@nockdev/awf 6.2.0

package/.agent/skills/cross-cutting/docker/data/build.yaml

@@ -0,0 +1,197 @@
+# =============================================================================
+# Docker Build Patterns (Feb 2026)
+# =============================================================================
+# Multi-stage, BuildKit, Bake, Build Cloud
+
+metadata:
+  skill: docker
+  domain: build
+  version: "2026.1"
+  updated: "2026-02-05"
+  patterns_count: 5
+
+patterns:
+  - id: docker001
+    name: Multi-Stage Build
+    category: build
+    version: "17.05+"
+    description: Minimize image size with multi-stage builds
+    text: multi-stage build slim minimize image size layers
+    example: |
+      # Multi-stage Dockerfile for Go
+      FROM golang:1.22 AS builder
+      WORKDIR /app
+      COPY go.* ./
+      RUN go mod download
+      COPY . .
+      RUN CGO_ENABLED=0 go build -o /app/server
+
+      # Final stage - minimal image
+      FROM gcr.io/distroless/static-debian12:nonroot
+      COPY --from=builder /app/server /server
+      USER nonroot
+      ENTRYPOINT ["/server"]
+
+      # Node.js example
+      FROM node:22 AS builder
+      WORKDIR /app
+      COPY package*.json ./
+      RUN npm ci
+      COPY . .
+      RUN npm run build
+
+      FROM node:22-slim
+      WORKDIR /app
+      COPY --from=builder /app/dist ./dist
+      COPY --from=builder /app/node_modules ./node_modules
+      CMD ["node", "dist/index.js"]
+
+      # Result: ~50-100MB images instead of ~1GB
+    severity: CRITICAL
+    docs_url: https://docs.docker.com/build/building/multi-stage/
+
+  - id: docker002
+    name: Docker Build Cloud
+    category: build
+    version: "2024+"
+    description: Cloud-based builders for faster CI/CD builds
+    text: docker build cloud ci cd fast remote builder
+    example: |
+      # Enable Build Cloud in Docker Desktop or CI
+      docker buildx create --use --driver cloud myorg/mybuilder
+
+      # Build with cloud builders
+      docker buildx build \
+        --builder cloud-myorg-mybuilder \
+        --platform linux/amd64,linux/arm64 \
+        --push \
+        -t myregistry/myapp:latest .
+
+      # GitHub Actions
+      - uses: docker/setup-buildx-action@v3
+        with:
+          driver: cloud
+          endpoint: myorg/mybuilder
+
+      # Benefits:
+      # - 10-40x faster builds (shared cache)
+      # - Multi-arch builds without QEMU
+      # - 400+ GB persistent cache per builder
+    severity: HIGH
+    docs_url: https://docs.docker.com/build/cloud/
+
+  - id: docker003
+    name: Docker Bake
+    category: build
+    version: "2022+"
+    description: Build multiple images with single command using HCL
+    text: docker bake buildx hcl targets multi-image build
+    example: |
+      # docker-bake.hcl
+      group "default" {
+        targets = ["api", "frontend", "worker"]
+      }
+
+      target "base" {
+        dockerfile = "Dockerfile.base"
+        context = "."
+        tags = ["myregistry/base:latest"]
+      }
+
+      target "api" {
+        inherits = ["base"]
+        dockerfile = "apps/api/Dockerfile"
+        tags = ["myregistry/api:latest"]
+        platforms = ["linux/amd64", "linux/arm64"]
+      }
+
+      target "frontend" {
+        inherits = ["base"]
+        dockerfile = "apps/frontend/Dockerfile"
+        tags = ["myregistry/frontend:latest"]
+        args = {
+          NODE_ENV = "production"
+        }
+      }
+
+      target "worker" {
+        dockerfile = "apps/worker/Dockerfile"
+        tags = ["myregistry/worker:latest"]
+        cache-from = ["type=registry,ref=myregistry/worker:cache"]
+        cache-to = ["type=registry,ref=myregistry/worker:cache,mode=max"]
+      }
+
+      # Build all: docker buildx bake
+      # Build one: docker buildx bake api
+    severity: HIGH
+    docs_url: https://docs.docker.com/build/bake/
+
+  - id: docker004
+    name: BuildKit Cache Mounts
+    category: build
+    version: "18.09+"
+    description: Persistent caches for package managers (npm, pip, go)
+    text: buildkit cache mount persistent npm pip go mod cache
+    example: |
+      # syntax=docker/dockerfile:1
+
+      FROM node:22
+      WORKDIR /app
+      COPY package*.json ./
+
+      # Cache npm packages across builds
+      RUN --mount=type=cache,target=/root/.npm \
+          npm ci
+
+      # Go modules cache
+      FROM golang:1.22
+      WORKDIR /app
+      COPY go.* ./
+      RUN --mount=type=cache,target=/go/pkg/mod \
+          --mount=type=cache,target=/root/.cache/go-build \
+          go mod download
+
+      # Python pip cache
+      FROM python:3.12
+      WORKDIR /app
+      COPY requirements.txt .
+      RUN --mount=type=cache,target=/root/.cache/pip \
+          pip install -r requirements.txt
+
+      # Enable BuildKit:
+      # export DOCKER_BUILDKIT=1
+    severity: HIGH
+    docs_url: https://docs.docker.com/build/cache/
+
+  - id: docker005
+    name: BuildKit Secrets
+    category: build
+    version: "18.09+"
+    description: Securely pass secrets during build (not in image layers)
+    text: buildkit secrets build time credentials ssh private key
+    example: |
+      # syntax=docker/dockerfile:1
+
+      FROM node:22
+      WORKDIR /app
+
+      # Use SSH for private repos
+      RUN --mount=type=ssh \
+          git clone git@github.com:myorg/private-repo.git
+
+      # Use secret file (not stored in layer)
+      RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
+          npm ci
+
+      # Build commands:
+      docker buildx build \
+        --ssh default \
+        --secret id=npmrc,src=.npmrc \
+        -t myapp .
+
+      # Important:
+      # - Secrets NOT stored in image layers
+      # - Cannot be extracted from final image
+      # - Must be provided at build time
+    severity: CRITICAL
+    docs_url: https://docs.docker.com/build/building/secrets/

package/.agent/skills/cross-cutting/docker/data/compose.yaml

@@ -0,0 +1,229 @@
+# =============================================================================
+# Docker Compose v5 Patterns (Feb 2026)
+# =============================================================================
+# Go SDK, GPU support, watch mode, profiles
+
+metadata:
+  skill: docker
+  domain: compose
+  version: "2026.1"
+  updated: "2026-02-05"
+  patterns_count: 5
+
+patterns:
+  - id: docker010
+    name: Compose v5 Go SDK
+    category: compose
+    version: "2024+"
+    description: New Go-based Compose with improved performance and features
+    text: compose v5 go sdk docker compose up services
+    example: |
+      # compose.yaml (Compose v5 format)
+      name: my-app
+
+      services:
+        api:
+          build:
+            context: ./api
+            dockerfile: Dockerfile
+          ports:
+            - "3000:3000"
+          environment:
+            DATABASE_URL: postgres://db:5432/app
+          depends_on:
+            db:
+              condition: service_healthy
+          develop:
+            watch:
+              - action: sync
+                path: ./api/src
+                target: /app/src
+
+        db:
+          image: postgres:16
+          environment:
+            POSTGRES_PASSWORD: secret
+          healthcheck:
+            test: ["CMD", "pg_isready"]
+            interval: 10s
+            timeout: 5s
+            retries: 5
+
+      # Run with watch mode
+      docker compose up --watch
+
+      # Compose v5 vs v2:
+      # - 40% faster startup
+      # - Native GPU support
+      # - Better BuildKit integration
+    severity: HIGH
+    docs_url: https://docs.docker.com/compose/
+
+  - id: docker011
+    name: Compose Watch Mode
+    category: compose
+    version: "2023+"
+    description: Automatic sync and rebuild on file changes
+    text: compose watch hot reload development live sync
+    example: |
+      services:
+        frontend:
+          build: ./frontend
+          develop:
+            watch:
+              # Sync files without rebuild
+              - action: sync
+                path: ./frontend/src
+                target: /app/src
+                ignore:
+                  - node_modules/
+
+              # Rebuild on package changes
+              - action: rebuild
+                path: ./frontend/package.json
+
+              # Sync and restart
+              - action: sync+restart
+                path: ./frontend/config.json
+                target: /app/config.json
+
+        api:
+          build: ./api
+          develop:
+            watch:
+              - action: rebuild
+                path: ./api
+                ignore:
+                  - "*.test.go"
+
+      # Start with watch mode
+      docker compose watch
+      # Or: docker compose up --watch
+    severity: HIGH
+    docs_url: https://docs.docker.com/compose/file-watch/
+
+  - id: docker012
+    name: Compose GPU Support
+    category: compose
+    version: "2024+"
+    description: Native GPU access for ML workloads in Compose
+    text: compose gpu nvidia ml machine learning cuda
+    example: |
+      services:
+        ml-training:
+          image: pytorch/pytorch:2.2.0-cuda12.1-cudnn8-runtime
+          deploy:
+            resources:
+              reservations:
+                devices:
+                  - driver: nvidia
+                    count: 1  # Or "all" for all GPUs
+                    capabilities: [gpu]
+          environment:
+            CUDA_VISIBLE_DEVICES: 0
+
+        inference:
+          image: myregistry/inference-server
+          deploy:
+            resources:
+              reservations:
+                devices:
+                  - driver: nvidia
+                    device_ids: ['0', '1']  # Specific GPUs
+                    capabilities: [gpu, utility]
+
+      # Check GPU availability
+      docker info | grep -i nvidia
+    severity: HIGH
+    docs_url: https://docs.docker.com/compose/gpu-support/
+
+  - id: docker013
+    name: Compose Profiles
+    category: compose
+    version: "2021+"
+    description: Selective service startup with profiles
+    text: compose profiles conditional services development testing
+    example: |
+      services:
+        app:
+          image: myapp
+
+        db:
+          image: postgres:16
+
+        # Only start with --profile debug
+        debug-tools:
+          image: nicolaka/netshoot
+          profiles: [debug]
+          stdin_open: true
+          tty: true
+
+        # Development tools
+        adminer:
+          image: adminer
+          profiles: [dev]
+          ports:
+            - "8080:8080"
+
+        # Testing database
+        test-db:
+          image: postgres:16
+          profiles: [test]
+          environment:
+            POSTGRES_DB: test_db
+
+      # Usage:
+      docker compose up                    # Only app and db
+      docker compose --profile dev up      # + adminer
+      docker compose --profile debug up    # + debug-tools
+      docker compose --profile test up     # + test-db
+    severity: MEDIUM
+    docs_url: https://docs.docker.com/compose/profiles/
+
+  - id: docker014
+    name: Compose Networking
+    category: compose
+    version: "2021+"
+    description: Custom networks and service discovery
+    text: compose networks internal external service discovery dns
+    example: |
+      services:
+        api:
+          networks:
+            - frontend
+            - backend
+
+        db:
+          networks:
+            - backend
+
+        nginx:
+          networks:
+            - frontend
+            - external
+
+      networks:
+        frontend:
+          # Internal network (no external access)
+        backend:
+          internal: true  # No outbound internet
+        external:
+          # Connect to existing network
+          external: true
+          name: prod-network
+
+      # Service discovery:
+      # - Services can reach each other by name
+      # - api can reach db at "db:5432"
+      # - nginx can reach api at "api:3000"
+
+      # DNS aliases:
+      services:
+        db:
+          networks:
+            backend:
+              aliases:
+                - database
+                - postgres
+    severity: MEDIUM
+    docs_url: https://docs.docker.com/compose/networking/

package/.agent/skills/cross-cutting/docker/data/security.yaml

@@ -0,0 +1,164 @@
+# =============================================================================
+# Docker Security Patterns (Feb 2026)
+# =============================================================================
+# Hardened images, rootless, scanning, microVM sandboxes
+
+metadata:
+  skill: docker
+  domain: security
+  version: "2026.1"
+  updated: "2026-02-05"
+  patterns_count: 4
+
+patterns:
+  - id: docker020
+    name: Hardened Images (Docker Official)
+    category: security
+    version: "2024+"
+    description: Docker's hardened base images with minimal attack surface
+    text: hardened images docker official minimal security distroless
+    example: |
+      # Docker Hardened Images (2024+)
+      FROM docker.io/library/node:22-slim-hardened
+
+      # Or use distroless (Google)
+      FROM gcr.io/distroless/nodejs22-debian12
+
+      # Hardened image features:
+      # - No shell (prevents shell escapes)
+      # - Minimal packages (reduced CVEs)
+      # - Non-root user by default
+      # - Read-only filesystem compatible
+      # - SBOM included
+
+      # Multi-platform hardened
+      FROM --platform=$BUILDPLATFORM docker.io/library/python:3.12-slim
+
+      # Final stage with hardened base
+      FROM gcr.io/distroless/python3-debian12
+      COPY --from=builder /app /app
+      USER nonroot
+      CMD ["python", "/app/main.py"]
+    severity: CRITICAL
+    docs_url: https://docs.docker.com/trusted-content/
+
+  - id: docker021
+    name: Rootless Docker
+    category: security
+    version: "20.10+"
+    description: Run Docker daemon and containers without root privileges
+    text: rootless docker non-root security user namespace
+    example: |
+      # Install rootless Docker
+      dockerd-rootless-setuptool.sh install
+
+      # Configure shell
+      export PATH=/home/user/bin:$PATH
+      export DOCKER_HOST=unix:///run/user/1000/docker.sock
+
+      # Run container as non-root
+      docker run --rm -it \
+        --security-opt no-new-privileges \
+        --cap-drop ALL \
+        --read-only \
+        myapp
+
+      # Kubernetes Pod Security equivalent
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        readOnlyRootFilesystem: true
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop: ["ALL"]
+    severity: HIGH
+    docs_url: https://docs.docker.com/engine/security/rootless/
+
+  - id: docker022
+    name: Image Scanning
+    category: security
+    version: "2022+"
+    description: Scan images for vulnerabilities with Docker Scout
+    text: docker scout scan vulnerability cve security analysis
+    example: |
+      # Scan local image
+      docker scout cves myapp:latest
+
+      # Scan with recommendations
+      docker scout recommendations myapp:latest
+
+      # SBOM generation
+      docker scout sbom myapp:latest
+
+      # Compare versions
+      docker scout compare myapp:v1 --to myapp:v2
+
+      # CI/CD integration
+      - name: Scan with Docker Scout
+        uses: docker/scout-action@v1
+        with:
+          command: cves
+          image: myregistry/myapp:${{ github.sha }}
+          only-severities: critical,high
+
+      # Alternative: Trivy
+      trivy image --severity HIGH,CRITICAL myapp:latest
+    severity: HIGH
+    docs_url: https://docs.docker.com/scout/
+
+  - id: docker023
+    name: MicroVM Sandboxes
+    category: security
+    version: "2025+"
+    description: Hardware-isolated containers with Firecracker/gVisor
+    text: microvm sandbox firecracker gvisor isolation kata containers
+    example: |
+      # Docker Desktop (2025+): MicroVM isolation
+
+      # Enable in settings.json or Docker Desktop UI
+      {
+        "experimental": true,
+        "vm": {
+          "type": "microvm"
+        }
+      }
+
+      # Or use gVisor runtime
+      docker run --runtime=runsc myapp
+
+      # Install gVisor
+      sudo apt-get install runsc
+
+      # Configure Docker daemon
+      # /etc/docker/daemon.json
+      {
+        "runtimes": {
+          "runsc": {
+            "path": "/usr/bin/runsc",
+            "runtimeArgs": [
+              "--platform=systrap"
+            ]
+          }
+        }
+      }
+
+      # Kubernetes with gVisor
+      apiVersion: node.k8s.io/v1
+      kind: RuntimeClass
+      metadata:
+        name: gvisor
+      handler: runsc
+
+      # Use in Pod
+      spec:
+        runtimeClassName: gvisor
+        containers:
+          - name: app
+            image: myapp
+
+      # Benefits:
+      # - Hardware-level isolation
+      # - Prevents container escapes
+      # - Minimal performance overhead (5-10%)
+    severity: HIGH
+    docs_url: https://docs.docker.com/desktop/features/isolation/