@enjoys/context-engine 1.7.0 → 1.7.1

package/data/completion/dockerfile.json

@@ -1,1285 +1,1270 @@
-{
-  "language": "dockerfile",
-  "completions": [
-    {
-      "label": "FROM",
-      "kind": 14,
-      "detail": "Base image instruction",
-      "documentation": {
-        "value": "Set the base image for subsequent instructions. Every Dockerfile must start with FROM (except ARG before FROM)."
-      },
-      "insertText": "FROM",
-      "sortText": "00_from"
-    },
-    {
-      "label": "RUN",
-      "kind": 14,
-      "detail": "Execute command",
-      "documentation": {
-        "value": "Execute a command in a new layer on top of the current image and commit the result."
-      },
-      "insertText": "RUN",
-      "sortText": "00_run"
-    },
-    {
-      "label": "CMD",
-      "kind": 14,
-      "detail": "Default command",
-      "documentation": {
-        "value": "Provide defaults for an executing container. Only one CMD per Dockerfile; the last one wins."
-      },
-      "insertText": "CMD",
-      "sortText": "00_cmd"
-    },
-    {
-      "label": "LABEL",
-      "kind": 14,
-      "detail": "Metadata label",
-      "documentation": {
-        "value": "Add metadata key-value pairs to the image."
-      },
-      "insertText": "LABEL",
-      "sortText": "00_label"
-    },
-    {
-      "label": "MAINTAINER",
-      "kind": 14,
-      "detail": "Author (deprecated)",
-      "documentation": {
-        "value": "Set the Author field of the generated image. Deprecated in favor of LABEL."
-      },
-      "insertText": "MAINTAINER",
-      "sortText": "00_maintainer"
-    },
-    {
-      "label": "EXPOSE",
-      "kind": 14,
-      "detail": "Expose port",
-      "documentation": {
-        "value": "Inform Docker that the container listens on the specified network ports at runtime."
-      },
-      "insertText": "EXPOSE",
-      "sortText": "00_expose"
-    },
-    {
-      "label": "ENV",
-      "kind": 14,
-      "detail": "Environment variable",
-      "documentation": {
-        "value": "Set an environment variable that persists in the built image and running containers."
-      },
-      "insertText": "ENV",
-      "sortText": "00_env"
-    },
-    {
-      "label": "ADD",
-      "kind": 14,
-      "detail": "Add files",
-      "documentation": {
-        "value": "Copy files, directories, or remote URLs into the image filesystem. Automatically extracts tar archives."
-      },
-      "insertText": "ADD",
-      "sortText": "00_add"
-    },
-    {
-      "label": "COPY",
-      "kind": 14,
-      "detail": "Copy files",
-      "documentation": {
-        "value": "Copy files or directories from the build context into the image filesystem."
-      },
-      "insertText": "COPY",
-      "sortText": "00_copy"
-    },
-    {
-      "label": "ENTRYPOINT",
-      "kind": 14,
-      "detail": "Container entrypoint",
-      "documentation": {
-        "value": "Configure a container that will run as an executable."
-      },
-      "insertText": "ENTRYPOINT",
-      "sortText": "00_entrypoint"
-    },
-    {
-      "label": "VOLUME",
-      "kind": 14,
-      "detail": "Create mount point",
-      "documentation": {
-        "value": "Create a mount point with the specified name and mark it as holding externally mounted volumes."
-      },
-      "insertText": "VOLUME",
-      "sortText": "00_volume"
-    },
-    {
-      "label": "USER",
-      "kind": 14,
-      "detail": "Set user",
-      "documentation": {
-        "value": "Set the user name or UID (and optionally group) to use for RUN, CMD, and ENTRYPOINT instructions."
-      },
-      "insertText": "USER",
-      "sortText": "00_user"
-    },
-    {
-      "label": "WORKDIR",
-      "kind": 14,
-      "detail": "Set working directory",
-      "documentation": {
-        "value": "Set the working directory for RUN, CMD, ENTRYPOINT, COPY, and ADD instructions."
-      },
-      "insertText": "WORKDIR",
-      "sortText": "00_workdir"
-    },
-    {
-      "label": "ARG",
-      "kind": 14,
-      "detail": "Build argument",
-      "documentation": {
-        "value": "Define a build-time variable that users can pass with --build-arg."
-      },
-      "insertText": "ARG",
-      "sortText": "00_arg"
-    },
-    {
-      "label": "ONBUILD",
-      "kind": 14,
-      "detail": "Deferred instruction",
-      "documentation": {
-        "value": "Add a trigger instruction that executes when the image is used as a base for another build."
-      },
-      "insertText": "ONBUILD",
-      "sortText": "00_onbuild"
-    },
-    {
-      "label": "STOPSIGNAL",
-      "kind": 14,
-      "detail": "Stop signal",
-      "documentation": {
-        "value": "Set the system call signal that will be sent to the container to exit."
-      },
-      "insertText": "STOPSIGNAL",
-      "sortText": "00_stopsignal"
-    },
-    {
-      "label": "HEALTHCHECK",
-      "kind": 14,
-      "detail": "Health check",
-      "documentation": {
-        "value": "Tell Docker how to test a container to check that it is still working."
-      },
-      "insertText": "HEALTHCHECK",
-      "sortText": "00_healthcheck"
-    },
-    {
-      "label": "SHELL",
-      "kind": 14,
-      "detail": "Default shell",
-      "documentation": {
-        "value": "Override the default shell used for the shell form of commands."
-      },
-      "insertText": "SHELL",
-      "sortText": "00_shell"
-    },
-    {
-      "label": "FROM image",
-      "kind": 15,
-      "detail": "FROM with image",
-      "documentation": {
-        "value": "Basic FROM with image name."
-      },
-      "insertText": "FROM ${1:image}",
-      "insertTextRules": 4,
-      "sortText": "01_from_basic"
-    },
-    {
-      "label": "FROM image:tag",
-      "kind": 15,
-      "detail": "FROM with tag",
-      "documentation": {
-        "value": "FROM with explicit image tag."
-      },
-      "insertText": "FROM ${1:image}:${2:tag}",
-      "insertTextRules": 4,
-      "sortText": "01_from_tag"
-    },
-    {
-      "label": "FROM image AS stage",
-      "kind": 15,
-      "detail": "FROM multi-stage",
-      "documentation": {
-        "value": "FROM with AS alias for multi-stage builds."
-      },
-      "insertText": "FROM ${1:image}:${2:tag} AS ${3:builder}",
-      "insertTextRules": 4,
-      "sortText": "01_from_as"
-    },
-    {
-      "label": "FROM --platform",
-      "kind": 15,
-      "detail": "FROM with platform",
-      "documentation": {
-        "value": "FROM with explicit platform for cross-compilation."
-      },
-      "insertText": "FROM --platform=${1|linux/amd64,linux/arm64,linux/arm/v7,\\$BUILDPLATFORM,\\$TARGETPLATFORM|} ${2:image}:${3:tag}",
-      "insertTextRules": 4,
-      "sortText": "01_from_platform"
-    },
-    {
-      "label": "FROM --platform AS",
-      "kind": 15,
-      "detail": "FROM platform + stage",
-      "documentation": {
-        "value": "FROM with platform and stage alias."
-      },
-      "insertText": "FROM --platform=${1|linux/amd64,linux/arm64,\\$BUILDPLATFORM,\\$TARGETPLATFORM|} ${2:image}:${3:tag} AS ${4:stage}",
-      "insertTextRules": 4,
-      "sortText": "01_from_platform_as"
-    },
-    {
-      "label": "FROM scratch",
-      "kind": 15,
-      "detail": "FROM scratch (empty)",
-      "documentation": {
-        "value": "Start from an empty image, used for statically linked binaries."
-      },
-      "insertText": "FROM scratch",
-      "insertTextRules": 4,
-      "sortText": "01_from_scratch"
-    },
-    {
-      "label": "RUN shell",
-      "kind": 15,
-      "detail": "RUN shell form",
-      "documentation": {
-        "value": "Execute command in shell form (/bin/sh -c)."
-      },
-      "insertText": "RUN ${1:command}",
-      "insertTextRules": 4,
-      "sortText": "02_run_shell"
-    },
-    {
-      "label": "RUN exec",
-      "kind": 15,
-      "detail": "RUN exec form",
-      "documentation": {
-        "value": "Execute command in exec form (no shell processing)."
-      },
-      "insertText": "RUN [\"${1:executable}\", \"${2:arg1}\", \"${3:arg2}\"]",
-      "insertTextRules": 4,
-      "sortText": "02_run_exec"
-    },
-    {
-      "label": "RUN --mount=cache",
-      "kind": 15,
-      "detail": "RUN with cache mount",
-      "documentation": {
-        "value": "Mount a persistent cache directory for package managers."
-      },
-      "insertText": "RUN --mount=type=cache,target=${1:/var/cache/apt} \\\n    ${2:apt-get update && apt-get install -y package}",
-      "insertTextRules": 4,
-      "sortText": "02_run_mount_cache"
-    },
-    {
-      "label": "RUN --mount=bind",
-      "kind": 15,
-      "detail": "RUN with bind mount",
-      "documentation": {
-        "value": "Bind mount a directory from the build context."
-      },
-      "insertText": "RUN --mount=type=bind,source=${1:src},target=${2:/app/src} \\\n    ${3:command}",
-      "insertTextRules": 4,
-      "sortText": "02_run_mount_bind"
-    },
-    {
-      "label": "RUN --mount=secret",
-      "kind": 15,
-      "detail": "RUN with secret mount",
-      "documentation": {
-        "value": "Mount a secret file without persisting in the image layer."
-      },
-      "insertText": "RUN --mount=type=secret,id=${1:mysecret},target=${2:/run/secrets/mysecret} \\\n    ${3:cat /run/secrets/mysecret}",
-      "insertTextRules": 4,
-      "sortText": "02_run_mount_secret"
-    },
-    {
-      "label": "RUN --mount=ssh",
-      "kind": 15,
-      "detail": "RUN with SSH mount",
-      "documentation": {
-        "value": "Forward SSH agent for private repo access during build."
-      },
-      "insertText": "RUN --mount=type=ssh \\\n    ${1:git clone git@github.com:user/repo.git}",
-      "insertTextRules": 4,
-      "sortText": "02_run_mount_ssh"
-    },
-    {
-      "label": "RUN --mount=tmpfs",
-      "kind": 15,
-      "detail": "RUN with tmpfs mount",
-      "documentation": {
-        "value": "Mount a tmpfs for temporary scratch space."
-      },
-      "insertText": "RUN --mount=type=tmpfs,target=${1:/tmp} \\\n    ${2:command}",
-      "insertTextRules": 4,
-      "sortText": "02_run_mount_tmpfs"
-    },
-    {
-      "label": "RUN heredoc",
-      "kind": 15,
-      "detail": "RUN with heredoc",
-      "documentation": {
-        "value": "Run multi-line script using heredoc syntax (BuildKit)."
-      },
-      "insertText": "RUN <<EOF\n${1:#!/bin/bash\nset -e\necho \"hello\"}\nEOF",
-      "insertTextRules": 4,
-      "sortText": "02_run_heredoc"
-    },
-    {
-      "label": "RUN apt-get install",
-      "kind": 15,
-      "detail": "RUN apt-get best practice",
-      "documentation": {
-        "value": "Best practice apt-get install: update + install + clean in one layer."
-      },
-      "insertText": "RUN apt-get update && apt-get install -y --no-install-recommends \\\n    ${1:package1} \\\n    ${2:package2} \\\n    && rm -rf /var/lib/apt/lists/*",
-      "insertTextRules": 4,
-      "sortText": "02_run_apt"
-    },
-    {
-      "label": "RUN pip install",
-      "kind": 15,
-      "detail": "RUN pip install",
-      "documentation": {
-        "value": "Install Python packages with no cache for smaller images."
-      },
-      "insertText": "RUN pip install --no-cache-dir ${1:-r requirements.txt}",
-      "insertTextRules": 4,
-      "sortText": "02_run_pip"
-    },
-    {
-      "label": "RUN npm ci",
-      "kind": 15,
-      "detail": "RUN npm ci",
-      "documentation": {
-        "value": "Install Node.js dependencies for reproducible builds."
-      },
-      "insertText": "RUN npm ci --only=production",
-      "insertTextRules": 4,
-      "sortText": "02_run_npm_ci"
-    },
-    {
-      "label": "RUN apk add",
-      "kind": 15,
-      "detail": "RUN apk add (Alpine)",
-      "documentation": {
-        "value": "Install packages on Alpine Linux."
-      },
-      "insertText": "RUN apk add --no-cache \\\n    ${1:package1} \\\n    ${2:package2}",
-      "insertTextRules": 4,
-      "sortText": "02_run_apk"
-    },
-    {
-      "label": "RUN --network=none",
-      "kind": 15,
-      "detail": "RUN without network",
-      "documentation": {
-        "value": "Run command with network disabled for security."
-      },
-      "insertText": "RUN --network=none ${1:command}",
-      "insertTextRules": 4,
-      "sortText": "02_run_network_none"
-    },
-    {
-      "label": "RUN --security=insecure",
-      "kind": 15,
-      "detail": "RUN insecure (privileged)",
-      "documentation": {
-        "value": "Run with elevated privileges (requires security.insecure entitlement)."
-      },
-      "insertText": "RUN --security=insecure ${1:command}",
-      "insertTextRules": 4,
-      "sortText": "02_run_security"
-    },
-    {
-      "label": "RUN useradd",
-      "kind": 15,
-      "detail": "RUN create user",
-      "documentation": {
-        "value": "Create a non-root user for running the application."
-      },
-      "insertText": "RUN groupadd -r ${1:appuser} && useradd -r -g ${1:appuser} -d /home/${1:appuser} -s /sbin/nologin ${1:appuser}",
-      "insertTextRules": 4,
-      "sortText": "02_run_useradd"
-    },
-    {
-      "label": "RUN adduser Alpine",
-      "kind": 15,
-      "detail": "RUN create user (Alpine)",
-      "documentation": {
-        "value": "Create a non-root user on Alpine."
-      },
-      "insertText": "RUN addgroup -S ${1:appuser} && adduser -S ${1:appuser} -G ${1:appuser}",
-      "insertTextRules": 4,
-      "sortText": "02_run_adduser_alpine"
-    },
-    {
-      "label": "CMD exec form",
-      "kind": 15,
-      "detail": "CMD exec form",
-      "documentation": {
-        "value": "Set default command in exec form (preferred)."
-      },
-      "insertText": "CMD [\"${1:executable}\", \"${2:arg1}\"]",
-      "insertTextRules": 4,
-      "sortText": "03_cmd_exec"
-    },
-    {
-      "label": "CMD shell form",
-      "kind": 15,
-      "detail": "CMD shell form",
-      "documentation": {
-        "value": "Set default command in shell form."
-      },
-      "insertText": "CMD ${1:command arg1 arg2}",
-      "insertTextRules": 4,
-      "sortText": "03_cmd_shell"
-    },
-    {
-      "label": "CMD as ENTRYPOINT params",
-      "kind": 15,
-      "detail": "CMD default parameters",
-      "documentation": {
-        "value": "Provide default parameters to ENTRYPOINT."
-      },
-      "insertText": "CMD [\"${1:--help}\"]",
-      "insertTextRules": 4,
-      "sortText": "03_cmd_params"
-    },
-    {
-      "label": "ENTRYPOINT exec form",
-      "kind": 15,
-      "detail": "ENTRYPOINT exec form",
-      "documentation": {
-        "value": "Set entrypoint in exec form (preferred)."
-      },
-      "insertText": "ENTRYPOINT [\"${1:executable}\", \"${2:arg1}\"]",
-      "insertTextRules": 4,
-      "sortText": "04_entrypoint_exec"
-    },
-    {
-      "label": "ENTRYPOINT shell form",
-      "kind": 15,
-      "detail": "ENTRYPOINT shell form",
-      "documentation": {
-        "value": "Set entrypoint in shell form."
-      },
-      "insertText": "ENTRYPOINT ${1:command arg1}",
-      "insertTextRules": 4,
-      "sortText": "04_entrypoint_shell"
-    },
-    {
-      "label": "ENTRYPOINT with tini",
-      "kind": 15,
-      "detail": "ENTRYPOINT with tini",
-      "documentation": {
-        "value": "Use tini as PID 1 for proper signal handling."
-      },
-      "insertText": "ENTRYPOINT [\"tini\", \"--\", \"${1:executable}\"]",
-      "insertTextRules": 4,
-      "sortText": "04_entrypoint_tini"
-    },
-    {
-      "label": "ENTRYPOINT with dumb-init",
-      "kind": 15,
-      "detail": "ENTRYPOINT with dumb-init",
-      "documentation": {
-        "value": "Use dumb-init as PID 1 for signal forwarding."
-      },
-      "insertText": "ENTRYPOINT [\"dumb-init\", \"--\", \"${1:executable}\"]",
-      "insertTextRules": 4,
-      "sortText": "04_entrypoint_dumb_init"
-    },
-    {
-      "label": "COPY basic",
-      "kind": 15,
-      "detail": "COPY files",
-      "documentation": {
-        "value": "Copy files from build context into the image."
-      },
-      "insertText": "COPY ${1:src} ${2:dest}",
-      "insertTextRules": 4,
-      "sortText": "05_copy_basic"
-    },
-    {
-      "label": "COPY --chown",
-      "kind": 15,
-      "detail": "COPY with chown",
-      "documentation": {
-        "value": "Copy files and set ownership."
-      },
-      "insertText": "COPY --chown=${1:user}:${2:group} ${3:src} ${4:dest}",
-      "insertTextRules": 4,
-      "sortText": "05_copy_chown"
-    },
-    {
-      "label": "COPY --chmod",
-      "kind": 15,
-      "detail": "COPY with chmod",
-      "documentation": {
-        "value": "Copy files and set permissions (BuildKit)."
-      },
-      "insertText": "COPY --chmod=${1:755} ${2:src} ${3:dest}",
-      "insertTextRules": 4,
-      "sortText": "05_copy_chmod"
-    },
-    {
-      "label": "COPY --from",
-      "kind": 15,
-      "detail": "COPY from stage",
-      "documentation": {
-        "value": "Copy files from a named build stage (multi-stage)."
-      },
-      "insertText": "COPY --from=${1:builder} ${2:/app/build} ${3:/usr/share/nginx/html}",
-      "insertTextRules": 4,
-      "sortText": "05_copy_from"
-    },
-    {
-      "label": "COPY --link",
-      "kind": 15,
-      "detail": "COPY with link",
-      "documentation": {
-        "value": "Copy files using link mode for better cache efficiency."
-      },
-      "insertText": "COPY --link ${1:src} ${2:dest}",
-      "insertTextRules": 4,
-      "sortText": "05_copy_link"
-    },
-    {
-      "label": "COPY package*.json",
-      "kind": 15,
-      "detail": "COPY package files first",
-      "documentation": {
-        "value": "Copy only package files first for better layer caching."
-      },
-      "insertText": "COPY package*.json ${1:./}\nRUN npm ci\nCOPY ${2:.} ${3:./}",
-      "insertTextRules": 4,
-      "sortText": "05_copy_package_cache"
-    },
-    {
-      "label": "ADD basic",
-      "kind": 15,
-      "detail": "ADD files",
-      "documentation": {
-        "value": "Add files from build context (or URL/tar) into the image."
-      },
-      "insertText": "ADD ${1:src} ${2:dest}",
-      "insertTextRules": 4,
-      "sortText": "06_add_basic"
-    },
-    {
-      "label": "ADD URL",
-      "kind": 15,
-      "detail": "ADD from URL",
-      "documentation": {
-        "value": "Download a file from a URL into the image."
-      },
-      "insertText": "ADD ${1:https://example.com/file.tar.gz} ${2:/tmp/}",
-      "insertTextRules": 4,
-      "sortText": "06_add_url"
-    },
-    {
-      "label": "ADD tar",
-      "kind": 15,
-      "detail": "ADD tar auto-extract",
-      "documentation": {
-        "value": "Add and auto-extract a tar archive."
-      },
-      "insertText": "ADD ${1:archive.tar.gz} ${2:/opt/}",
-      "insertTextRules": 4,
-      "sortText": "06_add_tar"
-    },
-    {
-      "label": "ADD --checksum",
-      "kind": 15,
-      "detail": "ADD with checksum",
-      "documentation": {
-        "value": "Add file with SHA256 checksum verification (BuildKit)."
-      },
-      "insertText": "ADD --checksum=sha256:${1:hash} ${2:https://example.com/file} ${3:/dest}",
-      "insertTextRules": 4,
-      "sortText": "06_add_checksum"
-    },
-    {
-      "label": "ENV single",
-      "kind": 15,
-      "detail": "ENV single variable",
-      "documentation": {
-        "value": "Set a single environment variable."
-      },
-      "insertText": "ENV ${1:KEY}=${2:value}",
-      "insertTextRules": 4,
-      "sortText": "07_env_single"
-    },
-    {
-      "label": "ENV multiple",
-      "kind": 15,
-      "detail": "ENV multiple variables",
-      "documentation": {
-        "value": "Set multiple environment variables."
-      },
-      "insertText": "ENV ${1:KEY1}=${2:value1} \\\n    ${3:KEY2}=${4:value2}",
-      "insertTextRules": 4,
-      "sortText": "07_env_multiple"
-    },
-    {
-      "label": "ENV PATH",
-      "kind": 15,
-      "detail": "ENV prepend PATH",
-      "documentation": {
-        "value": "Prepend a directory to PATH."
-      },
-      "insertText": "ENV PATH=\"${1:/app/bin}:$$PATH\"",
-      "insertTextRules": 4,
-      "sortText": "07_env_path"
-    },
-    {
-      "label": "ENV NODE_ENV",
-      "kind": 15,
-      "detail": "ENV NODE_ENV production",
-      "documentation": {
-        "value": "Set Node.js production environment."
-      },
-      "insertText": "ENV NODE_ENV=production",
-      "insertTextRules": 4,
-      "sortText": "07_env_node"
-    },
-    {
-      "label": "ENV PYTHONDONTWRITEBYTECODE",
-      "kind": 15,
-      "detail": "ENV Python optimizations",
-      "documentation": {
-        "value": "Common Python env vars for Docker."
-      },
-      "insertText": "ENV PYTHONDONTWRITEBYTECODE=1 \\\n    PYTHONUNBUFFERED=1",
-      "insertTextRules": 4,
-      "sortText": "07_env_python"
-    },
-    {
-      "label": "ARG basic",
-      "kind": 15,
-      "detail": "ARG variable",
-      "documentation": {
-        "value": "Define a build-time argument."
-      },
-      "insertText": "ARG ${1:NAME}",
-      "insertTextRules": 4,
-      "sortText": "08_arg_basic"
-    },
-    {
-      "label": "ARG with default",
-      "kind": 15,
-      "detail": "ARG with default value",
-      "documentation": {
-        "value": "Define a build arg with a default value."
-      },
-      "insertText": "ARG ${1:NAME}=${2:default}",
-      "insertTextRules": 4,
-      "sortText": "08_arg_default"
-    },
-    {
-      "label": "ARG before FROM",
-      "kind": 15,
-      "detail": "ARG before FROM",
-      "documentation": {
-        "value": "Define ARG before FROM for use in FROM instruction."
-      },
-      "insertText": "ARG ${1:VERSION}=${2:latest}\nFROM ${3:node}:${1:VERSION}",
-      "insertTextRules": 4,
-      "sortText": "08_arg_before_from"
-    },
-    {
-      "label": "EXPOSE port",
-      "kind": 15,
-      "detail": "EXPOSE single port",
-      "documentation": {
-        "value": "Expose a single port."
-      },
-      "insertText": "EXPOSE ${1:8080}",
-      "insertTextRules": 4,
-      "sortText": "09_expose_single"
-    },
-    {
-      "label": "EXPOSE multiple",
-      "kind": 15,
-      "detail": "EXPOSE multiple ports",
-      "documentation": {
-        "value": "Expose multiple ports."
-      },
-      "insertText": "EXPOSE ${1:80} ${2:443}",
-      "insertTextRules": 4,
-      "sortText": "09_expose_multiple"
-    },
-    {
-      "label": "EXPOSE UDP",
-      "kind": 15,
-      "detail": "EXPOSE UDP port",
-      "documentation": {
-        "value": "Expose a UDP port."
-      },
-      "insertText": "EXPOSE ${1:53}/udp",
-      "insertTextRules": 4,
-      "sortText": "09_expose_udp"
-    },
-    {
-      "label": "VOLUME path",
-      "kind": 15,
-      "detail": "VOLUME mount point",
-      "documentation": {
-        "value": "Create a mount point."
-      },
-      "insertText": "VOLUME ${1:/data}",
-      "insertTextRules": 4,
-      "sortText": "10_volume"
-    },
-    {
-      "label": "VOLUME JSON",
-      "kind": 15,
-      "detail": "VOLUME multiple",
-      "documentation": {
-        "value": "Create multiple mount points."
-      },
-      "insertText": "VOLUME [\"${1:/data}\", \"${2:/logs}\"]",
-      "insertTextRules": 4,
-      "sortText": "10_volume_json"
-    },
-    {
-      "label": "USER name",
-      "kind": 15,
-      "detail": "USER set user",
-      "documentation": {
-        "value": "Switch to a non-root user."
-      },
-      "insertText": "USER ${1:appuser}",
-      "insertTextRules": 4,
-      "sortText": "11_user"
-    },
-    {
-      "label": "USER uid:gid",
-      "kind": 15,
-      "detail": "USER with UID:GID",
-      "documentation": {
-        "value": "Switch to a specific UID:GID."
-      },
-      "insertText": "USER ${1:1001}:${2:1001}",
-      "insertTextRules": 4,
-      "sortText": "11_user_uid"
-    },
-    {
-      "label": "WORKDIR path",
-      "kind": 15,
-      "detail": "WORKDIR set directory",
-      "documentation": {
-        "value": "Set the working directory."
-      },
-      "insertText": "WORKDIR ${1:/app}",
-      "insertTextRules": 4,
-      "sortText": "12_workdir"
-    },
-    {
-      "label": "LABEL single",
-      "kind": 15,
-      "detail": "LABEL single",
-      "documentation": {
-        "value": "Add a single metadata label."
-      },
-      "insertText": "LABEL ${1:key}=\"${2:value}\"",
-      "insertTextRules": 4,
-      "sortText": "13_label_single"
-    },
-    {
-      "label": "LABEL multiple",
-      "kind": 15,
-      "detail": "LABEL multiple",
-      "documentation": {
-        "value": "Add multiple metadata labels."
-      },
-      "insertText": "LABEL ${1:maintainer}=\"${2:name}\" \\\n      ${3:version}=\"${4:1.0}\"",
-      "insertTextRules": 4,
-      "sortText": "13_label_multiple"
-    },
-    {
-      "label": "LABEL OCI",
-      "kind": 15,
-      "detail": "LABEL OCI annotations",
-      "documentation": {
-        "value": "OCI image spec annotation labels."
-      },
-      "insertText": "LABEL org.opencontainers.image.title=\"${1:title}\" \\\n      org.opencontainers.image.description=\"${2:description}\" \\\n      org.opencontainers.image.version=\"${3:1.0.0}\" \\\n      org.opencontainers.image.authors=\"${4:author}\" \\\n      org.opencontainers.image.source=\"${5:https://github.com/user/repo}\" \\\n      org.opencontainers.image.licenses=\"${6:MIT}\"",
-      "insertTextRules": 4,
-      "sortText": "13_label_oci"
-    },
-    {
-      "label": "HEALTHCHECK CMD",
-      "kind": 15,
-      "detail": "HEALTHCHECK CMD",
-      "documentation": {
-        "value": "Health check with HTTP endpoint."
-      },
-      "insertText": "HEALTHCHECK --interval=${1:30s} --timeout=${2:10s} --start-period=${3:5s} --retries=${4:3} \\\n    CMD ${5:curl -f http://localhost:${6:8080}/health || exit 1}",
-      "insertTextRules": 4,
-      "sortText": "14_healthcheck_cmd"
-    },
-    {
-      "label": "HEALTHCHECK wget",
-      "kind": 15,
-      "detail": "HEALTHCHECK with wget",
-      "documentation": {
-        "value": "Health check using wget (for alpine/minimal images)."
-      },
-      "insertText": "HEALTHCHECK --interval=${1:30s} --timeout=${2:10s} --retries=${3:3} \\\n    CMD wget --quiet --tries=1 --spider http://localhost:${4:8080}/health || exit 1",
-      "insertTextRules": 4,
-      "sortText": "14_healthcheck_wget"
-    },
-    {
-      "label": "HEALTHCHECK NONE",
-      "kind": 15,
-      "detail": "HEALTHCHECK NONE",
-      "documentation": {
-        "value": "Disable health check inherited from base image."
-      },
-      "insertText": "HEALTHCHECK NONE",
-      "insertTextRules": 4,
-      "sortText": "14_healthcheck_none"
-    },
-    {
-      "label": "SHELL bash",
-      "kind": 15,
-      "detail": "SHELL set to bash",
-      "documentation": {
-        "value": "Set default shell to bash."
-      },
-      "insertText": "SHELL [\"/bin/bash\", \"-c\"]",
-      "insertTextRules": 4,
-      "sortText": "15_shell_bash"
-    },
-    {
-      "label": "SHELL powershell",
-      "kind": 15,
-      "detail": "SHELL set to PowerShell",
-      "documentation": {
-        "value": "Set default shell to PowerShell (Windows)."
-      },
-      "insertText": "SHELL [\"powershell\", \"-Command\"]",
-      "insertTextRules": 4,
-      "sortText": "15_shell_powershell"
-    },
-    {
-      "label": "STOPSIGNAL",
-      "kind": 15,
-      "detail": "STOPSIGNAL",
-      "documentation": {
-        "value": "Set stop signal."
-      },
-      "insertText": "STOPSIGNAL ${1|SIGTERM,SIGQUIT,SIGINT,SIGKILL|}",
-      "insertTextRules": 4,
-      "sortText": "16_stopsignal"
-    },
-    {
-      "label": "ONBUILD",
-      "kind": 15,
-      "detail": "ONBUILD trigger",
-      "documentation": {
-        "value": "Add instruction to execute when image is used as base."
-      },
-      "insertText": "ONBUILD ${1:RUN echo \"triggered\"}",
-      "insertTextRules": 4,
-      "sortText": "17_onbuild"
-    },
-    {
-      "label": "# syntax=",
-      "kind": 15,
-      "detail": "syntax parser directive",
-      "documentation": {
-        "value": "Set BuildKit frontend syntax (must be first line)."
-      },
-      "insertText": "# syntax=docker/dockerfile:${1|1,1.4,1.5,1.6,1.7,labs|}",
-      "insertTextRules": 4,
-      "sortText": "00_syntax"
-    },
-    {
-      "label": "# escape=",
-      "kind": 15,
-      "detail": "escape parser directive",
-      "documentation": {
-        "value": "Change the escape character (must be before any instruction)."
-      },
-      "insertText": "# escape=${1|\\\\,`|}",
-      "insertTextRules": 4,
-      "sortText": "00_escape"
-    },
-    {
-      "label": "Dockerfile: Node.js multi-stage",
-      "kind": 15,
-      "detail": "Node.js multi-stage Dockerfile",
-      "documentation": {
-        "value": "Production-ready multi-stage Dockerfile for a Node.js application."
-      },
-      "insertText": "# syntax=docker/dockerfile:1\nFROM node:${1:20}-alpine AS deps\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci --only=production\n\nFROM node:${1:20}-alpine AS builder\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n\nFROM node:${1:20}-alpine\nWORKDIR /app\nENV NODE_ENV=production\nRUN addgroup -S appuser && adduser -S appuser -G appuser\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY --from=builder /app/dist ./dist\nCOPY package*.json ./\nUSER appuser\nEXPOSE ${2:3000}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD wget --quiet --tries=1 --spider http://localhost:${2:3000}/health || exit 1\nCMD [\"node\", \"dist/index.js\"]",
-      "insertTextRules": 4,
-      "sortText": "20_tmpl_node"
-    },
-    {
-      "label": "Dockerfile: Python multi-stage",
-      "kind": 15,
-      "detail": "Python multi-stage Dockerfile",
-      "documentation": {
-        "value": "Production-ready multi-stage Dockerfile for a Python application."
-      },
-      "insertText": "# syntax=docker/dockerfile:1\nFROM python:${1:3.12}-slim AS builder\nWORKDIR /app\nENV PYTHONDONTWRITEBYTECODE=1 \\\n    PYTHONUNBUFFERED=1\nCOPY requirements.txt .\nRUN pip install --no-cache-dir --prefix=/install -r requirements.txt\n\nFROM python:${1:3.12}-slim\nWORKDIR /app\nENV PYTHONDONTWRITEBYTECODE=1 \\\n    PYTHONUNBUFFERED=1\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nCOPY --from=builder /install /usr/local\nCOPY . .\nUSER appuser\nEXPOSE ${2:8000}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD python -c \"import urllib.request; urllib.request.urlopen('http://localhost:${2:8000}/health')\" || exit 1\nCMD [\"python\", \"-m\", \"${3:app}\"]",
-      "insertTextRules": 4,
-      "sortText": "20_tmpl_python"
-    },
-    {
-      "label": "Dockerfile: Go multi-stage",
-      "kind": 15,
-      "detail": "Go multi-stage Dockerfile",
-      "documentation": {
-        "value": "Production-ready multi-stage Dockerfile for a Go application."
-      },
-      "insertText": "# syntax=docker/dockerfile:1\nFROM golang:${1:1.22}-alpine AS builder\nWORKDIR /app\nCOPY go.mod go.sum ./\nRUN go mod download\nCOPY . .\nRUN CGO_ENABLED=0 GOOS=linux go build -ldflags=\"-s -w\" -o /app/server ./cmd/${2:server}\n\nFROM gcr.io/distroless/static-debian12\nCOPY --from=builder /app/server /server\nEXPOSE ${3:8080}\nUSER nonroot:nonroot\nENTRYPOINT [\"/server\"]",
-      "insertTextRules": 4,
-      "sortText": "20_tmpl_go"
-    },
-    {
-      "label": "Dockerfile: Java Maven multi-stage",
-      "kind": 15,
-      "detail": "Java/Maven multi-stage Dockerfile",
-      "documentation": {
-        "value": "Production-ready multi-stage Dockerfile for a Java application built with Maven."
-      },
-      "insertText": "# syntax=docker/dockerfile:1\nFROM maven:${1:3.9}-eclipse-temurin-${2:21} AS builder\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn package -DskipTests -B\n\nFROM eclipse-temurin:${2:21}-jre-alpine\nWORKDIR /app\nRUN addgroup -S appuser && adduser -S appuser -G appuser\nCOPY --from=builder /app/target/*.jar app.jar\nUSER appuser\nEXPOSE ${3:8080}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD wget --quiet --tries=1 --spider http://localhost:${3:8080}/actuator/health || exit 1\nENTRYPOINT [\"java\", \"-jar\", \"app.jar\"]",
-      "insertTextRules": 4,
-      "sortText": "20_tmpl_java"
-    },
-    {
-      "label": "Dockerfile: Rust multi-stage",
-      "kind": 15,
-      "detail": "Rust multi-stage Dockerfile",
-      "documentation": {
-        "value": "Production-ready multi-stage Dockerfile for a Rust application."
-      },
-      "insertText": "# syntax=docker/dockerfile:1\nFROM rust:${1:1.77}-slim AS builder\nWORKDIR /app\nCOPY Cargo.toml Cargo.lock ./\nRUN mkdir src && echo \"fn main() {}\" > src/main.rs && cargo build --release && rm -rf src\nCOPY src ./src\nRUN cargo build --release\n\nFROM debian:${2:bookworm}-slim\nRUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nCOPY --from=builder /app/target/release/${3:myapp} /usr/local/bin/\nUSER appuser\nEXPOSE ${4:8080}\nENTRYPOINT [\"${3:myapp}\"]",
-      "insertTextRules": 4,
-      "sortText": "20_tmpl_rust"
-    },
-    {
-      "label": "Dockerfile: .NET multi-stage",
-      "kind": 15,
-      "detail": ".NET multi-stage Dockerfile",
-      "documentation": {
-        "value": "Production-ready multi-stage Dockerfile for a .NET application."
-      },
-      "insertText": "# syntax=docker/dockerfile:1\nFROM mcr.microsoft.com/dotnet/sdk:${1:8.0} AS builder\nWORKDIR /app\nCOPY *.csproj .\nRUN dotnet restore\nCOPY . .\nRUN dotnet publish -c Release -o /out --no-restore\n\nFROM mcr.microsoft.com/dotnet/aspnet:${1:8.0}\nWORKDIR /app\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nCOPY --from=builder /out .\nUSER appuser\nEXPOSE ${2:8080}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD curl -f http://localhost:${2:8080}/health || exit 1\nENTRYPOINT [\"dotnet\", \"${3:MyApp}.dll\"]",
-      "insertTextRules": 4,
-      "sortText": "20_tmpl_dotnet"
-    },
-    {
-      "label": "Dockerfile: Nginx static site",
-      "kind": 15,
-      "detail": "Nginx static site Dockerfile",
-      "documentation": {
-        "value": "Serve static files with Nginx using a multi-stage build."
-      },
-      "insertText": "# syntax=docker/dockerfile:1\nFROM node:${1:20}-alpine AS builder\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n\nFROM nginx:${2:alpine}\nCOPY --from=builder /app/${3:dist} /usr/share/nginx/html\nCOPY ${4:nginx.conf} /etc/nginx/conf.d/default.conf\nEXPOSE 80\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD curl -f http://localhost/ || exit 1\nCMD [\"nginx\", \"-g\", \"daemon off;\"]",
-      "insertTextRules": 4,
-      "sortText": "20_tmpl_nginx"
-    },
-    {
-      "label": "Dockerfile: PHP-FPM",
-      "kind": 15,
-      "detail": "PHP-FPM Dockerfile",
-      "documentation": {
-        "value": "PHP-FPM application Dockerfile with Composer."
-      },
-      "insertText": "# syntax=docker/dockerfile:1\nFROM composer:${1:2} AS vendor\nWORKDIR /app\nCOPY composer.json composer.lock ./\nRUN composer install --no-dev --no-scripts --no-autoloader\nCOPY . .\nRUN composer dump-autoload --optimize\n\nFROM php:${2:8.3}-fpm-alpine\nWORKDIR /var/www/html\nRUN docker-php-ext-install pdo pdo_mysql opcache\nCOPY --from=vendor /app .\nRUN chown -R www-data:www-data /var/www/html\nUSER www-data\nEXPOSE 9000\nCMD [\"php-fpm\"]",
-      "insertTextRules": 4,
-      "sortText": "20_tmpl_php"
-    },
-    {
-      "label": "Dockerfile: Ruby/Rails",
-      "kind": 15,
-      "detail": "Ruby/Rails Dockerfile",
-      "documentation": {
-        "value": "Production-ready Dockerfile for a Ruby on Rails application."
-      },
-      "insertText": "# syntax=docker/dockerfile:1\nFROM ruby:${1:3.3}-slim AS builder\nWORKDIR /app\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    build-essential libpq-dev \\\n    && rm -rf /var/lib/apt/lists/*\nCOPY Gemfile Gemfile.lock ./\nRUN bundle config set --local deployment true \\\n    && bundle config set --local without \"development test\" \\\n    && bundle install\n\nFROM ruby:${1:3.3}-slim\nWORKDIR /app\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    libpq5 \\\n    && rm -rf /var/lib/apt/lists/*\nRUN groupadd -r rails && useradd -r -g rails rails\nCOPY --from=builder /app/vendor/bundle ./vendor/bundle\nCOPY . .\nRUN bundle config set --local path vendor/bundle\nUSER rails\nEXPOSE ${2:3000}\nCMD [\"bundle\", \"exec\", \"rails\", \"server\", \"-b\", \"0.0.0.0\"]",
-      "insertTextRules": 4,
-      "sortText": "20_tmpl_ruby"
-    },
-    {
-      "label": "Non-root user setup",
-      "kind": 15,
-      "detail": "Non-root user pattern",
-      "documentation": {
-        "value": "Best practice: create and switch to a non-root user."
-      },
-      "insertText": "RUN groupadd -r ${1:appuser} && useradd -r -g ${1:appuser} -d /home/${1:appuser} -s /sbin/nologin ${1:appuser} \\\n    && mkdir -p /home/${1:appuser} && chown -R ${1:appuser}:${1:appuser} /home/${1:appuser}\nUSER ${1:appuser}",
-      "insertTextRules": 4,
-      "sortText": "18_bp_nonroot"
-    },
-    {
-      "label": "apt-get best practice",
-      "kind": 15,
-      "detail": "apt-get best practice layer",
-      "documentation": {
-        "value": "Install packages and clean up in a single layer."
-      },
-      "insertText": "RUN apt-get update \\\n    && apt-get install -y --no-install-recommends \\\n        ${1:curl} \\\n        ${2:ca-certificates} \\\n    && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \\\n    && rm -rf /var/lib/apt/lists/*",
-      "insertTextRules": 4,
-      "sortText": "18_bp_apt"
-    },
-    {
-      "label": "pip best practice",
-      "kind": 15,
-      "detail": "pip install best practice",
-      "documentation": {
-        "value": "Install Python packages without cache."
-      },
-      "insertText": "COPY requirements.txt .\nRUN pip install --no-cache-dir --upgrade pip \\\n    && pip install --no-cache-dir -r requirements.txt",
-      "insertTextRules": 4,
-      "sortText": "18_bp_pip"
-    },
-    {
-      "label": "npm ci pattern",
-      "kind": 15,
-      "detail": "npm ci production pattern",
-      "documentation": {
-        "value": "Install production Node.js dependencies."
-      },
-      "insertText": "COPY package.json package-lock.json ./\nRUN npm ci --only=production \\\n    && npm cache clean --force",
-      "insertTextRules": 4,
-      "sortText": "18_bp_npm"
-    },
-    {
-      "label": "Multi-stage build pattern",
-      "kind": 15,
-      "detail": "Multi-stage build skeleton",
-      "documentation": {
-        "value": "Basic multi-stage build skeleton."
-      },
-      "insertText": "FROM ${1:node:20-alpine} AS builder\nWORKDIR /app\nCOPY . .\nRUN ${2:npm ci && npm run build}\n\nFROM ${3:node:20-alpine}\nWORKDIR /app\nCOPY --from=builder /app/${4:dist} ./${4:dist}\nEXPOSE ${5:3000}\nCMD ${6:[\"node\", \"dist/index.js\"]}",
-      "insertTextRules": 4,
-      "sortText": "18_bp_multistage"
-    },
-    {
-      "label": "Distroless final stage",
-      "kind": 15,
-      "detail": "Distroless final stage",
-      "documentation": {
-        "value": "Use Google distroless as the final minimal image."
-      },
-      "insertText": "FROM gcr.io/distroless/${1|static-debian12,base-debian12,cc-debian12,java21-debian12,python3-debian12,nodejs22-debian12|}\nCOPY --from=builder ${2:/app/binary} ${3:/}\nUSER nonroot:nonroot\nENTRYPOINT [\"${4:/binary}\"]",
-      "insertTextRules": 4,
-      "sortText": "18_bp_distroless"
-    },
-    {
-      "label": "Signal handling (tini)",
-      "kind": 15,
-      "detail": "Signal handling with tini",
-      "documentation": {
-        "value": "Use tini init for proper PID 1 signal handling."
-      },
-      "insertText": "RUN apt-get update && apt-get install -y --no-install-recommends tini \\\n    && rm -rf /var/lib/apt/lists/*\nENTRYPOINT [\"tini\", \"--\"]\nCMD [\"${1:node}\", \"${2:server.js}\"]",
-      "insertTextRules": 4,
-      "sortText": "18_bp_tini"
-    },
-    {
-      "label": "Build cache optimization",
-      "kind": 15,
-      "detail": "Layer caching order",
-      "documentation": {
-        "value": "Copy dependency files before source for cache optimization."
-      },
-      "insertText": "# Copy dependency manifests first (changes less often)\nCOPY ${1:package.json} ${2:package-lock.json} ./\nRUN ${3:npm ci}\n\n# Copy source code (changes more often)\nCOPY . .\nRUN ${4:npm run build}",
-      "insertTextRules": 4,
-      "sortText": "18_bp_cache_order"
-    },
-    {
-      "label": "FROM alpine",
-      "kind": 15,
-      "detail": "Alpine Linux",
-      "documentation": {
-        "value": "Minimal 5MB Alpine Linux base image."
-      },
-      "insertText": "FROM alpine:${1:3.19}",
-      "insertTextRules": 4,
-      "sortText": "19_base_alpine"
-    },
-    {
-      "label": "FROM node:alpine",
-      "kind": 15,
-      "detail": "Node.js Alpine",
-      "documentation": {
-        "value": "Node.js on Alpine Linux."
-      },
-      "insertText": "FROM node:${1:20}-alpine",
-      "insertTextRules": 4,
-      "sortText": "19_base_node_alpine"
-    },
-    {
-      "label": "FROM node:slim",
-      "kind": 15,
-      "detail": "Node.js Slim",
-      "documentation": {
-        "value": "Node.js on Debian slim."
-      },
-      "insertText": "FROM node:${1:20}-slim",
-      "insertTextRules": 4,
-      "sortText": "19_base_node_slim"
-    },
-    {
-      "label": "FROM python:slim",
-      "kind": 15,
-      "detail": "Python Slim",
-      "documentation": {
-        "value": "Python on Debian slim."
-      },
-      "insertText": "FROM python:${1:3.12}-slim",
-      "insertTextRules": 4,
-      "sortText": "19_base_python_slim"
-    },
-    {
-      "label": "FROM python:alpine",
-      "kind": 15,
-      "detail": "Python Alpine",
-      "documentation": {
-        "value": "Python on Alpine Linux."
-      },
-      "insertText": "FROM python:${1:3.12}-alpine",
-      "insertTextRules": 4,
-      "sortText": "19_base_python_alpine"
-    },
-    {
-      "label": "FROM golang:alpine",
-      "kind": 15,
-      "detail": "Go Alpine",
-      "documentation": {
-        "value": "Go on Alpine Linux."
-      },
-      "insertText": "FROM golang:${1:1.22}-alpine",
-      "insertTextRules": 4,
-      "sortText": "19_base_golang_alpine"
-    },
-    {
-      "label": "FROM ubuntu",
-      "kind": 15,
-      "detail": "Ubuntu",
-      "documentation": {
-        "value": "Ubuntu base image."
-      },
-      "insertText": "FROM ubuntu:${1:24.04}",
-      "insertTextRules": 4,
-      "sortText": "19_base_ubuntu"
-    },
-    {
-      "label": "FROM debian:slim",
-      "kind": 15,
-      "detail": "Debian Slim",
-      "documentation": {
-        "value": "Minimal Debian base image."
-      },
-      "insertText": "FROM debian:${1:bookworm}-slim",
-      "insertTextRules": 4,
-      "sortText": "19_base_debian_slim"
-    },
-    {
-      "label": "FROM nginx:alpine",
-      "kind": 15,
-      "detail": "Nginx Alpine",
-      "documentation": {
-        "value": "Nginx on Alpine Linux."
-      },
-      "insertText": "FROM nginx:${1:alpine}",
-      "insertTextRules": 4,
-      "sortText": "19_base_nginx_alpine"
-    },
-    {
-      "label": "FROM distroless",
-      "kind": 15,
-      "detail": "Distroless static",
-      "documentation": {
-        "value": "Google distroless static image (no shell)."
-      },
-      "insertText": "FROM gcr.io/distroless/static-debian12",
-      "insertTextRules": 4,
-      "sortText": "19_base_distroless"
-    },
-    {
-      "label": "FROM scratch",
-      "kind": 15,
-      "detail": "Scratch (empty)",
-      "documentation": {
-        "value": "Empty base image for static binaries."
-      },
-      "insertText": "FROM scratch",
-      "insertTextRules": 4,
-      "sortText": "19_base_scratch"
-    },
-    {
-      "label": "COPY --parents",
-      "kind": 15,
-      "detail": "Copy preserving directory structure",
-      "documentation": {
-        "value": "Copy files preserving parent directory structure (BuildKit).\n\n```dockerfile\nCOPY --parents src/app/config.json /app/\n# Creates /app/src/app/config.json\n```"
-      },
-      "insertText": "COPY --parents ${1:src/dir/} ${2:/dest/}",
-      "insertTextRules": 4,
-      "sortText": "02_copy_parents"
-    },
-    {
-      "label": "ADD --keep-git-dir",
-      "kind": 15,
-      "detail": "Add Git repo keeping .git",
-      "documentation": {
-        "value": "Clone and keep the .git directory (BuildKit).\n\n```dockerfile\nADD --keep-git-dir=true https://github.com/user/repo.git /src\n```"
-      },
-      "insertText": "ADD --keep-git-dir=true ${1:https://github.com/user/repo.git} ${2:/src}",
-      "insertTextRules": 4,
-      "sortText": "02_add_gitdir"
-    },
-    {
-      "label": ".dockerignore pattern",
-      "kind": 15,
-      "detail": ".dockerignore best practice",
-      "documentation": {
-        "value": "Recommended .dockerignore contents to reduce build context.\n\n```\n# .dockerignore\nnode_modules\n.git\n.env\n*.md\nDockerfile*\ndocker-compose*\n.dockerignore\n.vscode\n__pycache__\n*.pyc\n.tox\n.coverage\ndist\nbuild\n```"
-      },
-      "insertText": "# .dockerignore\nnode_modules\n.git\n.env\n*.md\nDockerfile*\ndocker-compose*\n.dockerignore\n${1:.vscode}",
-      "insertTextRules": 4,
-      "sortText": "09_dockerignore"
-    },
-    {
-      "label": "COPY heredoc",
-      "kind": 15,
-      "detail": "Inline file creation with heredoc",
-      "documentation": {
-        "value": "Create files inline using heredoc syntax (BuildKit).\n\n```dockerfile\nCOPY <<EOF /app/config.json\n{\"key\": \"value\"}\nEOF\n```"
-      },
-      "insertText": "COPY <<EOF ${1:/app/config.json}\n${2:content}\nEOF",
-      "insertTextRules": 4,
-      "sortText": "02_copy_heredoc"
-    },
-    {
-      "label": "RUN pipe pattern",
-      "kind": 15,
-      "detail": "RUN with pipe and set -o pipefail",
-      "documentation": {
-        "value": "Use pipefail for reliable pipe error detection.\n\n```dockerfile\nRUN set -o pipefail && curl -fsSL https://example.com/install.sh | bash\n```"
-      },
-      "insertText": "RUN set -o pipefail && ${1:curl -fsSL https://example.com/install.sh} | ${2:bash}",
-      "insertTextRules": 4,
-      "sortText": "01_run_pipe"
-    }
-  ]
-}
+{
+  "language": "dockerfile",
+  "completions": [
+    {
+      "label": "FROM",
+      "kind": 14,
+      "detail": "Base image instruction",
+      "documentation": {
+        "value": "Set the base image for subsequent instructions. Every Dockerfile must start with FROM (except ARG before FROM)."
+      },
+      "insertText": "FROM",
+      "sortText": "00_from",
+      "insertTextRules": 0
+    },
+    {
+      "label": "RUN",
+      "kind": 14,
+      "detail": "Execute command",
+      "documentation": {
+        "value": "Execute a command in a new layer on top of the current image and commit the result."
+      },
+      "insertText": "RUN",
+      "sortText": "00_run",
+      "insertTextRules": 0
+    },
+    {
+      "label": "CMD",
+      "kind": 14,
+      "detail": "Default command",
+      "documentation": {
+        "value": "Provide defaults for an executing container. Only one CMD per Dockerfile; the last one wins."
+      },
+      "insertText": "CMD",
+      "sortText": "00_cmd",
+      "insertTextRules": 0
+    },
+    {
+      "label": "LABEL",
+      "kind": 14,
+      "detail": "Metadata label",
+      "documentation": {
+        "value": "Add metadata key-value pairs to the image."
+      },
+      "insertText": "LABEL",
+      "sortText": "00_label",
+      "insertTextRules": 0
+    },
+    {
+      "label": "MAINTAINER",
+      "kind": 14,
+      "detail": "Author (deprecated)",
+      "documentation": {
+        "value": "Set the Author field of the generated image. Deprecated in favor of LABEL."
+      },
+      "insertText": "MAINTAINER",
+      "sortText": "00_maintainer",
+      "insertTextRules": 0
+    },
+    {
+      "label": "EXPOSE",
+      "kind": 14,
+      "detail": "Expose port",
+      "documentation": {
+        "value": "Inform Docker that the container listens on the specified network ports at runtime."
+      },
+      "insertText": "EXPOSE",
+      "sortText": "00_expose",
+      "insertTextRules": 0
+    },
+    {
+      "label": "ENV",
+      "kind": 14,
+      "detail": "Environment variable",
+      "documentation": {
+        "value": "Set an environment variable that persists in the built image and running containers."
+      },
+      "insertText": "ENV",
+      "sortText": "00_env",
+      "insertTextRules": 0
+    },
+    {
+      "label": "ADD",
+      "kind": 14,
+      "detail": "Add files",
+      "documentation": {
+        "value": "Copy files, directories, or remote URLs into the image filesystem. Automatically extracts tar archives."
+      },
+      "insertText": "ADD",
+      "sortText": "00_add",
+      "insertTextRules": 0
+    },
+    {
+      "label": "COPY",
+      "kind": 14,
+      "detail": "Copy files",
+      "documentation": {
+        "value": "Copy files or directories from the build context into the image filesystem."
+      },
+      "insertText": "COPY",
+      "sortText": "00_copy",
+      "insertTextRules": 0
+    },
+    {
+      "label": "ENTRYPOINT",
+      "kind": 14,
+      "detail": "Container entrypoint",
+      "documentation": {
+        "value": "Configure a container that will run as an executable."
+      },
+      "insertText": "ENTRYPOINT",
+      "sortText": "00_entrypoint",
+      "insertTextRules": 0
+    },
+    {
+      "label": "VOLUME",
+      "kind": 14,
+      "detail": "Create mount point",
+      "documentation": {
+        "value": "Create a mount point with the specified name and mark it as holding externally mounted volumes."
+      },
+      "insertText": "VOLUME",
+      "sortText": "00_volume",
+      "insertTextRules": 0
+    },
+    {
+      "label": "USER",
+      "kind": 14,
+      "detail": "Set user",
+      "documentation": {
+        "value": "Set the user name or UID (and optionally group) to use for RUN, CMD, and ENTRYPOINT instructions."
+      },
+      "insertText": "USER",
+      "sortText": "00_user",
+      "insertTextRules": 0
+    },
+    {
+      "label": "WORKDIR",
+      "kind": 14,
+      "detail": "Set working directory",
+      "documentation": {
+        "value": "Set the working directory for RUN, CMD, ENTRYPOINT, COPY, and ADD instructions."
+      },
+      "insertText": "WORKDIR",
+      "sortText": "00_workdir",
+      "insertTextRules": 0
+    },
+    {
+      "label": "ARG",
+      "kind": 14,
+      "detail": "Build argument",
+      "documentation": {
+        "value": "Define a build-time variable that users can pass with --build-arg."
+      },
+      "insertText": "ARG",
+      "sortText": "00_arg",
+      "insertTextRules": 0
+    },
+    {
+      "label": "ONBUILD",
+      "kind": 14,
+      "detail": "Deferred instruction",
+      "documentation": {
+        "value": "Add a trigger instruction that executes when the image is used as a base for another build."
+      },
+      "insertText": "ONBUILD",
+      "sortText": "00_onbuild",
+      "insertTextRules": 0
+    },
+    {
+      "label": "STOPSIGNAL",
+      "kind": 14,
+      "detail": "Stop signal",
+      "documentation": {
+        "value": "Set the system call signal that will be sent to the container to exit."
+      },
+      "insertText": "STOPSIGNAL",
+      "sortText": "00_stopsignal",
+      "insertTextRules": 0
+    },
+    {
+      "label": "HEALTHCHECK",
+      "kind": 14,
+      "detail": "Health check",
+      "documentation": {
+        "value": "Tell Docker how to test a container to check that it is still working."
+      },
+      "insertText": "HEALTHCHECK",
+      "sortText": "00_healthcheck",
+      "insertTextRules": 0
+    },
+    {
+      "label": "SHELL",
+      "kind": 14,
+      "detail": "Default shell",
+      "documentation": {
+        "value": "Override the default shell used for the shell form of commands."
+      },
+      "insertText": "SHELL",
+      "sortText": "00_shell",
+      "insertTextRules": 0
+    },
+    {
+      "label": "FROM image",
+      "kind": 15,
+      "detail": "FROM with image",
+      "documentation": {
+        "value": "Basic FROM with image name."
+      },
+      "insertText": "FROM ${1:image}",
+      "insertTextRules": 4,
+      "sortText": "01_from_basic"
+    },
+    {
+      "label": "FROM image:tag",
+      "kind": 15,
+      "detail": "FROM with tag",
+      "documentation": {
+        "value": "FROM with explicit image tag."
+      },
+      "insertText": "FROM ${1:image}:${2:tag}",
+      "insertTextRules": 4,
+      "sortText": "01_from_tag"
+    },
+    {
+      "label": "FROM image AS stage",
+      "kind": 15,
+      "detail": "FROM multi-stage",
+      "documentation": {
+        "value": "FROM with AS alias for multi-stage builds."
+      },
+      "insertText": "FROM ${1:image}:${2:tag} AS ${3:builder}",
+      "insertTextRules": 4,
+      "sortText": "01_from_as"
+    },
+    {
+      "label": "FROM --platform",
+      "kind": 15,
+      "detail": "FROM with platform",
+      "documentation": {
+        "value": "FROM with explicit platform for cross-compilation."
+      },
+      "insertText": "FROM --platform=${1|linux/amd64,linux/arm64,linux/arm/v7,\\$BUILDPLATFORM,\\$TARGETPLATFORM|} ${2:image}:${3:tag}",
+      "insertTextRules": 4,
+      "sortText": "01_from_platform"
+    },
+    {
+      "label": "FROM --platform AS",
+      "kind": 15,
+      "detail": "FROM platform + stage",
+      "documentation": {
+        "value": "FROM with platform and stage alias."
+      },
+      "insertText": "FROM --platform=${1|linux/amd64,linux/arm64,\\$BUILDPLATFORM,\\$TARGETPLATFORM|} ${2:image}:${3:tag} AS ${4:stage}",
+      "insertTextRules": 4,
+      "sortText": "01_from_platform_as"
+    },
+    {
+      "label": "FROM scratch",
+      "kind": 15,
+      "detail": "FROM scratch (empty)",
+      "documentation": {
+        "value": "Start from an empty image, used for statically linked binaries."
+      },
+      "insertText": "FROM scratch",
+      "insertTextRules": 4,
+      "sortText": "01_from_scratch"
+    },
+    {
+      "label": "RUN shell",
+      "kind": 15,
+      "detail": "RUN shell form",
+      "documentation": {
+        "value": "Execute command in shell form (/bin/sh -c)."
+      },
+      "insertText": "RUN ${1:command}",
+      "insertTextRules": 4,
+      "sortText": "02_run_shell"
+    },
+    {
+      "label": "RUN exec",
+      "kind": 15,
+      "detail": "RUN exec form",
+      "documentation": {
+        "value": "Execute command in exec form (no shell processing)."
+      },
+      "insertText": "RUN [\"${1:executable}\", \"${2:arg1}\", \"${3:arg2}\"]",
+      "insertTextRules": 4,
+      "sortText": "02_run_exec"
+    },
+    {
+      "label": "RUN --mount=cache",
+      "kind": 15,
+      "detail": "RUN with cache mount",
+      "documentation": {
+        "value": "Mount a persistent cache directory for package managers."
+      },
+      "insertText": "RUN --mount=type=cache,target=${1:/var/cache/apt} \\\n    ${2:apt-get update && apt-get install -y package}",
+      "insertTextRules": 4,
+      "sortText": "02_run_mount_cache"
+    },
+    {
+      "label": "RUN --mount=bind",
+      "kind": 15,
+      "detail": "RUN with bind mount",
+      "documentation": {
+        "value": "Bind mount a directory from the build context."
+      },
+      "insertText": "RUN --mount=type=bind,source=${1:src},target=${2:/app/src} \\\n    ${3:command}",
+      "insertTextRules": 4,
+      "sortText": "02_run_mount_bind"
+    },
+    {
+      "label": "RUN --mount=secret",
+      "kind": 15,
+      "detail": "RUN with secret mount",
+      "documentation": {
+        "value": "Mount a secret file without persisting in the image layer."
+      },
+      "insertText": "RUN --mount=type=secret,id=${1:mysecret},target=${2:/run/secrets/mysecret} \\\n    ${3:cat /run/secrets/mysecret}",
+      "insertTextRules": 4,
+      "sortText": "02_run_mount_secret"
+    },
+    {
+      "label": "RUN --mount=ssh",
+      "kind": 15,
+      "detail": "RUN with SSH mount",
+      "documentation": {
+        "value": "Forward SSH agent for private repo access during build."
+      },
+      "insertText": "RUN --mount=type=ssh \\\n    ${1:git clone git@github.com:user/repo.git}",
+      "insertTextRules": 4,
+      "sortText": "02_run_mount_ssh"
+    },
+    {
+      "label": "RUN --mount=tmpfs",
+      "kind": 15,
+      "detail": "RUN with tmpfs mount",
+      "documentation": {
+        "value": "Mount a tmpfs for temporary scratch space."
+      },
+      "insertText": "RUN --mount=type=tmpfs,target=${1:/tmp} \\\n    ${2:command}",
+      "insertTextRules": 4,
+      "sortText": "02_run_mount_tmpfs"
+    },
+    {
+      "label": "RUN heredoc",
+      "kind": 15,
+      "detail": "RUN with heredoc",
+      "documentation": {
+        "value": "Run multi-line script using heredoc syntax (BuildKit)."
+      },
+      "insertText": "RUN <<EOF\n${1:#!/bin/bash\nset -e\necho \"hello\"}\nEOF",
+      "insertTextRules": 4,
+      "sortText": "02_run_heredoc"
+    },
+    {
+      "label": "RUN apt-get install",
+      "kind": 15,
+      "detail": "RUN apt-get best practice",
+      "documentation": {
+        "value": "Best practice apt-get install: update + install + clean in one layer."
+      },
+      "insertText": "RUN apt-get update && apt-get install -y --no-install-recommends \\\n    ${1:package1} \\\n    ${2:package2} \\\n    && rm -rf /var/lib/apt/lists/*",
+      "insertTextRules": 4,
+      "sortText": "02_run_apt"
+    },
+    {
+      "label": "RUN pip install",
+      "kind": 15,
+      "detail": "RUN pip install",
+      "documentation": {
+        "value": "Install Python packages with no cache for smaller images."
+      },
+      "insertText": "RUN pip install --no-cache-dir ${1:-r requirements.txt}",
+      "insertTextRules": 4,
+      "sortText": "02_run_pip"
+    },
+    {
+      "label": "RUN npm ci",
+      "kind": 15,
+      "detail": "RUN npm ci",
+      "documentation": {
+        "value": "Install Node.js dependencies for reproducible builds."
+      },
+      "insertText": "RUN npm ci --only=production",
+      "insertTextRules": 4,
+      "sortText": "02_run_npm_ci"
+    },
+    {
+      "label": "RUN apk add",
+      "kind": 15,
+      "detail": "RUN apk add (Alpine)",
+      "documentation": {
+        "value": "Install packages on Alpine Linux."
+      },
+      "insertText": "RUN apk add --no-cache \\\n    ${1:package1} \\\n    ${2:package2}",
+      "insertTextRules": 4,
+      "sortText": "02_run_apk"
+    },
+    {
+      "label": "RUN --network=none",
+      "kind": 15,
+      "detail": "RUN without network",
+      "documentation": {
+        "value": "Run command with network disabled for security."
+      },
+      "insertText": "RUN --network=none ${1:command}",
+      "insertTextRules": 4,
+      "sortText": "02_run_network_none"
+    },
+    {
+      "label": "RUN --security=insecure",
+      "kind": 15,
+      "detail": "RUN insecure (privileged)",
+      "documentation": {
+        "value": "Run with elevated privileges (requires security.insecure entitlement)."
+      },
+      "insertText": "RUN --security=insecure ${1:command}",
+      "insertTextRules": 4,
+      "sortText": "02_run_security"
+    },
+    {
+      "label": "RUN useradd",
+      "kind": 15,
+      "detail": "RUN create user",
+      "documentation": {
+        "value": "Create a non-root user for running the application."
+      },
+      "insertText": "RUN groupadd -r ${1:appuser} && useradd -r -g ${1:appuser} -d /home/${1:appuser} -s /sbin/nologin ${1:appuser}",
+      "insertTextRules": 4,
+      "sortText": "02_run_useradd"
+    },
+    {
+      "label": "RUN adduser Alpine",
+      "kind": 15,
+      "detail": "RUN create user (Alpine)",
+      "documentation": {
+        "value": "Create a non-root user on Alpine."
+      },
+      "insertText": "RUN addgroup -S ${1:appuser} && adduser -S ${1:appuser} -G ${1:appuser}",
+      "insertTextRules": 4,
+      "sortText": "02_run_adduser_alpine"
+    },
+    {
+      "label": "CMD exec form",
+      "kind": 15,
+      "detail": "CMD exec form",
+      "documentation": {
+        "value": "Set default command in exec form (preferred)."
+      },
+      "insertText": "CMD [\"${1:executable}\", \"${2:arg1}\"]",
+      "insertTextRules": 4,
+      "sortText": "03_cmd_exec"
+    },
+    {
+      "label": "CMD shell form",
+      "kind": 15,
+      "detail": "CMD shell form",
+      "documentation": {
+        "value": "Set default command in shell form."
+      },
+      "insertText": "CMD ${1:command arg1 arg2}",
+      "insertTextRules": 4,
+      "sortText": "03_cmd_shell"
+    },
+    {
+      "label": "CMD as ENTRYPOINT params",
+      "kind": 15,
+      "detail": "CMD default parameters",
+      "documentation": {
+        "value": "Provide default parameters to ENTRYPOINT."
+      },
+      "insertText": "CMD [\"${1:--help}\"]",
+      "insertTextRules": 4,
+      "sortText": "03_cmd_params"
+    },
+    {
+      "label": "ENTRYPOINT exec form",
+      "kind": 15,
+      "detail": "ENTRYPOINT exec form",
+      "documentation": {
+        "value": "Set entrypoint in exec form (preferred)."
+      },
+      "insertText": "ENTRYPOINT [\"${1:executable}\", \"${2:arg1}\"]",
+      "insertTextRules": 4,
+      "sortText": "04_entrypoint_exec"
+    },
+    {
+      "label": "ENTRYPOINT shell form",
+      "kind": 15,
+      "detail": "ENTRYPOINT shell form",
+      "documentation": {
+        "value": "Set entrypoint in shell form."
+      },
+      "insertText": "ENTRYPOINT ${1:command arg1}",
+      "insertTextRules": 4,
+      "sortText": "04_entrypoint_shell"
+    },
+    {
+      "label": "ENTRYPOINT with tini",
+      "kind": 15,
+      "detail": "ENTRYPOINT with tini",
+      "documentation": {
+        "value": "Use tini as PID 1 for proper signal handling."
+      },
+      "insertText": "ENTRYPOINT [\"tini\", \"--\", \"${1:executable}\"]",
+      "insertTextRules": 4,
+      "sortText": "04_entrypoint_tini"
+    },
+    {
+      "label": "ENTRYPOINT with dumb-init",
+      "kind": 15,
+      "detail": "ENTRYPOINT with dumb-init",
+      "documentation": {
+        "value": "Use dumb-init as PID 1 for signal forwarding."
+      },
+      "insertText": "ENTRYPOINT [\"dumb-init\", \"--\", \"${1:executable}\"]",
+      "insertTextRules": 4,
+      "sortText": "04_entrypoint_dumb_init"
+    },
+    {
+      "label": "COPY basic",
+      "kind": 15,
+      "detail": "COPY files",
+      "documentation": {
+        "value": "Copy files from build context into the image."
+      },
+      "insertText": "COPY ${1:src} ${2:dest}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_basic"
+    },
+    {
+      "label": "COPY --chown",
+      "kind": 15,
+      "detail": "COPY with chown",
+      "documentation": {
+        "value": "Copy files and set ownership."
+      },
+      "insertText": "COPY --chown=${1:user}:${2:group} ${3:src} ${4:dest}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_chown"
+    },
+    {
+      "label": "COPY --chmod",
+      "kind": 15,
+      "detail": "COPY with chmod",
+      "documentation": {
+        "value": "Copy files and set permissions (BuildKit)."
+      },
+      "insertText": "COPY --chmod=${1:755} ${2:src} ${3:dest}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_chmod"
+    },
+    {
+      "label": "COPY --from",
+      "kind": 15,
+      "detail": "COPY from stage",
+      "documentation": {
+        "value": "Copy files from a named build stage (multi-stage)."
+      },
+      "insertText": "COPY --from=${1:builder} ${2:/app/build} ${3:/usr/share/nginx/html}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_from"
+    },
+    {
+      "label": "COPY --link",
+      "kind": 15,
+      "detail": "COPY with link",
+      "documentation": {
+        "value": "Copy files using link mode for better cache efficiency."
+      },
+      "insertText": "COPY --link ${1:src} ${2:dest}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_link"
+    },
+    {
+      "label": "COPY package*.json",
+      "kind": 15,
+      "detail": "COPY package files first",
+      "documentation": {
+        "value": "Copy only package files first for better layer caching."
+      },
+      "insertText": "COPY package*.json ${1:./}\nRUN npm ci\nCOPY ${2:.} ${3:./}",
+      "insertTextRules": 4,
+      "sortText": "05_copy_package_cache"
+    },
+    {
+      "label": "ADD basic",
+      "kind": 15,
+      "detail": "ADD files",
+      "documentation": {
+        "value": "Add files from build context (or URL/tar) into the image."
+      },
+      "insertText": "ADD ${1:src} ${2:dest}",
+      "insertTextRules": 4,
+      "sortText": "06_add_basic"
+    },
+    {
+      "label": "ADD URL",
+      "kind": 15,
+      "detail": "ADD from URL",
+      "documentation": {
+        "value": "Download a file from a URL into the image."
+      },
+      "insertText": "ADD ${1:https://example.com/file.tar.gz} ${2:/tmp/}",
+      "insertTextRules": 4,
+      "sortText": "06_add_url"
+    },
+    {
+      "label": "ADD tar",
+      "kind": 15,
+      "detail": "ADD tar auto-extract",
+      "documentation": {
+        "value": "Add and auto-extract a tar archive."
+      },
+      "insertText": "ADD ${1:archive.tar.gz} ${2:/opt/}",
+      "insertTextRules": 4,
+      "sortText": "06_add_tar"
+    },
+    {
+      "label": "ADD --checksum",
+      "kind": 15,
+      "detail": "ADD with checksum",
+      "documentation": {
+        "value": "Add file with SHA256 checksum verification (BuildKit)."
+      },
+      "insertText": "ADD --checksum=sha256:${1:hash} ${2:https://example.com/file} ${3:/dest}",
+      "insertTextRules": 4,
+      "sortText": "06_add_checksum"
+    },
+    {
+      "label": "ENV single",
+      "kind": 15,
+      "detail": "ENV single variable",
+      "documentation": {
+        "value": "Set a single environment variable."
+      },
+      "insertText": "ENV ${1:KEY}=${2:value}",
+      "insertTextRules": 4,
+      "sortText": "07_env_single"
+    },
+    {
+      "label": "ENV multiple",
+      "kind": 15,
+      "detail": "ENV multiple variables",
+      "documentation": {
+        "value": "Set multiple environment variables."
+      },
+      "insertText": "ENV ${1:KEY1}=${2:value1} \\\n    ${3:KEY2}=${4:value2}",
+      "insertTextRules": 4,
+      "sortText": "07_env_multiple"
+    },
+    {
+      "label": "ENV PATH",
+      "kind": 15,
+      "detail": "ENV prepend PATH",
+      "documentation": {
+        "value": "Prepend a directory to PATH."
+      },
+      "insertText": "ENV PATH=\"${1:/app/bin}:$$PATH\"",
+      "insertTextRules": 4,
+      "sortText": "07_env_path"
+    },
+    {
+      "label": "ENV NODE_ENV",
+      "kind": 15,
+      "detail": "ENV NODE_ENV production",
+      "documentation": {
+        "value": "Set Node.js production environment."
+      },
+      "insertText": "ENV NODE_ENV=production",
+      "insertTextRules": 4,
+      "sortText": "07_env_node"
+    },
+    {
+      "label": "ENV PYTHONDONTWRITEBYTECODE",
+      "kind": 15,
+      "detail": "ENV Python optimizations",
+      "documentation": {
+        "value": "Common Python env vars for Docker."
+      },
+      "insertText": "ENV PYTHONDONTWRITEBYTECODE=1 \\\n    PYTHONUNBUFFERED=1",
+      "insertTextRules": 4,
+      "sortText": "07_env_python"
+    },
+    {
+      "label": "ARG basic",
+      "kind": 15,
+      "detail": "ARG variable",
+      "documentation": {
+        "value": "Define a build-time argument."
+      },
+      "insertText": "ARG ${1:NAME}",
+      "insertTextRules": 4,
+      "sortText": "08_arg_basic"
+    },
+    {
+      "label": "ARG with default",
+      "kind": 15,
+      "detail": "ARG with default value",
+      "documentation": {
+        "value": "Define a build arg with a default value."
+      },
+      "insertText": "ARG ${1:NAME}=${2:default}",
+      "insertTextRules": 4,
+      "sortText": "08_arg_default"
+    },
+    {
+      "label": "ARG before FROM",
+      "kind": 15,
+      "detail": "ARG before FROM",
+      "documentation": {
+        "value": "Define ARG before FROM for use in FROM instruction."
+      },
+      "insertText": "ARG ${1:VERSION}=${2:latest}\nFROM ${3:node}:${1:VERSION}",
+      "insertTextRules": 4,
+      "sortText": "08_arg_before_from"
+    },
+    {
+      "label": "EXPOSE port",
+      "kind": 15,
+      "detail": "EXPOSE single port",
+      "documentation": {
+        "value": "Expose a single port."
+      },
+      "insertText": "EXPOSE ${1:8080}",
+      "insertTextRules": 4,
+      "sortText": "09_expose_single"
+    },
+    {
+      "label": "EXPOSE multiple",
+      "kind": 15,
+      "detail": "EXPOSE multiple ports",
+      "documentation": {
+        "value": "Expose multiple ports."
+      },
+      "insertText": "EXPOSE ${1:80} ${2:443}",
+      "insertTextRules": 4,
+      "sortText": "09_expose_multiple"
+    },
+    {
+      "label": "EXPOSE UDP",
+      "kind": 15,
+      "detail": "EXPOSE UDP port",
+      "documentation": {
+        "value": "Expose a UDP port."
+      },
+      "insertText": "EXPOSE ${1:53}/udp",
+      "insertTextRules": 4,
+      "sortText": "09_expose_udp"
+    },
+    {
+      "label": "VOLUME path",
+      "kind": 15,
+      "detail": "VOLUME mount point",
+      "documentation": {
+        "value": "Create a mount point."
+      },
+      "insertText": "VOLUME ${1:/data}",
+      "insertTextRules": 4,
+      "sortText": "10_volume"
+    },
+    {
+      "label": "VOLUME JSON",
+      "kind": 15,
+      "detail": "VOLUME multiple",
+      "documentation": {
+        "value": "Create multiple mount points."
+      },
+      "insertText": "VOLUME [\"${1:/data}\", \"${2:/logs}\"]",
+      "insertTextRules": 4,
+      "sortText": "10_volume_json"
+    },
+    {
+      "label": "USER name",
+      "kind": 15,
+      "detail": "USER set user",
+      "documentation": {
+        "value": "Switch to a non-root user."
+      },
+      "insertText": "USER ${1:appuser}",
+      "insertTextRules": 4,
+      "sortText": "11_user"
+    },
+    {
+      "label": "USER uid:gid",
+      "kind": 15,
+      "detail": "USER with UID:GID",
+      "documentation": {
+        "value": "Switch to a specific UID:GID."
+      },
+      "insertText": "USER ${1:1001}:${2:1001}",
+      "insertTextRules": 4,
+      "sortText": "11_user_uid"
+    },
+    {
+      "label": "WORKDIR path",
+      "kind": 15,
+      "detail": "WORKDIR set directory",
+      "documentation": {
+        "value": "Set the working directory."
+      },
+      "insertText": "WORKDIR ${1:/app}",
+      "insertTextRules": 4,
+      "sortText": "12_workdir"
+    },
+    {
+      "label": "LABEL single",
+      "kind": 15,
+      "detail": "LABEL single",
+      "documentation": {
+        "value": "Add a single metadata label."
+      },
+      "insertText": "LABEL ${1:key}=\"${2:value}\"",
+      "insertTextRules": 4,
+      "sortText": "13_label_single"
+    },
+    {
+      "label": "LABEL multiple",
+      "kind": 15,
+      "detail": "LABEL multiple",
+      "documentation": {
+        "value": "Add multiple metadata labels."
+      },
+      "insertText": "LABEL ${1:maintainer}=\"${2:name}\" \\\n      ${3:version}=\"${4:1.0}\"",
+      "insertTextRules": 4,
+      "sortText": "13_label_multiple"
+    },
+    {
+      "label": "LABEL OCI",
+      "kind": 15,
+      "detail": "LABEL OCI annotations",
+      "documentation": {
+        "value": "OCI image spec annotation labels."
+      },
+      "insertText": "LABEL org.opencontainers.image.title=\"${1:title}\" \\\n      org.opencontainers.image.description=\"${2:description}\" \\\n      org.opencontainers.image.version=\"${3:1.0.0}\" \\\n      org.opencontainers.image.authors=\"${4:author}\" \\\n      org.opencontainers.image.source=\"${5:https://github.com/user/repo}\" \\\n      org.opencontainers.image.licenses=\"${6:MIT}\"",
+      "insertTextRules": 4,
+      "sortText": "13_label_oci"
+    },
+    {
+      "label": "HEALTHCHECK CMD",
+      "kind": 15,
+      "detail": "HEALTHCHECK CMD",
+      "documentation": {
+        "value": "Health check with HTTP endpoint."
+      },
+      "insertText": "HEALTHCHECK --interval=${1:30s} --timeout=${2:10s} --start-period=${3:5s} --retries=${4:3} \\\n    CMD ${5:curl -f http://localhost:${6:8080}/health || exit 1}",
+      "insertTextRules": 4,
+      "sortText": "14_healthcheck_cmd"
+    },
+    {
+      "label": "HEALTHCHECK wget",
+      "kind": 15,
+      "detail": "HEALTHCHECK with wget",
+      "documentation": {
+        "value": "Health check using wget (for alpine/minimal images)."
+      },
+      "insertText": "HEALTHCHECK --interval=${1:30s} --timeout=${2:10s} --retries=${3:3} \\\n    CMD wget --quiet --tries=1 --spider http://localhost:${4:8080}/health || exit 1",
+      "insertTextRules": 4,
+      "sortText": "14_healthcheck_wget"
+    },
+    {
+      "label": "HEALTHCHECK NONE",
+      "kind": 15,
+      "detail": "HEALTHCHECK NONE",
+      "documentation": {
+        "value": "Disable health check inherited from base image."
+      },
+      "insertText": "HEALTHCHECK NONE",
+      "insertTextRules": 4,
+      "sortText": "14_healthcheck_none"
+    },
+    {
+      "label": "SHELL bash",
+      "kind": 15,
+      "detail": "SHELL set to bash",
+      "documentation": {
+        "value": "Set default shell to bash."
+      },
+      "insertText": "SHELL [\"/bin/bash\", \"-c\"]",
+      "insertTextRules": 4,
+      "sortText": "15_shell_bash"
+    },
+    {
+      "label": "SHELL powershell",
+      "kind": 15,
+      "detail": "SHELL set to PowerShell",
+      "documentation": {
+        "value": "Set default shell to PowerShell (Windows)."
+      },
+      "insertText": "SHELL [\"powershell\", \"-Command\"]",
+      "insertTextRules": 4,
+      "sortText": "15_shell_powershell"
+    },
+    {
+      "label": "# syntax=",
+      "kind": 15,
+      "detail": "syntax parser directive",
+      "documentation": {
+        "value": "Set BuildKit frontend syntax (must be first line)."
+      },
+      "insertText": "# syntax=docker/dockerfile:${1|1,1.4,1.5,1.6,1.7,labs|}",
+      "insertTextRules": 4,
+      "sortText": "00_syntax"
+    },
+    {
+      "label": "# escape=",
+      "kind": 15,
+      "detail": "escape parser directive",
+      "documentation": {
+        "value": "Change the escape character (must be before any instruction)."
+      },
+      "insertText": "# escape=${1|\\\\,`|}",
+      "insertTextRules": 4,
+      "sortText": "00_escape"
+    },
+    {
+      "label": "Dockerfile: Node.js multi-stage",
+      "kind": 15,
+      "detail": "Node.js multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Node.js application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM node:${1:20}-alpine AS deps\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci --only=production\n\nFROM node:${1:20}-alpine AS builder\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n\nFROM node:${1:20}-alpine\nWORKDIR /app\nENV NODE_ENV=production\nRUN addgroup -S appuser && adduser -S appuser -G appuser\nCOPY --from=deps /app/node_modules ./node_modules\nCOPY --from=builder /app/dist ./dist\nCOPY package*.json ./\nUSER appuser\nEXPOSE ${2:3000}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD wget --quiet --tries=1 --spider http://localhost:${2:3000}/health || exit 1\nCMD [\"node\", \"dist/index.js\"]",
+      "insertTextRules": 4,
+      "sortText": "20_tmpl_node"
+    },
+    {
+      "label": "Dockerfile: Python multi-stage",
+      "kind": 15,
+      "detail": "Python multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Python application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM python:${1:3.12}-slim AS builder\nWORKDIR /app\nENV PYTHONDONTWRITEBYTECODE=1 \\\n    PYTHONUNBUFFERED=1\nCOPY requirements.txt .\nRUN pip install --no-cache-dir --prefix=/install -r requirements.txt\n\nFROM python:${1:3.12}-slim\nWORKDIR /app\nENV PYTHONDONTWRITEBYTECODE=1 \\\n    PYTHONUNBUFFERED=1\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nCOPY --from=builder /install /usr/local\nCOPY . .\nUSER appuser\nEXPOSE ${2:8000}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD python -c \"import urllib.request; urllib.request.urlopen('http://localhost:${2:8000}/health')\" || exit 1\nCMD [\"python\", \"-m\", \"${3:app}\"]",
+      "insertTextRules": 4,
+      "sortText": "20_tmpl_python"
+    },
+    {
+      "label": "Dockerfile: Go multi-stage",
+      "kind": 15,
+      "detail": "Go multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Go application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM golang:${1:1.22}-alpine AS builder\nWORKDIR /app\nCOPY go.mod go.sum ./\nRUN go mod download\nCOPY . .\nRUN CGO_ENABLED=0 GOOS=linux go build -ldflags=\"-s -w\" -o /app/server ./cmd/${2:server}\n\nFROM gcr.io/distroless/static-debian12\nCOPY --from=builder /app/server /server\nEXPOSE ${3:8080}\nUSER nonroot:nonroot\nENTRYPOINT [\"/server\"]",
+      "insertTextRules": 4,
+      "sortText": "20_tmpl_go"
+    },
+    {
+      "label": "Dockerfile: Java Maven multi-stage",
+      "kind": 15,
+      "detail": "Java/Maven multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Java application built with Maven."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM maven:${1:3.9}-eclipse-temurin-${2:21} AS builder\nWORKDIR /app\nCOPY pom.xml .\nRUN mvn dependency:go-offline -B\nCOPY src ./src\nRUN mvn package -DskipTests -B\n\nFROM eclipse-temurin:${2:21}-jre-alpine\nWORKDIR /app\nRUN addgroup -S appuser && adduser -S appuser -G appuser\nCOPY --from=builder /app/target/*.jar app.jar\nUSER appuser\nEXPOSE ${3:8080}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD wget --quiet --tries=1 --spider http://localhost:${3:8080}/actuator/health || exit 1\nENTRYPOINT [\"java\", \"-jar\", \"app.jar\"]",
+      "insertTextRules": 4,
+      "sortText": "20_tmpl_java"
+    },
+    {
+      "label": "Dockerfile: Rust multi-stage",
+      "kind": 15,
+      "detail": "Rust multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a Rust application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM rust:${1:1.77}-slim AS builder\nWORKDIR /app\nCOPY Cargo.toml Cargo.lock ./\nRUN mkdir src && echo \"fn main() {}\" > src/main.rs && cargo build --release && rm -rf src\nCOPY src ./src\nRUN cargo build --release\n\nFROM debian:${2:bookworm}-slim\nRUN apt-get update && apt-get install -y --no-install-recommends ca-certificates \\\n    && rm -rf /var/lib/apt/lists/*\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nCOPY --from=builder /app/target/release/${3:myapp} /usr/local/bin/\nUSER appuser\nEXPOSE ${4:8080}\nENTRYPOINT [\"${3:myapp}\"]",
+      "insertTextRules": 4,
+      "sortText": "20_tmpl_rust"
+    },
+    {
+      "label": "Dockerfile: .NET multi-stage",
+      "kind": 15,
+      "detail": ".NET multi-stage Dockerfile",
+      "documentation": {
+        "value": "Production-ready multi-stage Dockerfile for a .NET application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM mcr.microsoft.com/dotnet/sdk:${1:8.0} AS builder\nWORKDIR /app\nCOPY *.csproj .\nRUN dotnet restore\nCOPY . .\nRUN dotnet publish -c Release -o /out --no-restore\n\nFROM mcr.microsoft.com/dotnet/aspnet:${1:8.0}\nWORKDIR /app\nRUN groupadd -r appuser && useradd -r -g appuser appuser\nCOPY --from=builder /out .\nUSER appuser\nEXPOSE ${2:8080}\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD curl -f http://localhost:${2:8080}/health || exit 1\nENTRYPOINT [\"dotnet\", \"${3:MyApp}.dll\"]",
+      "insertTextRules": 4,
+      "sortText": "20_tmpl_dotnet"
+    },
+    {
+      "label": "Dockerfile: Nginx static site",
+      "kind": 15,
+      "detail": "Nginx static site Dockerfile",
+      "documentation": {
+        "value": "Serve static files with Nginx using a multi-stage build."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM node:${1:20}-alpine AS builder\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci\nCOPY . .\nRUN npm run build\n\nFROM nginx:${2:alpine}\nCOPY --from=builder /app/${3:dist} /usr/share/nginx/html\nCOPY ${4:nginx.conf} /etc/nginx/conf.d/default.conf\nEXPOSE 80\nHEALTHCHECK --interval=30s --timeout=10s --retries=3 \\\n    CMD curl -f http://localhost/ || exit 1\nCMD [\"nginx\", \"-g\", \"daemon off;\"]",
+      "insertTextRules": 4,
+      "sortText": "20_tmpl_nginx"
+    },
+    {
+      "label": "Dockerfile: PHP-FPM",
+      "kind": 15,
+      "detail": "PHP-FPM Dockerfile",
+      "documentation": {
+        "value": "PHP-FPM application Dockerfile with Composer."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM composer:${1:2} AS vendor\nWORKDIR /app\nCOPY composer.json composer.lock ./\nRUN composer install --no-dev --no-scripts --no-autoloader\nCOPY . .\nRUN composer dump-autoload --optimize\n\nFROM php:${2:8.3}-fpm-alpine\nWORKDIR /var/www/html\nRUN docker-php-ext-install pdo pdo_mysql opcache\nCOPY --from=vendor /app .\nRUN chown -R www-data:www-data /var/www/html\nUSER www-data\nEXPOSE 9000\nCMD [\"php-fpm\"]",
+      "insertTextRules": 4,
+      "sortText": "20_tmpl_php"
+    },
+    {
+      "label": "Dockerfile: Ruby/Rails",
+      "kind": 15,
+      "detail": "Ruby/Rails Dockerfile",
+      "documentation": {
+        "value": "Production-ready Dockerfile for a Ruby on Rails application."
+      },
+      "insertText": "# syntax=docker/dockerfile:1\nFROM ruby:${1:3.3}-slim AS builder\nWORKDIR /app\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    build-essential libpq-dev \\\n    && rm -rf /var/lib/apt/lists/*\nCOPY Gemfile Gemfile.lock ./\nRUN bundle config set --local deployment true \\\n    && bundle config set --local without \"development test\" \\\n    && bundle install\n\nFROM ruby:${1:3.3}-slim\nWORKDIR /app\nRUN apt-get update && apt-get install -y --no-install-recommends \\\n    libpq5 \\\n    && rm -rf /var/lib/apt/lists/*\nRUN groupadd -r rails && useradd -r -g rails rails\nCOPY --from=builder /app/vendor/bundle ./vendor/bundle\nCOPY . .\nRUN bundle config set --local path vendor/bundle\nUSER rails\nEXPOSE ${2:3000}\nCMD [\"bundle\", \"exec\", \"rails\", \"server\", \"-b\", \"0.0.0.0\"]",
+      "insertTextRules": 4,
+      "sortText": "20_tmpl_ruby"
+    },
+    {
+      "label": "Non-root user setup",
+      "kind": 15,
+      "detail": "Non-root user pattern",
+      "documentation": {
+        "value": "Best practice: create and switch to a non-root user."
+      },
+      "insertText": "RUN groupadd -r ${1:appuser} && useradd -r -g ${1:appuser} -d /home/${1:appuser} -s /sbin/nologin ${1:appuser} \\\n    && mkdir -p /home/${1:appuser} && chown -R ${1:appuser}:${1:appuser} /home/${1:appuser}\nUSER ${1:appuser}",
+      "insertTextRules": 4,
+      "sortText": "18_bp_nonroot"
+    },
+    {
+      "label": "apt-get best practice",
+      "kind": 15,
+      "detail": "apt-get best practice layer",
+      "documentation": {
+        "value": "Install packages and clean up in a single layer."
+      },
+      "insertText": "RUN apt-get update \\\n    && apt-get install -y --no-install-recommends \\\n        ${1:curl} \\\n        ${2:ca-certificates} \\\n    && apt-get purge -y --auto-remove -o APT::AutoRemove::RecommendsImportant=false \\\n    && rm -rf /var/lib/apt/lists/*",
+      "insertTextRules": 4,
+      "sortText": "18_bp_apt"
+    },
+    {
+      "label": "pip best practice",
+      "kind": 15,
+      "detail": "pip install best practice",
+      "documentation": {
+        "value": "Install Python packages without cache."
+      },
+      "insertText": "COPY requirements.txt .\nRUN pip install --no-cache-dir --upgrade pip \\\n    && pip install --no-cache-dir -r requirements.txt",
+      "insertTextRules": 4,
+      "sortText": "18_bp_pip"
+    },
+    {
+      "label": "npm ci pattern",
+      "kind": 15,
+      "detail": "npm ci production pattern",
+      "documentation": {
+        "value": "Install production Node.js dependencies."
+      },
+      "insertText": "COPY package.json package-lock.json ./\nRUN npm ci --only=production \\\n    && npm cache clean --force",
+      "insertTextRules": 4,
+      "sortText": "18_bp_npm"
+    },
+    {
+      "label": "Multi-stage build pattern",
+      "kind": 15,
+      "detail": "Multi-stage build skeleton",
+      "documentation": {
+        "value": "Basic multi-stage build skeleton."
+      },
+      "insertText": "FROM ${1:node:20-alpine} AS builder\nWORKDIR /app\nCOPY . .\nRUN ${2:npm ci && npm run build}\n\nFROM ${3:node:20-alpine}\nWORKDIR /app\nCOPY --from=builder /app/${4:dist} ./${4:dist}\nEXPOSE ${5:3000}\nCMD ${6:[\"node\", \"dist/index.js\"]}",
+      "insertTextRules": 4,
+      "sortText": "18_bp_multistage"
+    },
+    {
+      "label": "Distroless final stage",
+      "kind": 15,
+      "detail": "Distroless final stage",
+      "documentation": {
+        "value": "Use Google distroless as the final minimal image."
+      },
+      "insertText": "FROM gcr.io/distroless/${1|static-debian12,base-debian12,cc-debian12,java21-debian12,python3-debian12,nodejs22-debian12|}\nCOPY --from=builder ${2:/app/binary} ${3:/}\nUSER nonroot:nonroot\nENTRYPOINT [\"${4:/binary}\"]",
+      "insertTextRules": 4,
+      "sortText": "18_bp_distroless"
+    },
+    {
+      "label": "Signal handling (tini)",
+      "kind": 15,
+      "detail": "Signal handling with tini",
+      "documentation": {
+        "value": "Use tini init for proper PID 1 signal handling."
+      },
+      "insertText": "RUN apt-get update && apt-get install -y --no-install-recommends tini \\\n    && rm -rf /var/lib/apt/lists/*\nENTRYPOINT [\"tini\", \"--\"]\nCMD [\"${1:node}\", \"${2:server.js}\"]",
+      "insertTextRules": 4,
+      "sortText": "18_bp_tini"
+    },
+    {
+      "label": "Build cache optimization",
+      "kind": 15,
+      "detail": "Layer caching order",
+      "documentation": {
+        "value": "Copy dependency files before source for cache optimization."
+      },
+      "insertText": "# Copy dependency manifests first (changes less often)\nCOPY ${1:package.json} ${2:package-lock.json} ./\nRUN ${3:npm ci}\n\n# Copy source code (changes more often)\nCOPY . .\nRUN ${4:npm run build}",
+      "insertTextRules": 4,
+      "sortText": "18_bp_cache_order"
+    },
+    {
+      "label": "FROM alpine",
+      "kind": 15,
+      "detail": "Alpine Linux",
+      "documentation": {
+        "value": "Minimal 5MB Alpine Linux base image."
+      },
+      "insertText": "FROM alpine:${1:3.19}",
+      "insertTextRules": 4,
+      "sortText": "19_base_alpine"
+    },
+    {
+      "label": "FROM node:alpine",
+      "kind": 15,
+      "detail": "Node.js Alpine",
+      "documentation": {
+        "value": "Node.js on Alpine Linux."
+      },
+      "insertText": "FROM node:${1:20}-alpine",
+      "insertTextRules": 4,
+      "sortText": "19_base_node_alpine"
+    },
+    {
+      "label": "FROM node:slim",
+      "kind": 15,
+      "detail": "Node.js Slim",
+      "documentation": {
+        "value": "Node.js on Debian slim."
+      },
+      "insertText": "FROM node:${1:20}-slim",
+      "insertTextRules": 4,
+      "sortText": "19_base_node_slim"
+    },
+    {
+      "label": "FROM python:slim",
+      "kind": 15,
+      "detail": "Python Slim",
+      "documentation": {
+        "value": "Python on Debian slim."
+      },
+      "insertText": "FROM python:${1:3.12}-slim",
+      "insertTextRules": 4,
+      "sortText": "19_base_python_slim"
+    },
+    {
+      "label": "FROM python:alpine",
+      "kind": 15,
+      "detail": "Python Alpine",
+      "documentation": {
+        "value": "Python on Alpine Linux."
+      },
+      "insertText": "FROM python:${1:3.12}-alpine",
+      "insertTextRules": 4,
+      "sortText": "19_base_python_alpine"
+    },
+    {
+      "label": "FROM golang:alpine",
+      "kind": 15,
+      "detail": "Go Alpine",
+      "documentation": {
+        "value": "Go on Alpine Linux."
+      },
+      "insertText": "FROM golang:${1:1.22}-alpine",
+      "insertTextRules": 4,
+      "sortText": "19_base_golang_alpine"
+    },
+    {
+      "label": "FROM ubuntu",
+      "kind": 15,
+      "detail": "Ubuntu",
+      "documentation": {
+        "value": "Ubuntu base image."
+      },
+      "insertText": "FROM ubuntu:${1:24.04}",
+      "insertTextRules": 4,
+      "sortText": "19_base_ubuntu"
+    },
+    {
+      "label": "FROM debian:slim",
+      "kind": 15,
+      "detail": "Debian Slim",
+      "documentation": {
+        "value": "Minimal Debian base image."
+      },
+      "insertText": "FROM debian:${1:bookworm}-slim",
+      "insertTextRules": 4,
+      "sortText": "19_base_debian_slim"
+    },
+    {
+      "label": "FROM nginx:alpine",
+      "kind": 15,
+      "detail": "Nginx Alpine",
+      "documentation": {
+        "value": "Nginx on Alpine Linux."
+      },
+      "insertText": "FROM nginx:${1:alpine}",
+      "insertTextRules": 4,
+      "sortText": "19_base_nginx_alpine"
+    },
+    {
+      "label": "FROM distroless",
+      "kind": 15,
+      "detail": "Distroless static",
+      "documentation": {
+        "value": "Google distroless static image (no shell)."
+      },
+      "insertText": "FROM gcr.io/distroless/static-debian12",
+      "insertTextRules": 4,
+      "sortText": "19_base_distroless"
+    },
+    {
+      "label": "COPY --parents",
+      "kind": 15,
+      "detail": "Copy preserving directory structure",
+      "documentation": {
+        "value": "Copy files preserving parent directory structure (BuildKit).\n\n```dockerfile\nCOPY --parents src/app/config.json /app/\n# Creates /app/src/app/config.json\n```"
+      },
+      "insertText": "COPY --parents ${1:src/dir/} ${2:/dest/}",
+      "insertTextRules": 4,
+      "sortText": "02_copy_parents"
+    },
+    {
+      "label": "ADD --keep-git-dir",
+      "kind": 15,
+      "detail": "Add Git repo keeping .git",
+      "documentation": {
+        "value": "Clone and keep the .git directory (BuildKit).\n\n```dockerfile\nADD --keep-git-dir=true https://github.com/user/repo.git /src\n```"
+      },
+      "insertText": "ADD --keep-git-dir=true ${1:https://github.com/user/repo.git} ${2:/src}",
+      "insertTextRules": 4,
+      "sortText": "02_add_gitdir"
+    },
+    {
+      "label": ".dockerignore pattern",
+      "kind": 15,
+      "detail": ".dockerignore best practice",
+      "documentation": {
+        "value": "Recommended .dockerignore contents to reduce build context.\n\n```\n# .dockerignore\nnode_modules\n.git\n.env\n*.md\nDockerfile*\ndocker-compose*\n.dockerignore\n.vscode\n__pycache__\n*.pyc\n.tox\n.coverage\ndist\nbuild\n```"
+      },
+      "insertText": "# .dockerignore\nnode_modules\n.git\n.env\n*.md\nDockerfile*\ndocker-compose*\n.dockerignore\n${1:.vscode}",
+      "insertTextRules": 4,
+      "sortText": "09_dockerignore"
+    },
+    {
+      "label": "COPY heredoc",
+      "kind": 15,
+      "detail": "Inline file creation with heredoc",
+      "documentation": {
+        "value": "Create files inline using heredoc syntax (BuildKit).\n\n```dockerfile\nCOPY <<EOF /app/config.json\n{\"key\": \"value\"}\nEOF\n```"
+      },
+      "insertText": "COPY <<EOF ${1:/app/config.json}\n${2:content}\nEOF",
+      "insertTextRules": 4,
+      "sortText": "02_copy_heredoc"
+    },
+    {
+      "label": "RUN pipe pattern",
+      "kind": 15,
+      "detail": "RUN with pipe and set -o pipefail",
+      "documentation": {
+        "value": "Use pipefail for reliable pipe error detection.\n\n```dockerfile\nRUN set -o pipefail && curl -fsSL https://example.com/install.sh | bash\n```"
+      },
+      "insertText": "RUN set -o pipefail && ${1:curl -fsSL https://example.com/install.sh} | ${2:bash}",
+      "insertTextRules": 4,
+      "sortText": "01_run_pipe"
+    }
+  ]
+}