+      "label": "COPY --link",
+      "kind": 15,
+      "detail": "COPY with link",
+      "documentation": {
+        "value": "Copy files using link mode for better cache efficiency."
+      },
+      "insertText": "COPY --link ${1:src} ${2:dest}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_link"
+    },
+    {
+      "label": "COPY package*.json",
+      "kind": 15,
+      "detail": "COPY package files first",
+      "documentation": {
+        "value": "Copy only package files first for better layer caching."
+      },
+      "insertText": "COPY package*.json ${1:./}\nRUN npm ci\nCOPY ${2:.} ${3:./}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_package_cache"
+    },
+    {
+      "label": "ADD basic",
+      "kind": 15,
+      "detail": "ADD files",
+      "documentation": {
+        "value": "Add files from build context (or URL/tar) into the image."
+      },
+      "insertText": "ADD ${1:src} ${2:dest}",
+      "insertTextRules": 4,
+      "sortText": "06_add_basic"
+    },
+    {
+      "label": "ADD URL",
+      "kind": 15,
+      "detail": "ADD from URL",
+      "documentation": {
+        "value": "Download a file from a URL into the image."
+      },
+      "insertText": "ADD ${1:https://example.com/file.tar.gz} ${2:/tmp/}",
+      "insertTextRules": 4,
+      "sortText": "06_add_url"
+    },
+    {
+      "label": "ADD tar",
+      "kind": 15,
+      "detail": "ADD tar auto-extract",
+      "documentation": {
+        "value": "Add and auto-extract a tar archive."
+      },
+      "insertText": "ADD ${1:archive.tar.gz} ${2:/opt/}",
+      "insertTextRules": 4,
+      "sortText": "06_add_tar"
+    },
+    {
+      "label": "ADD --checksum",
+      "kind": 15,
+      "detail": "ADD with checksum",
+      "documentation": {
+        "value": "Add file with SHA256 checksum verification (BuildKit)."
+      },
+      "insertText": "ADD --checksum=sha256:${1:hash} ${2:https://example.com/file} ${3:/dest}",
+      "insertTextRules": 4,
+      "sortText": "06_add_checksum"
+    },
+    {
+      "label": "ENV single",
+      "kind": 15,
+      "detail": "ENV single variable",
+      "documentation": {
+        "value": "Set a single environment variable."
+      },
+      "insertText": "ENV ${1:KEY}=${2:value}",
+      "insertTextRules": 4,
+      "sortText": "07_env_single"
+    },
+    {
+      "label": "ENV multiple",
+      "kind": 15,
+      "detail": "ENV multiple variables",
+      "documentation": {
+        "value": "Set multiple environment variables."
+      },
+      "insertText": "ENV ${1:KEY1}=${2:value1} \\\n    ${3:KEY2}=${4:value2}",
+      "insertTextRules": 4,
+      "sortText": "07_env_multiple"
+    },
+    {
+      "label": "ENV PATH",
+      "kind": 15,
+      "detail": "ENV prepend PATH",
+      "documentation": {
+        "value": "Prepend a directory to PATH."
+      },
+      "insertText": "ENV PATH=\"${1:/app/bin}:$$PATH\"",
+      "insertTextRules": 4,
+      "sortText": "07_env_path"
+    },
+    {
+      "label": "ENV NODE_ENV",
+      "kind": 15,
+      "detail": "ENV NODE_ENV production",
+      "documentation": {
+        "value": "Set Node.js production environment."
+      },
+      "insertText": "ENV NODE_ENV=production",
+      "insertTextRules": 4,
+      "sortText": "07_env_node"
+    },
+    {
+      "label": "ENV PYTHONDONTWRITEBYTECODE",
+      "kind": 15,
+      "detail": "ENV Python optimizations",
+      "documentation": {
+        "value": "Common Python env vars for Docker."
+      },
+      "insertText": "ENV PYTHONDONTWRITEBYTECODE=1 \\\n    PYTHONUNBUFFERED=1",
+      "insertTextRules": 4,
+      "sortText": "07_env_python"
+    },
+    {
+      "label": "ARG basic",
+      "kind": 15,
+      "detail": "ARG variable",
+      "documentation": {
+        "value": "Define a build-time argument."
+      },
+      "insertText": "ARG ${1:NAME}",
+      "insertTextRules": 4,
+      "sortText": "08_arg_basic"
+    },
+    {
+      "label": "ARG with default",
+      "kind": 15,
+      "detail": "ARG with default value",
+      "documentation": {
+        "value": "Define a build arg with a default value."
+      },
+      "insertText": "ARG ${1:NAME}=${2:default}",
+      "insertTextRules": 4,
+      "sortText": "08_arg_default"
+    },
+    {
+      "label": "ARG before FROM",
+      "kind": 15,
+      "detail": "ARG before FROM",
+      "documentation": {
+        "value": "Define ARG before FROM for use in FROM instruction."
+      },
+      "insertText": "ARG ${1:VERSION}=${2:latest}\nFROM ${3:node}:${1:VERSION}",
+      "insertTextRules": 4,
+      "sortText": "08_arg_before_from"
+    },
+    {
+      "label": "EXPOSE port",
+      "kind": 15,
+      "detail": "EXPOSE single port",
+      "documentation": {
+        "value": "Expose a single port."
+      },
+      "insertText": "EXPOSE ${1:8080}",
+      "insertTextRules": 4,
+      "sortText": "09_expose_single"
+    },
+    {
+      "label": "EXPOSE multiple",
+      "kind": 15,
+      "detail": "EXPOSE multiple ports",
+      "documentation": {
+        "value": "Expose multiple ports."
+      },
+      "insertText": "EXPOSE ${1:80} ${2:443}",
+      "insertTextRules": 4,
+      "sortText": "09_expose_multiple"
+    },
+    {
+      "label": "EXPOSE UDP",
+      "kind": 15,
+      "detail": "EXPOSE UDP port",
+      "documentation": {
+        "value": "Expose a UDP port."
+      },
+      "insertText": "EXPOSE ${1:53}/udp",
+      "insertTextRules": 4,
+      "sortText": "09_expose_udp"
+    },
+    {
+      "label": "VOLUME path",
+      "kind": 15,
+      "detail": "VOLUME mount point",
+      "documentation": {
+        "value": "Create a mount point."
+      },
       "insertText": "VOLUME ${1:/data}",
       "insertTextRules": 4,
-      "sortText": "10_VOLUME"
+      "sortText": "10_volume"
     },
     {
-      "label": "USER",
-      "kind": 14,
-      "detail": "Set the user for subsequent instructions",
-      "documentation": { "value": "Set the user (and optionally group) for RUN, CMD, and ENTRYPOINT instructions that follow.\n\n```dockerfile\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nUSER appuser\nUSER 1000:1000\n```" },
-      "insertText": "USER ${1:user}",
+      "label": "VOLUME JSON",
+      "kind": 15,
+      "detail": "VOLUME multiple",
+      "documentation": {
+        "value": "Create multiple mount points."
+      },
+      "insertText": "VOLUME [\"${1:/data}\", \"${2:/logs}\"]",
       "insertTextRules": 4,
-      "sortText": "11_USER"
+      "sortText": "10_volume_json"
     },
     {
-      "label": "WORKDIR",
-      "kind": 14,
-      "detail": "Set the working directory",
-      "documentation": { "value": "Set the working directory for RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow.\n\n```dockerfile\nWORKDIR /app\nWORKDIR /usr/src/app\n```" },
+      "label": "USER name",
+      "kind": 15,
+      "detail": "USER set user",
+      "documentation": {
+        "value": "Switch to a non-root user."
+      },
+      "insertText": "USER ${1:appuser}",
+      "insertTextRules": 4,
+      "sortText": "11_user"
+    },
+    {
+      "label": "USER uid:gid",
+      "kind": 15,
+      "detail": "USER with UID:GID",
+      "documentation": {
+        "value": "Switch to a specific UID:GID."
+      },
+      "insertText": "USER ${1:1001}:${2:1001}",
+      "insertTextRules": 4,
+      "sortText": "11_user_uid"
+    },
+    {
+      "label": "WORKDIR path",
+      "kind": 15,
+      "detail": "WORKDIR set directory",
+      "documentation": {
+        "value": "Set the working directory."
+      },
       "insertText": "WORKDIR ${1:/app}",
       "insertTextRules": 4,
-      "sortText": "12_WORKDIR"
+      "sortText": "12_workdir"
     },
     {
-      "label": "ARG",
-      "kind": 14,
-      "detail": "Define a build-time variable",
-      "documentation": { "value": "Define a variable that users can pass at build time with `--build-arg`.\n\n```dockerfile\nARG NODE_VERSION=20\nARG APP_VERSION\nFROM node:${NODE_VERSION}-alpine\n```\n\nBuild: `docker build --build-arg NODE_VERSION=18 .`" },
-      "insertText": "ARG ${1:name}=${2:default}",
+      "label": "LABEL single",
+      "kind": 15,
+      "detail": "LABEL single",
+      "documentation": {
+        "value": "Add a single metadata label."
+      },
+      "insertText": "LABEL ${1:key}=\"${2:value}\"",
       "insertTextRules": 4,
-      "sortText": "13_ARG"
+      "sortText": "13_label_single"
     },
     {
-      "label": "ONBUILD",
-      "kind": 14,
-      "detail": "Add trigger instruction for downstream builds",
-      "documentation": { "value": "Add a trigger instruction that executes when the image is used as a base for another build.\n\n```dockerfile\nONBUILD COPY . /app/src\nONBUILD RUN npm install\n```" },
-      "insertText": "ONBUILD ${1:INSTRUCTION}",
+      "label": "LABEL multiple",
+      "kind": 15,
+      "detail": "LABEL multiple",
+      "documentation": {
+        "value": "Add multiple metadata labels."
+      },
+      "insertText": "LABEL ${1:maintainer}=\"${2:name}\" \\\n      ${3:version}=\"${4:1.0}\"",
+      "insertTextRules": 4,
+      "sortText": "13_label_multiple"
+    },
+    {
+      "label": "LABEL OCI",
+      "kind": 15,
+      "detail": "LABEL OCI annotations",
+      "documentation": {
+        "value": "OCI image spec annotation labels."
+      },
+      "insertText": "LABEL org.opencontainers.image.title=\"${1:title}\" \\\n      org.opencontainers.image.description=\"${2:description}\" \\\n      org.opencontainers.image.version=\"${3:1.0.0}\" \\\n      org.opencontainers.image.authors=\"${4:author}\" \\\n      org.opencontainers.image.source=\"${5:https://github.com/user/repo}\" \\\n      org.opencontainers.image.licenses=\"${6:MIT}\"",
+      "insertTextRules": 4,
+      "sortText": "13_label_oci"
+    },
+    {
+      "label": "HEALTHCHECK CMD",
+      "kind": 15,
+      "detail": "HEALTHCHECK CMD",
+      "documentation": {
+        "value": "Health check with HTTP endpoint."
+      },
+      "insertText": "HEALTHCHECK --interval=${1:30s} --timeout=${2:10s} --start-period=${3:5s} --retries=${4:3} \\\n    CMD ${5:curl -f http://localhost:${6:8080}/health || exit 1}",
+      "insertTextRules": 4,
+      "sortText": "14_healthcheck_cmd"
+    },
+    {
+      "label": "HEALTHCHECK wget",
+      "kind": 15,
+      "detail": "HEALTHCHECK with wget",
+      "documentation": {
+        "value": "Health check using wget (for alpine/minimal images)."
+      },
+      "insertText": "HEALTHCHECK --interval=${1:30s} --timeout=${2:10s} --retries=${3:3} \\\n    CMD wget --quiet --tries=1 --spider http://localhost:${4:8080}/health || exit 1",
+      "insertTextRules": 4,
+      "sortText": "14_healthcheck_wget"
+    },
+    {
+      "label": "HEALTHCHECK NONE",
+      "kind": 15,
+      "detail": "HEALTHCHECK NONE",
+      "documentation": {
+        "value": "Disable health check inherited from base image."
+      },
+      "insertText": "HEALTHCHECK NONE",
+      "insertTextRules": 4,
+      "sortText": "14_healthcheck_none"
+    },
+    {
+      "label": "SHELL bash",
+      "kind": 15,
+      "detail": "SHELL set to bash",
+      "documentation": {
+        "value": "Set default shell to bash."
+      },
+      "insertText": "SHELL [\"/bin/bash\", \"-c\"]",
+      "insertTextRules": 4,
+      "sortText": "15_shell_bash"
+    },
+    {
+      "label": "SHELL powershell",
+      "kind": 15,
+      "detail": "SHELL set to PowerShell",
+      "documentation": {
+        "value": "Set default shell to PowerShell (Windows)."
+      },
+      "insertText": "SHELL [\"powershell\", \"-Command\"]",
       "insertTextRules": 4,
-      "sortText": "14_ONBUILD"
+      "sortText": "15_shell_powershell"
     },
     {
       "label": "STOPSIGNAL",
-      "kind": 14,
-      "detail": "Set the system call signal for stopping the container",
-      "documentation": { "value": "Set the signal that will be sent to the container to stop it.\n\n```dockerfile\nSTOPSIGNAL SIGTERM\nSTOPSIGNAL SIGQUIT\nSTOPSIGNAL 9\n```" },
-      "insertText": "STOPSIGNAL ${1|SIGTERM,SIGQUIT,SIGKILL,SIGINT|}",
+      "kind": 15,
+      "detail": "STOPSIGNAL",
+      "documentation": {
+        "value": "Set stop signal."
+      },
+      "insertText": "STOPSIGNAL ${1|SIGTERM,SIGQUIT,SIGINT,SIGKILL|}",
       "insertTextRules": 4,
-      "sortText": "15_STOPSIGNAL"
+      "sortText": "16_stopsignal"
     },
     {
-      "label": "HEALTHCHECK",
-      "kind": 14,
-      "detail": "Define container health check",
-      "documentation": { "value": "Tell Docker how to test the container to check that it is still working.\n\n```dockerfile\nHEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \\\n  CMD curl -f http://localhost:8080/health || exit 1\n\nHEALTHCHECK NONE\n```" },
-      "insertText": "HEALTHCHECK --interval=${1:30s} --timeout=${2:10s} --start-period=${3:5s} --retries=${4:3} \\\n  CMD ${5:curl -f http://localhost:8080/health || exit 1}",
+      "label": "ONBUILD",
+      "kind": 15,
+      "detail": "ONBUILD trigger",
+      "documentation": {
+        "value": "Add instruction to execute when image is used as base."
+      },
+      "insertText": "ONBUILD ${1:RUN echo \"triggered\"}",
       "insertTextRules": 4,
-      "sortText": "16_HEALTHCHECK"
+      "sortText": "17_onbuild"
     },
     {
-      "label": "SHELL",
-      "kind": 14,
-      "detail": "Override the default shell",
-      "documentation": { "value": "Override the default shell used for the shell form of commands.\n\n```dockerfile\nSHELL [\"/bin/bash\", \"-c\"]\nSHELL [\"powershell\", \"-command\"]\n```" },
-      "insertText": "SHELL [\"${1:/bin/bash}\", \"${2:-c}\"]",
+      "label": "# syntax=",
+      "kind": 15,
+      "detail": "syntax parser directive",
+      "documentation": {
+        "value": "Set BuildKit frontend syntax (must be first line)."
+      },
+      "insertText": "# syntax=docker/dockerfile:${1|1,1.4,1.5,1.6,1.7,labs|}",
       "insertTextRules": 4,
-      "sortText": "17_SHELL"
+      "sortText": "00_syntax"
     },
     {
-      "label": "FROM node",
-      "kind": 27,
-      "detail": "Node.js base image",
-      "documentation": { "value": "Use the official Node.js image as the base.\n\n```dockerfile\nFROM node:20-alpine\nFROM node:18-slim\nFROM node:20-bookworm\n```\n\nVariants: `alpine` (minimal ~50MB), `slim` (Debian minimal), `bookworm`/`bullseye` (full Debian)." },
-      "insertText": "FROM node:${1|20-alpine,20-slim,20-bookworm,18-alpine,18-slim,22-alpine|}",
+      "label": "# escape=",
+      "kind": 15,
+      "detail": "escape parser directive",
+      "documentation": {
+        "value": "Change the escape character (must be before any instruction)."
+      },
+      "insertText": "# escape=${1|\\\\,`|}",
       "insertTextRules": 4,
-      "sortText": "20_node"
+      "sortText": "00_escape"
     },
     {
-      "label": "FROM python",
-      "kind": 27,
-      "detail": "Python base image",
-      "documentation": { "value": "Use the official Python image as the base.\n\n```dockerfile\nFROM python:3.12-slim\nFROM python:3.11-alpine\nFROM python:3.12-bookworm\n```\n\nVariants: `slim` (recommended for most apps), `alpine` (smallest), `bookworm` (full Debian)." },
-      "insertText": "FROM python:${1|3.12-slim,3.12-alpine,3.12-bookworm,3.11-slim,3.11-alpine|}",
+      "label": "Dockerfile: Node.js multi-stage",
+      "kind": 15,
+      "detail": "Node.js multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Node.js application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM node:${1:20}-alpine AS deps\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci --only=production\n\nFROM node:${1:20}-alpine AS builder\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n\nFROM node:${1:20}-alpine\nWORKDIR /app\nENV NODE_ENV=production\nRUN addgroup -S appuser && adduser -S appuser -G appuser\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY --from=builder /app/dist ./dist\nCOPY package*.json ./\nUSER appuser\nEXPOSE ${2:3000}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD wget --quiet --tries=1 --spider http://localhost:${2:3000}/health || exit 1\nCMD [\"node\", \"dist/index.js\"]",
       "insertTextRules": 4,
-      "sortText": "20_python"
+      "sortText": "20_tmpl_node"
     },
     {
-      "label": "FROM golang",
-      "kind": 27,
-      "detail": "Go base image",
-      "documentation": { "value": "Use the official Go image as the base.\n\n```dockerfile\nFROM golang:1.22-alpine\nFROM golang:1.22-bookworm\n```\n\nGo binaries are statically linked by default — ideal for multi-stage builds with `FROM scratch`." },
-      "insertText": "FROM golang:${1|1.22-alpine,1.22-bookworm,1.21-alpine,1.21-bookworm|}",
+      "label": "Dockerfile: Python multi-stage",
+      "kind": 15,
+      "detail": "Python multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Python application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM python:${1:3.12}-slim AS builder\nWORKDIR /app\nENV PYTHONDONTWRITEBYTECODE=1 \\\n    PYTHONUNBUFFERED=1\nCOPY requirements.txt .\nRUN pip install --no-cache-dir --prefix=/install -r requirements.txt\n\nFROM python:${1:3.12}-slim\nWORKDIR /app\nENV PYTHONDONTWRITEBYTECODE=1 \\\n    PYTHONUNBUFFERED=1\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nCOPY --from=builder /install /usr/local\nCOPY . .\nUSER appuser\nEXPOSE ${2:8000}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD python -c \"import urllib.request; urllib.request.urlopen('http://localhost:${2:8000}/health')\" || exit 1\nCMD [\"python\", \"-m\", \"${3:app}\"]",
       "insertTextRules": 4,
-      "sortText": "20_golang"
+      "sortText": "20_tmpl_python"
     },
     {
-      "label": "FROM rust",
-      "kind": 27,
-      "detail": "Rust base image",
-      "documentation": { "value": "Use the official Rust image as the base.\n\n```dockerfile\nFROM rust:1.77-slim\nFROM rust:1.77-alpine\nFROM rust:1.77-bookworm\n```\n\nUse multi-stage builds to create minimal final images." },
-      "insertText": "FROM rust:${1|1.77-slim,1.77-alpine,1.77-bookworm|}",
+      "label": "Dockerfile: Go multi-stage",
+      "kind": 15,
+      "detail": "Go multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Go application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM golang:${1:1.22}-alpine AS builder\nWORKDIR /app\nCOPY go.mod go.sum ./\nRUN go mod download\nCOPY . .\nRUN CGO_ENABLED=0 GOOS=linux go build -ldflags=\"-s -w\" -o /app/server ./cmd/${2:server}\n\nFROM gcr.io/distroless/static-debian12\nCOPY --from=builder /app/server /server\nEXPOSE ${3:8080}\nUSER nonroot:nonroot\nENTRYPOINT [\"/server\"]",
       "insertTextRules": 4,
-      "sortText": "20_rust"
+      "sortText": "20_tmpl_go"
     },
     {
-      "label": "FROM ubuntu",
-      "kind": 27,
-      "detail": "Ubuntu base image",
-      "documentation": { "value": "Use the official Ubuntu image as the base.\n\n```dockerfile\nFROM ubuntu:22.04\nFROM ubuntu:24.04\nFROM ubuntu:20.04\n```" },
-      "insertText": "FROM ubuntu:${1|24.04,22.04,20.04|}",
+      "label": "Dockerfile: Java Maven multi-stage",
+      "kind": 15,
+      "detail": "Java/Maven multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Java application built with Maven."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM maven:${1:3.9}-eclipse-temurin-${2:21} AS builder\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn package -DskipTests -B\n\nFROM eclipse-temurin:${2:21}-jre-alpine\nWORKDIR /app\nRUN addgroup -S appuser && adduser -S appuser -G appuser\nCOPY --from=builder /app/target/*.jar app.jar\nUSER appuser\nEXPOSE ${3:8080}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD wget --quiet --tries=1 --spider http://localhost:${3:8080}/actuator/health || exit 1\nENTRYPOINT [\"java\", \"-jar\", \"app.jar\"]",
       "insertTextRules": 4,
-      "sortText": "20_ubuntu"
+      "sortText": "20_tmpl_java"
     },
     {
-      "label": "FROM alpine",
-      "kind": 27,
-      "detail": "Alpine Linux base image",
-      "documentation": { "value": "Use Alpine Linux (~5MB) for minimal images.\n\n```dockerfile\nFROM alpine:3.19\nFROM alpine:3.18\n```\n\nUses `musl` libc and `apk` package manager. May have compatibility issues with some C libraries." },
-      "insertText": "FROM alpine:${1|3.19,3.18,3.17|}",
+      "label": "Dockerfile: Rust multi-stage",
+      "kind": 15,
+      "detail": "Rust multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Rust application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM rust:${1:1.77}-slim AS builder\nWORKDIR /app\nCOPY Cargo.toml Cargo.lock ./\nRUN mkdir src && echo \"fn main() {}\" > src/main.rs && cargo build --release && rm -rf src\nCOPY src ./src\nRUN cargo build --release\n\nFROM debian:${2:bookworm}-slim\nRUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nCOPY --from=builder /app/target/release/${3:myapp} /usr/local/bin/\nUSER appuser\nEXPOSE ${4:8080}\nENTRYPOINT [\"${3:myapp}\"]",
       "insertTextRules": 4,
-      "sortText": "20_alpine"
+      "sortText": "20_tmpl_rust"
     },
     {
-      "label": "FROM debian",
-      "kind": 27,
-      "detail": "Debian base image",
-      "documentation": { "value": "Use the official Debian image as the base.\n\n```dockerfile\nFROM debian:bookworm-slim\nFROM debian:bullseye-slim\n```\n\n`-slim` variants are much smaller and sufficient for most applications." },
-      "insertText": "FROM debian:${1|bookworm-slim,bullseye-slim,bookworm,bullseye|}",
+      "label": "Dockerfile: .NET multi-stage",
+      "kind": 15,
+      "detail": ".NET multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a .NET application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM mcr.microsoft.com/dotnet/sdk:${1:8.0} AS builder\nWORKDIR /app\nCOPY *.csproj .\nRUN dotnet restore\nCOPY . .\nRUN dotnet publish -c Release -o /out --no-restore\n\nFROM mcr.microsoft.com/dotnet/aspnet:${1:8.0}\nWORKDIR /app\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nCOPY --from=builder /out .\nUSER appuser\nEXPOSE ${2:8080}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD curl -f http://localhost:${2:8080}/health || exit 1\nENTRYPOINT [\"dotnet\", \"${3:MyApp}.dll\"]",
       "insertTextRules": 4,
-      "sortText": "20_debian"
+      "sortText": "20_tmpl_dotnet"
     },
     {
-      "label": "FROM nginx",
-      "kind": 27,
-      "detail": "Nginx web server base image",
-      "documentation": { "value": "Use the official Nginx image.\n\n```dockerfile\nFROM nginx:alpine\nFROM nginx:1.25-alpine\n```\n\nDefault serves `/usr/share/nginx/html`. Config at `/etc/nginx/nginx.conf`." },
-      "insertText": "FROM nginx:${1|alpine,1.25-alpine,1.25-bookworm,stable-alpine|}",
+      "label": "Dockerfile: Nginx static site",
+      "kind": 15,
+      "detail": "Nginx static site Dockerfile",
+      "documentation": {
+        "value": "Serve static files with Nginx using a multi-stage build."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM node:${1:20}-alpine AS builder\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n\nFROM nginx:${2:alpine}\nCOPY --from=builder /app/${3:dist} /usr/share/nginx/html\nCOPY ${4:nginx.conf} /etc/nginx/conf.d/default.conf\nEXPOSE 80\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD curl -f http://localhost/ || exit 1\nCMD [\"nginx\", \"-g\", \"daemon off;\"]",
       "insertTextRules": 4,
-      "sortText": "20_nginx"
+      "sortText": "20_tmpl_nginx"
     },
     {
-      "label": "FROM redis",
-      "kind": 27,
-      "detail": "Redis base image",
-      "documentation": { "value": "Use the official Redis image.\n\n```dockerfile\nFROM redis:7-alpine\nFROM redis:7-bookworm\n```\n\nData directory: `/data`. Default port: 6379." },
-      "insertText": "FROM redis:${1|7-alpine,7-bookworm,6-alpine|}",
+      "label": "Dockerfile: PHP-FPM",
+      "kind": 15,
+      "detail": "PHP-FPM Dockerfile",
+      "documentation": {
+        "value": "PHP-FPM application Dockerfile with Composer."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM composer:${1:2} AS vendor\nWORKDIR /app\nCOPY composer.json composer.lock ./\nRUN composer install --no-dev --no-scripts --no-autoloader\nCOPY . .\nRUN composer dump-autoload --optimize\n\nFROM php:${2:8.3}-fpm-alpine\nWORKDIR /var/www/html\nRUN docker-php-ext-install pdo pdo_mysql opcache\nCOPY --from=vendor /app .\nRUN chown -R www-data:www-data /var/www/html\nUSER www-data\nEXPOSE 9000\nCMD [\"php-fpm\"]",
       "insertTextRules": 4,
-      "sortText": "20_redis"
+      "sortText": "20_tmpl_php"
     },
     {
-      "label": "FROM postgres",
-      "kind": 27,
-      "detail": "PostgreSQL base image",
-      "documentation": { "value": "Use the official PostgreSQL image.\n\n```dockerfile\nFROM postgres:16-alpine\nFROM postgres:15-bookworm\n```\n\nSet `POSTGRES_PASSWORD`, `POSTGRES_USER`, `POSTGRES_DB` environment variables. Init scripts in `/docker-entrypoint-initdb.d/`." },
-      "insertText": "FROM postgres:${1|16-alpine,16-bookworm,15-alpine,15-bookworm|}",
+      "label": "Dockerfile: Ruby/Rails",
+      "kind": 15,
+      "detail": "Ruby/Rails Dockerfile",
+      "documentation": {
+        "value": "Production-ready Dockerfile for a Ruby on Rails application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM ruby:${1:3.3}-slim AS builder\nWORKDIR /app\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    build-essential libpq-dev \\\n    && rm -rf /var/lib/apt/lists/*\nCOPY Gemfile Gemfile.lock ./\nRUN bundle config set --local deployment true \\\n    && bundle config set --local without \"development test\" \\\n    && bundle install\n\nFROM ruby:${1:3.3}-slim\nWORKDIR /app\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    libpq5 \\\n    && rm -rf /var/lib/apt/lists/*\nRUN groupadd -r rails && useradd -r -g rails rails\nCOPY --from=builder /app/vendor/bundle ./vendor/bundle\nCOPY . .\nRUN bundle config set --local path vendor/bundle\nUSER rails\nEXPOSE ${2:3000}\nCMD [\"bundle\", \"exec\", \"rails\", \"server\", \"-b\", \"0.0.0.0\"]",
       "insertTextRules": 4,
-      "sortText": "20_postgres"
+      "sortText": "20_tmpl_ruby"
     },
     {
-      "label": "FROM mysql",
-      "kind": 27,
-      "detail": "MySQL base image",
-      "documentation": { "value": "Use the official MySQL image.\n\n```dockerfile\nFROM mysql:8.0\nFROM mysql:8.3\n```\n\nSet `MYSQL_ROOT_PASSWORD`, `MYSQL_DATABASE`, `MYSQL_USER`, `MYSQL_PASSWORD`. Init scripts in `/docker-entrypoint-initdb.d/`." },
-      "insertText": "FROM mysql:${1|8.3,8.0|}",
+      "label": "Non-root user setup",
+      "kind": 15,
+      "detail": "Non-root user pattern",
+      "documentation": {
+        "value": "Best practice: create and switch to a non-root user."
+      },
+      "insertText": "RUN groupadd -r ${1:appuser} && useradd -r -g ${1:appuser} -d /home/${1:appuser} -s /sbin/nologin ${1:appuser} \\\n    && mkdir -p /home/${1:appuser} && chown -R ${1:appuser}:${1:appuser} /home/${1:appuser}\nUSER ${1:appuser}",
       "insertTextRules": 4,
-      "sortText": "20_mysql"
+      "sortText": "18_bp_nonroot"
     },
     {
-      "label": "apt-get install pattern",
+      "label": "apt-get best practice",
       "kind": 15,
-      "detail": "Best practice apt-get install with cleanup",
-      "documentation": { "value": "Install packages with apt-get following Docker best practices: combine update+install, use `--no-install-recommends`, and clean up in a single RUN layer.\n\n```dockerfile\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    curl \\\n    ca-certificates \\\n  && rm -rf /var/lib/apt/lists/*\n```" },
-      "insertText": "RUN apt-get update && apt-get install -y --no-install-recommends \\\n    ${1:package} \\\n  && rm -rf /var/lib/apt/lists/*",
+      "detail": "apt-get best practice layer",
+      "documentation": {
+        "value": "Install packages and clean up in a single layer."
+      },
+      "insertText": "RUN apt-get update \\\n    && apt-get install -y --no-install-recommends \\\n        ${1:curl} \\\n        ${2:ca-certificates} \\\n    && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \\\n    && rm -rf /var/lib/apt/lists/*",
       "insertTextRules": 4,
-      "sortText": "30_apt_install"
+      "sortText": "18_bp_apt"
     },
     {
-      "label": "pip install pattern",
+      "label": "pip best practice",
       "kind": 15,
-      "detail": "Best practice pip install",
-      "documentation": { "value": "Install Python packages with pip following best practices: use `--no-cache-dir` to keep image small.\n\n```dockerfile\nCOPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt\n```" },
-      "insertText": "COPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt",
+      "detail": "pip install best practice",
+      "documentation": {
+        "value": "Install Python packages without cache."
+      },
+      "insertText": "COPY requirements.txt .\nRUN pip install --no-cache-dir --upgrade pip \\\n    && pip install --no-cache-dir -r requirements.txt",
       "insertTextRules": 4,
-      "sortText": "30_pip_install"
+      "sortText": "18_bp_pip"
     },
     {
-      "label": "npm install pattern",
+      "label": "npm ci pattern",
       "kind": 15,
-      "detail": "Best practice npm install with layer caching",
-      "documentation": { "value": "Copy package files first to leverage Docker layer caching. Dependencies are only reinstalled when package files change.\n\n```dockerfile\nCOPY package.json package-lock.json ./\nRUN npm ci --only=production\nCOPY . .\n```" },
-      "insertText": "COPY package.json package-lock.json ./\nRUN npm ci ${1:--only=production}\nCOPY . .",
+      "detail": "npm ci production pattern",
+      "documentation": {
+        "value": "Install production Node.js dependencies."
+      },
+      "insertText": "COPY package.json package-lock.json ./\nRUN npm ci --only=production \\\n    && npm cache clean --force",
       "insertTextRules": 4,
-      "sortText": "30_npm_install"
+      "sortText": "18_bp_npm"
     },
     {
-      "label": "COPY package.json first",
+      "label": "Multi-stage build pattern",
       "kind": 15,
-      "detail": "Layer caching pattern for package managers",
-      "documentation": { "value": "Copy dependency manifests before the rest of the code to leverage Docker's build cache. This way, dependencies are only reinstalled when the manifest changes.\n\n```dockerfile\n# Dependencies are cached unless package.json changes\nCOPY package.json package-lock.json ./\nRUN npm ci\n\n# Application code changes don't invalidate deps cache\nCOPY . .\n```" },
-      "insertText": "# Install dependencies (cached unless manifest changes)\nCOPY ${1:package.json} ${2:package-lock.json} ./\nRUN ${3:npm ci}\n\n# Copy application source\nCOPY . .",
+      "detail": "Multi-stage build skeleton",
+      "documentation": {
+        "value": "Basic multi-stage build skeleton."
+      },
+      "insertText": "FROM ${1:node:20-alpine} AS builder\nWORKDIR /app\nCOPY . .\nRUN ${2:npm ci && npm run build}\n\nFROM ${3:node:20-alpine}\nWORKDIR /app\nCOPY --from=builder /app/${4:dist} ./${4:dist}\nEXPOSE ${5:3000}\nCMD ${6:[\"node\", \"dist/index.js\"]}",
       "insertTextRules": 4,
-      "sortText": "30_copy_first"
+      "sortText": "18_bp_multistage"
     },
     {
-      "label": "ARG + ENV pattern",
+      "label": "Distroless final stage",
       "kind": 15,
-      "detail": "Use ARG to set ENV at build time",
-      "documentation": { "value": "Combine ARG and ENV to set environment variables that can be overridden at build time and persist at runtime.\n\n```dockerfile\nARG APP_VERSION=1.0.0\nENV APP_VERSION=${APP_VERSION}\n```\n\n`ARG` is only available during build. `ENV` persists in the running container." },
-      "insertText": "ARG ${1:VAR_NAME}=${2:default_value}\nENV ${1:VAR_NAME}=${${1:VAR_NAME}}",
+      "detail": "Distroless final stage",
+      "documentation": {
+        "value": "Use Google distroless as the final minimal image."
+      },
+      "insertText": "FROM gcr.io/distroless/${1|static-debian12,base-debian12,cc-debian12,java21-debian12,python3-debian12,nodejs22-debian12|}\nCOPY --from=builder ${2:/app/binary} ${3:/}\nUSER nonroot:nonroot\nENTRYPOINT [\"${4:/binary}\"]",
       "insertTextRules": 4,
-      "sortText": "31_arg_env"
+      "sortText": "18_bp_distroless"
     },
     {
-      "label": "HEALTHCHECK CMD",
+      "label": "Signal handling (tini)",
       "kind": 15,
-      "detail": "Health check with all options",
-      "documentation": { "value": "Configure a health check with interval, timeout, start period, and retries.\n\n```dockerfile\nHEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \\\n  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1\n```\n\nOptions:\n- `--interval=DURATION` (default 30s)\n- `--timeout=DURATION` (default 30s)\n- `--start-period=DURATION` (default 0s)\n- `--retries=N` (default 3)" },
-      "insertText": "HEALTHCHECK --interval=${1:30s} --timeout=${2:10s} --start-period=${3:40s} --retries=${4:3} \\\n  CMD ${5:wget --no-verbose --tries=1 --spider http://localhost:${6:8080}/health || exit 1}",
+      "detail": "Signal handling with tini",
+      "documentation": {
+        "value": "Use tini init for proper PID 1 signal handling."
+      },
+      "insertText": "RUN apt-get update && apt-get install -y --no-install-recommends tini \\\n    && rm -rf /var/lib/apt/lists/*\nENTRYPOINT [\"tini\", \"--\"]\nCMD [\"${1:node}\", \"${2:server.js}\"]",
       "insertTextRules": 4,
-      "sortText": "31_healthcheck"
+      "sortText": "18_bp_tini"
     },
     {
-      "label": "Multi-stage builder pattern",
+      "label": "Build cache optimization",
       "kind": 15,
-      "detail": "Multi-stage build with builder stage",
-      "documentation": { "value": "Use a multi-stage build to compile/build in one stage and copy artifacts to a minimal final image.\n\n```dockerfile\nFROM node:20-alpine AS builder\nWORKDIR /app\nCOPY . .\nRUN npm ci && npm run build\n\nFROM nginx:alpine\nCOPY --from=builder /app/dist /usr/share/nginx/html\nEXPOSE 80\nCMD [\"nginx\", \"-g\", \"daemon off;\"]\n```" },
-      "insertText": "FROM ${1:node:20-alpine} AS builder\nWORKDIR /app\nCOPY . .\nRUN ${2:npm ci && npm run build}\n\nFROM ${3:nginx:alpine}\nCOPY --from=builder ${4:/app/dist} ${5:/usr/share/nginx/html}\nEXPOSE ${6:80}\nCMD [\"${7:nginx}\", \"${8:-g}\", \"${9:daemon off;}\"]",
+      "detail": "Layer caching order",
+      "documentation": {
+        "value": "Copy dependency files before source for cache optimization."
+      },
+      "insertText": "# Copy dependency manifests first (changes less often)\nCOPY ${1:package.json} ${2:package-lock.json} ./\nRUN ${3:npm ci}\n\n# Copy source code (changes more often)\nCOPY . .\nRUN ${4:npm run build}",
       "insertTextRules": 4,
-      "sortText": "32_multistage_builder"
+      "sortText": "18_bp_cache_order"
     },
     {
-      "label": "Non-root user pattern",
+      "label": "FROM alpine",
       "kind": 15,
-      "detail": "Create and switch to non-root user",
-      "documentation": { "value": "Security best practice: run the final container as a non-root user.\n\n```dockerfile\nRUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser\nUSER appuser\n```" },
-      "insertText": "RUN addgroup --system ${1:appgroup} && adduser --system --ingroup ${1:appgroup} ${2:appuser}\nUSER ${2:appuser}",
+      "detail": "Alpine Linux",
+      "documentation": {
+        "value": "Minimal 5MB Alpine Linux base image."
+      },
+      "insertText": "FROM alpine:${1:3.19}",
       "insertTextRules": 4,
-      "sortText": "33_nonroot_user"
+      "sortText": "19_base_alpine"
     },
     {
-      "label": "Dockerfile: Node.js app",
+      "label": "FROM node:alpine",
       "kind": 15,
-      "detail": "Complete Dockerfile for a Node.js application",
-      "documentation": { "value": "Production-ready Dockerfile for a Node.js application with multi-stage build, non-root user, and health check.\n\n```dockerfile\nFROM node:20-alpine AS builder\nWORKDIR /app\nCOPY package.json package-lock.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n\nFROM node:20-alpine\nRUN addgroup -S app && adduser -S app -G app\nWORKDIR /app\nCOPY --from=builder --chown=app:app /app/dist ./dist\nCOPY --from=builder --chown=app:app /app/node_modules ./node_modules\nCOPY --from=builder --chown=app:app /app/package.json ./\nUSER app\nEXPOSE 3000\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 CMD wget -qO- http://localhost:3000/health || exit 1\nCMD [\"node\", \"dist/index.js\"]\n```" },
-      "insertText": "FROM node:${1:20-alpine} AS builder\nWORKDIR /app\nCOPY package.json package-lock.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n\nFROM node:${1:20-alpine}\nRUN addgroup -S app && adduser -S app -G app\nWORKDIR /app\nCOPY --from=builder --chown=app:app /app/dist ./dist\nCOPY --from=builder --chown=app:app /app/node_modules ./node_modules\nCOPY --from=builder --chown=app:app /app/package.json ./\nUSER app\nEXPOSE ${2:3000}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n  CMD wget -qO- http://localhost:${2:3000}/health || exit 1\nCMD [\"node\", \"dist/index.js\"]",
+      "detail": "Node.js Alpine",
+      "documentation": {
+        "value": "Node.js on Alpine Linux."
+      },
+      "insertText": "FROM node:${1:20}-alpine",
       "insertTextRules": 4,
-      "sortText": "40_full_node"
+      "sortText": "19_base_node_alpine"
     },
     {
-      "label": "Dockerfile: Python app",
+      "label": "FROM node:slim",
       "kind": 15,
-      "detail": "Complete Dockerfile for a Python application",
-      "documentation": { "value": "Production-ready Dockerfile for a Python application with virtual env, non-root user, and best practices.\n\n```dockerfile\nFROM python:3.12-slim AS builder\nWORKDIR /app\nRUN python -m venv /opt/venv\nENV PATH=\"/opt/venv/bin:$PATH\"\nCOPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt\n\nFROM python:3.12-slim\nRUN useradd --create-home appuser\nWORKDIR /app\nCOPY --from=builder /opt/venv /opt/venv\nENV PATH=\"/opt/venv/bin:$PATH\"\nCOPY --chown=appuser:appuser . .\nUSER appuser\nEXPOSE 8000\nCMD [\"python\", \"-m\", \"uvicorn\", \"main:app\", \"--host\", \"0.0.0.0\", \"--port\", \"8000\"]\n```" },
-      "insertText": "FROM python:${1:3.12-slim} AS builder\nWORKDIR /app\nRUN python -m venv /opt/venv\nENV PATH=\"/opt/venv/bin:$$PATH\"\nCOPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt\n\nFROM python:${1:3.12-slim}\nRUN useradd --create-home appuser\nWORKDIR /app\nCOPY --from=builder /opt/venv /opt/venv\nENV PATH=\"/opt/venv/bin:$$PATH\"\nCOPY --chown=appuser:appuser . .\nUSER appuser\nEXPOSE ${2:8000}\nCMD [\"python\", \"-m\", \"${3:uvicorn}\", \"${4:main:app}\", \"--host\", \"0.0.0.0\", \"--port\", \"${2:8000}\"]",
+      "detail": "Node.js Slim",
+      "documentation": {
+        "value": "Node.js on Debian slim."
+      },
+      "insertText": "FROM node:${1:20}-slim",
       "insertTextRules": 4,
-      "sortText": "40_full_python"
+      "sortText": "19_base_node_slim"
     },
     {
-      "label": "Dockerfile: Go app",
+      "label": "FROM python:slim",
       "kind": 15,
-      "detail": "Complete Dockerfile for a Go application",
-      "documentation": { "value": "Production-ready multi-stage Dockerfile for a Go application using scratch as the final image.\n\n```dockerfile\nFROM golang:1.22-alpine AS builder\nWORKDIR /app\nCOPY go.mod go.sum ./\nRUN go mod download\nCOPY . .\nRUN CGO_ENABLED=0 GOOS=linux go build -ldflags='-w -s' -o /app/server ./cmd/server\n\nFROM scratch\nCOPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/\nCOPY --from=builder /app/server /server\nEXPOSE 8080\nENTRYPOINT [\"/server\"]\n```" },
-      "insertText": "FROM golang:${1:1.22-alpine} AS builder\nWORKDIR /app\nCOPY go.mod go.sum ./\nRUN go mod download\nCOPY . .\nRUN CGO_ENABLED=0 GOOS=linux go build -ldflags='-w -s' -o /app/${2:server} ./${3:cmd/server}\n\nFROM scratch\nCOPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/\nCOPY --from=builder /app/${2:server} /${2:server}\nEXPOSE ${4:8080}\nENTRYPOINT [\"/${2:server}\"]",
+      "detail": "Python Slim",
+      "documentation": {
+        "value": "Python on Debian slim."
+      },
+      "insertText": "FROM python:${1:3.12}-slim",
       "insertTextRules": 4,
-      "sortText": "40_full_go"
+      "sortText": "19_base_python_slim"
     },
     {
-      "label": "Dockerfile: Multi-stage build",
+      "label": "FROM python:alpine",
       "kind": 15,
-      "detail": "Generic multi-stage build template",
-      "documentation": { "value": "A generic multi-stage build template. First stage builds, second stage runs.\n\n```dockerfile\n# Build stage\nFROM image:tag AS builder\nWORKDIR /app\nCOPY . .\nRUN make build\n\n# Production stage\nFROM image:tag\nWORKDIR /app\nCOPY --from=builder /app/output /app/\nEXPOSE 8080\nCMD [\"./app\"]\n```" },
-      "insertText": "# Build stage\nFROM ${1:image}:${2:tag} AS builder\nWORKDIR /app\nCOPY . .\nRUN ${3:make build}\n\n# Production stage\nFROM ${4:image}:${5:tag}\nWORKDIR /app\nCOPY --from=builder /app/${6:output} /app/\nEXPOSE ${7:8080}\nCMD [\"${8:./app}\"]",
+      "detail": "Python Alpine",
+      "documentation": {
+        "value": "Python on Alpine Linux."
+      },
+      "insertText": "FROM python:${1:3.12}-alpine",
       "insertTextRules": 4,
-      "sortText": "40_full_multistage"
+      "sortText": "19_base_python_alpine"
     },
     {
-      "label": "Dockerfile: Rust app",
+      "label": "FROM golang:alpine",
       "kind": 15,
-      "detail": "Complete Dockerfile for a Rust application",
-      "documentation": { "value": "Production-ready multi-stage Dockerfile for a Rust application.\n\n```dockerfile\nFROM rust:1.77-slim AS builder\nWORKDIR /app\nCOPY Cargo.toml Cargo.lock ./\nRUN mkdir src && echo 'fn main(){}' > src/main.rs && cargo build --release && rm -rf src\nCOPY src ./src\nRUN cargo build --release\n\nFROM debian:bookworm-slim\nRUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*\nCOPY --from=builder /app/target/release/myapp /usr/local/bin/myapp\nEXPOSE 8080\nCMD [\"myapp\"]\n```" },
-      "insertText": "FROM rust:${1:1.77-slim} AS builder\nWORKDIR /app\nCOPY Cargo.toml Cargo.lock ./\nRUN mkdir src && echo 'fn main(){}' > src/main.rs && cargo build --release && rm -rf src\nCOPY src ./src\nRUN cargo build --release\n\nFROM debian:bookworm-slim\nRUN apt-get update && apt-get install -y --no-install-recommends ca-certificates && rm -rf /var/lib/apt/lists/*\nCOPY --from=builder /app/target/release/${2:myapp} /usr/local/bin/${2:myapp}\nEXPOSE ${3:8080}\nCMD [\"${2:myapp}\"]",
+      "detail": "Go Alpine",
+      "documentation": {
+        "value": "Go on Alpine Linux."
+      },
+      "insertText": "FROM golang:${1:1.22}-alpine",
       "insertTextRules": 4,
-      "sortText": "40_full_rust"
+      "sortText": "19_base_golang_alpine"
     },
     {
-      "label": "Dockerfile: Nginx static site",
+      "label": "FROM ubuntu",
       "kind": 15,
-      "detail": "Dockerfile for serving static files with Nginx",
-      "documentation": { "value": "Serve a static website or SPA with Nginx.\n\n```dockerfile\nFROM nginx:alpine\nCOPY nginx.conf /etc/nginx/conf.d/default.conf\nCOPY dist/ /usr/share/nginx/html/\nEXPOSE 80\nHEALTHCHECK --interval=30s --timeout=5s CMD wget -qO- http://localhost/ || exit 1\nCMD [\"nginx\", \"-g\", \"daemon off;\"]\n```" },
-      "insertText": "FROM nginx:alpine\nCOPY ${1:nginx.conf} /etc/nginx/conf.d/default.conf\nCOPY ${2:dist/} /usr/share/nginx/html/\nEXPOSE 80\nHEALTHCHECK --interval=30s --timeout=5s \\\n  CMD wget -qO- http://localhost/ || exit 1\nCMD [\"nginx\", \"-g\", \"daemon off;\"]",
+      "detail": "Ubuntu",
+      "documentation": {
+        "value": "Ubuntu base image."
+      },
+      "insertText": "FROM ubuntu:${1:24.04}",
       "insertTextRules": 4,
-      "sortText": "40_full_nginx"
+      "sortText": "19_base_ubuntu"
     },
     {
-      "label": "apk add pattern",
+      "label": "FROM debian:slim",
       "kind": 15,
-      "detail": "Alpine package install with cleanup",
-      "documentation": { "value": "Install packages on Alpine Linux with `--no-cache` to avoid caching the index.\n\n```dockerfile\nRUN apk add --no-cache \\\n    curl \\\n    ca-certificates \\\n    tzdata\n```" },
-      "insertText": "RUN apk add --no-cache \\\n    ${1:package}",
+      "detail": "Debian Slim",
+      "documentation": {
+        "value": "Minimal Debian base image."
+      },
+      "insertText": "FROM debian:${1:bookworm}-slim",
       "insertTextRules": 4,
-      "sortText": "30_apk_install"
+      "sortText": "19_base_debian_slim"
     },
     {
-      "label": "ENTRYPOINT + CMD pattern",
+      "label": "FROM nginx:alpine",
       "kind": 15,
-      "detail": "ENTRYPOINT with CMD as default args",
-      "documentation": { "value": "Use ENTRYPOINT for the executable and CMD for default arguments. Users can override CMD args at `docker run`.\n\n```dockerfile\nENTRYPOINT [\"python\", \"app.py\"]\nCMD [\"--port\", \"8000\"]\n\n# docker run myimage                  -> python app.py --port 8000\n# docker run myimage --port 9000      -> python app.py --port 9000\n```" },
-      "insertText": "ENTRYPOINT [\"${1:executable}\"]\nCMD [\"${2:--default-arg}\", \"${3:value}\"]",
+      "detail": "Nginx Alpine",
+      "documentation": {
+        "value": "Nginx on Alpine Linux."
+      },
+      "insertText": "FROM nginx:${1:alpine}",
       "insertTextRules": 4,
-      "sortText": "31_entrypoint_cmd"
+      "sortText": "19_base_nginx_alpine"
     },
     {
-      "label": ".dockerignore note",
+      "label": "FROM distroless",
       "kind": 15,
-      "detail": "Reminder to create .dockerignore",
-      "documentation": { "value": "Always create a `.dockerignore` file to exclude files from the build context, reducing build time and image size.\n\n```\n# .dockerignore\nnode_modules\n.git\n.env\n*.md\nDockerfile\n.dockerignore\ndist\ncoverage\n.nyc_output\n```" },
-      "insertText": "# Remember to create a .dockerignore file:\n# node_modules\n# .git\n# .env\n# *.md\n# Dockerfile\n# .dockerignore",
+      "detail": "Distroless static",
+      "documentation": {
+        "value": "Google distroless static image (no shell)."
+      },
+      "insertText": "FROM gcr.io/distroless/static-debian12",
       "insertTextRules": 4,
-      "sortText": "50_dockerignore"
+      "sortText": "19_base_distroless"
     },
     {
-      "label": "COPY --link",
+      "label": "FROM scratch",
       "kind": 15,
-      "detail": "Copy with independent layer",
-      "documentation": { "value": "Use `--link` to create an independent layer that doesn't depend on previous layers, enabling better cache reuse.\n\n```dockerfile\nCOPY --link package.json ./\nCOPY --link --from=builder /app/dist ./dist\n```\n\nAvailable since BuildKit. The layer is not invalidated by changes to prior layers." },
-      "insertText": "COPY --link ${1:src} ${2:dest}",
+      "detail": "Scratch (empty)",
+      "documentation": {
+        "value": "Empty base image for static binaries."
+      },
+      "insertText": "FROM scratch",
       "insertTextRules": 4,
-      "sortText": "08_COPY_link"
+      "sortText": "19_base_scratch"
     },
     {
-      "label": "RUN --network=none",
+      "label": "COPY --parents",
       "kind": 15,
-      "detail": "RUN with no network access",
-      "documentation": { "value": "Disable network access during a RUN step for security.\n\n```dockerfile\nRUN --network=none cat /etc/hostname\n```" },
-      "insertText": "RUN --network=none ${1:command}",
+      "detail": "Copy preserving directory structure",
+      "documentation": {
+        "value": "Copy files preserving parent directory structure (BuildKit).\n\n```dockerfile\nCOPY --parents src/app/config.json /app/\n# Creates /app/src/app/config.json\n```"
+      },
+      "insertText": "COPY --parents ${1:src/dir/} ${2:/dest/}",
+      "insertTextRules": 4,
+      "sortText": "02_copy_parents"
+    },
+    {
+      "label": "ADD --keep-git-dir",
+      "kind": 15,
+      "detail": "Add Git repo keeping .git",
+      "documentation": {
+        "value": "Clone and keep the .git directory (BuildKit).\n\n```dockerfile\nADD --keep-git-dir=true https://github.com/user/repo.git /src\n```"
+      },
+      "insertText": "ADD --keep-git-dir=true ${1:https://github.com/user/repo.git} ${2:/src}",
+      "insertTextRules": 4,
+      "sortText": "02_add_gitdir"
+    },
+    {
+      "label": ".dockerignore pattern",
+      "kind": 15,
+      "detail": ".dockerignore best practice",
+      "documentation": {
+        "value": "Recommended .dockerignore contents to reduce build context.\n\n```\n# .dockerignore\nnode_modules\n.git\n.env\n*.md\nDockerfile*\ndocker-compose*\n.dockerignore\n.vscode\n__pycache__\n*.pyc\n.tox\n.coverage\ndist\nbuild\n```"
+      },
+      "insertText": "# .dockerignore\nnode_modules\n.git\n.env\n*.md\nDockerfile*\ndocker-compose*\n.dockerignore\n${1:.vscode}",
       "insertTextRules": 4,
-      "sortText": "01_RUN_nonetwork"
+      "sortText": "09_dockerignore"
     },
     {
-      "label": "LABEL OCI metadata",
+      "label": "COPY heredoc",
       "kind": 15,
-      "detail": "OCI standard image labels",
-      "documentation": { "value": "Apply standardized OCI annotations to your image.\n\n```dockerfile\nLABEL org.opencontainers.image.title=\"My App\" \\\n      org.opencontainers.image.description=\"Description\" \\\n      org.opencontainers.image.version=\"1.0.0\" \\\n      org.opencontainers.image.source=\"https://github.com/user/repo\" \\\n      org.opencontainers.image.licenses=\"MIT\"\n```" },
-      "insertText": "LABEL org.opencontainers.image.title=\"${1:App Name}\" \\\n      org.opencontainers.image.description=\"${2:Description}\" \\\n      org.opencontainers.image.version=\"${3:1.0.0}\" \\\n      org.opencontainers.image.source=\"${4:https://github.com/user/repo}\" \\\n      org.opencontainers.image.licenses=\"${5:MIT}\"",
+      "detail": "Inline file creation with heredoc",
+      "documentation": {
+        "value": "Create files inline using heredoc syntax (BuildKit).\n\n```dockerfile\nCOPY <<EOF /app/config.json\n{\"key\": \"value\"}\nEOF\n```"
+      },
+      "insertText": "COPY <<EOF ${1:/app/config.json}\n${2:content}\nEOF",
       "insertTextRules": 4,
-      "sortText": "03_LABEL_oci"
+      "sortText": "02_copy_heredoc"
     },
     {
-      "label": "Dockerfile: Java Spring Boot app",
+      "label": "RUN pipe pattern",
       "kind": 15,
-      "detail": "Dockerfile for Java Spring Boot using layered JARs",
-      "documentation": { "value": "Multi-stage Dockerfile for a Spring Boot application with dependency layer caching.\n\n```dockerfile\nFROM eclipse-temurin:21-jdk-alpine AS builder\nWORKDIR /app\nCOPY . .\nRUN ./mvnw package -DskipTests\n\nFROM eclipse-temurin:21-jre-alpine\nWORKDIR /app\nCOPY --from=builder /app/target/*.jar app.jar\nRUN addgroup -S spring && adduser -S spring -G spring\nUSER spring\nEXPOSE 8080\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 CMD wget -qO- http://localhost:8080/actuator/health || exit 1\nENTRYPOINT [\"java\", \"-jar\", \"app.jar\"]\n```" },
-      "insertText": "FROM eclipse-temurin:${1:21-jdk-alpine} AS builder\nWORKDIR /app\nCOPY . .\nRUN ./mvnw package -DskipTests\n\nFROM eclipse-temurin:${2:21-jre-alpine}\nWORKDIR /app\nCOPY --from=builder /app/target/*.jar app.jar\nRUN addgroup -S spring && adduser -S spring -G spring\nUSER spring\nEXPOSE ${3:8080}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n  CMD wget -qO- http://localhost:${3:8080}/actuator/health || exit 1\nENTRYPOINT [\"java\", \"-jar\", \"app.jar\"]",
+      "detail": "RUN with pipe and set -o pipefail",
+      "documentation": {
+        "value": "Use pipefail for reliable pipe error detection.\n\n```dockerfile\nRUN set -o pipefail && curl -fsSL https://example.com/install.sh | bash\n```"
+      },
+      "insertText": "RUN set -o pipefail && ${1:curl -fsSL https://example.com/install.sh} | ${2:bash}",
       "insertTextRules": 4,
-      "sortText": "40_full_java"
+      "sortText": "01_run_pipe"
     }
   ]
-}
+}