rsc-universal 0.1.1

package/skills/django/references/testing.md

@@ -0,0 +1,86 @@
+# Testing Django with pytest-django
+
+Use `pytest-django`. It gives you DB fixtures, the `@pytest.mark.django_db` gate, and
+`--reuse-db`. The stdlib `TestCase` still works; the patterns below apply to both.
+
+## Setup
+
+```toml
+# pyproject.toml
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "config.settings.test"
+addopts = "--reuse-db --strict-markers"
+```
+
+- `--reuse-db` skips schema rebuild between runs locally; CI drops it (or runs `--create-db`).
+- A dedicated `settings/test.py` uses a fast hasher and an in-memory or disposable DB.
+
+## DB access & transactions
+
+```python
+import pytest
+
+@pytest.mark.django_db                 # this test may touch the DB
+def test_publish(article):
+    article.publish()
+    article.refresh_from_db()
+    assert article.status == "published"
+```
+
+- `TestCase` (and `django_db`) wraps each test in a transaction that rolls back — fast, isolated.
+- Use `TransactionTestCase` / `@pytest.mark.django_db(transaction=True)` **only** when you assert
+  `transaction.on_commit` callbacks or genuine multi-connection commit behavior; it truncates
+  tables and is slower.
+
+## Factories over hand-built rows
+
+```python
+import factory
+from catalog.models import Product
+
+class ProductFactory(factory.django.DjangoModelFactory):
+    class Meta:
+        model = Product
+    name = factory.Sequence(lambda n: f"product-{n}")
+    price = 9.99
+    owner = factory.SubFactory("tests.factories.UserFactory")
+```
+
+`ProductFactory.create_batch(20)` beats 20 hand-written `objects.create(...)` calls and stays
+correct as the model grows.
+
+## Locking in N+1 fixes
+
+```python
+from django.test import TestCase
+
+class ListQueryTests(TestCase):
+    def test_list_is_constant_queries(self):
+        ProductFactory.create_batch(10)
+        with self.assertNumQueries(2):          # list + one prefetch, regardless of N
+            list(Product.objects.select_related("owner"))
+```
+
+`assertNumQueries` turns a silent N+1 regression into a red build. Add one to every list/detail
+endpoint that walks a relation.
+
+## API tests
+
+```python
+from rest_framework.test import APIClient
+
+@pytest.mark.django_db
+def test_owner_only(product, owner):
+    client = APIClient()
+    assert client.get(f"/api/products/{product.pk}/").status_code == 403   # anon
+    client.force_authenticate(owner)
+    assert client.get(f"/api/products/{product.pk}/").status_code == 200
+```
+
+- `force_authenticate(user)` bypasses the login round-trip; test the permission, not the auth UI.
+- Test the boundary cases: anonymous, wrong owner, correct owner, and invalid payload (400).
+
+## Coverage
+
+Run `pytest --cov` and set `--cov-fail-under` in `pyproject.toml`. Cover model methods,
+managers, permissions and serializers validators — the logic, not the framework.

package/skills/django/scripts/verify.sh

@@ -0,0 +1,115 @@
+#!/usr/bin/env bash
+#
+# verify.sh — read-only foot-gun lint for a Django project.
+#
+# Usage:
+#   ./scripts/verify.sh [TARGET_PATH]      # default: current directory
+#
+# Greps tracked Django source for high-signal mistakes. It NEVER edits anything and
+# NEVER runs the project; it only reads files. This is a lint, not a replacement for
+# `python manage.py check --deploy` or the test suite.
+#
+# Exit codes:
+#   0  clean, empty target, or warnings only
+#   2  at least one FAIL-level finding
+#
+# FAIL  literal SECRET_KEY in source; ALLOWED_HOSTS = ['*']; f-string/%-built SQL
+#       passed to .raw()/.extra()/cursor.execute
+# WARN  DEBUG = True outside a *dev*/*local* settings file; ModelViewSet/APIView with
+#       no permission_classes nearby
+#
+# Compatible with stock macOS bash 3.2: no mapfile, no associative arrays, find-based
+# file discovery, every array access guarded so `set -u` never trips.
+
+set -euo pipefail
+
+TARGET="${1:-.}"
+
+if [ -t 1 ]; then
+  RED=$'\033[0;31m'; GREEN=$'\033[0;32m'; YELLOW=$'\033[0;33m'; RESET=$'\033[0m'
+else
+  RED=''; GREEN=''; YELLOW=''; RESET=''
+fi
+warn() { printf '%sWARN%s %s\n' "$YELLOW" "$RESET" "$*"; }
+fail() { printf '%sFAIL%s %s\n' "$RED" "$RESET" "$*"; }
+ok()   { printf '%s%s%s\n' "$GREEN" "$*" "$RESET"; }
+
+FAILS=0
+WARNS=0
+
+# A Django project is present if there is a manage.py, a settings file, or any *.py.
+# With none of those there is nothing to lint, so exit 0 (no false failure on empty).
+django_present() {
+  if [ -f "$TARGET/manage.py" ]; then return 0; fi
+  if [ -n "$(find "$TARGET" -type f -name 'settings*.py' -print -quit 2>/dev/null)" ]; then return 0; fi
+  if [ -n "$(find "$TARGET" -type f -name '*.py' -print -quit 2>/dev/null)" ]; then return 0; fi
+  return 1
+}
+
+if ! django_present; then
+  ok "verify.sh: ok (no Django/Python source under '${TARGET}', nothing to lint)"
+  exit 0
+fi
+
+# grep helpers: -E extended regex, -r recursive, -n line numbers, -I skip binary.
+# Restrict to .py for code checks. Suppress grep's exit status (it is informational).
+gpy() { grep -REnI --include='*.py' "$1" "$TARGET" 2>/dev/null || true; }
+
+# --- FAIL: literal SECRET_KEY assignment to a string literal ---
+HITS="$(gpy '^[[:space:]]*SECRET_KEY[[:space:]]*=[[:space:]]*["'\'']' | grep -v 'os\.environ\|getenv\|config(\|env(' || true)"
+if [ -n "$HITS" ]; then
+  fail "SECRET_KEY assigned a literal string (read it from os.environ instead):"
+  printf '%s\n' "$HITS"
+  FAILS=$((FAILS + 1))
+fi
+
+# --- FAIL: ALLOWED_HOSTS = ['*'] (any quote/spacing) ---
+HITS="$(gpy 'ALLOWED_HOSTS[[:space:]]*=[[:space:]]*\[[[:space:]]*["'\'']\*["'\'']' || true)"
+if [ -n "$HITS" ]; then
+  fail "ALLOWED_HOSTS allows every host ('*') — list explicit domains:"
+  printf '%s\n' "$HITS"
+  FAILS=$((FAILS + 1))
+fi
+
+# --- FAIL: f-string / %-built SQL into .raw()/.extra()/cursor.execute ---
+HITS="$(gpy '(\.raw|\.extra|cursor\.execute)\([[:space:]]*(f["'\'']|["'\''].*%[^s])' || true)"
+if [ -n "$HITS" ]; then
+  fail "SQL string interpolation into .raw()/.extra()/cursor.execute (use params, not f-strings/%):"
+  printf '%s\n' "$HITS"
+  FAILS=$((FAILS + 1))
+fi
+
+# --- WARN: DEBUG = True outside a dev/local settings file ---
+DEBUG_HITS="$(gpy '^[[:space:]]*DEBUG[[:space:]]*=[[:space:]]*True' || true)"
+if [ -n "$DEBUG_HITS" ]; then
+  # Drop lines whose file path looks like a dev/local/test settings module.
+  NONDEV="$(printf '%s\n' "$DEBUG_HITS" | grep -vEi '(dev|local|test)' || true)"
+  if [ -n "$NONDEV" ]; then
+    warn "DEBUG = True outside a dev/local settings file (must be False in prod):"
+    printf '%s\n' "$NONDEV"
+    WARNS=$((WARNS + 1))
+  fi
+fi
+
+# --- WARN: ModelViewSet / APIView subclasses with no permission_classes nearby ---
+# Heuristic: a file that defines such a class but never mentions permission_classes.
+VS_FILES="$(grep -rlEI --include='*.py' '(ModelViewSet|ReadOnlyModelViewSet|viewsets\.GenericViewSet|APIView)' "$TARGET" 2>/dev/null || true)"
+if [ -n "$VS_FILES" ]; then
+  while IFS= read -r f; do
+    [ -z "$f" ] && continue
+    if ! grep -qE 'permission_classes' "$f" 2>/dev/null; then
+      warn "no permission_classes in a viewset/APIView file (endpoint may be open): $f"
+      WARNS=$((WARNS + 1))
+    fi
+  done <<EOF
+$VS_FILES
+EOF
+fi
+
+printf '\n%d fail, %d warn\n' "$FAILS" "$WARNS"
+if [ "$FAILS" -gt 0 ]; then
+  fail "verify.sh: foot-guns detected"
+  exit 2
+fi
+ok "verify.sh: ok"
+exit 0

package/skills/docker/SKILL.md

@@ -0,0 +1,283 @@
+---
+name: docker
+description: "Use when authoring or auditing a Dockerfile/Containerfile, shrinking a bloated image, hardening a container that runs as root, choosing a base image, or wiring a Compose dev loop with hot reload. Triggers: 'dockerize this app', 'my node image is 1.2GB make it smaller', 'the build cache keeps busting', 'harden this Dockerfile, trivy flags it', 'docker compose watch for local dev', 'distroless vs alpine vs slim', 'la imagen pesa demasiado', 'el build de docker tarda siglos'. NOT the CI/CD pipeline or deploy-to-host (that is deployment), NOT k8s autoscaling/HPA (that is scaling), NOT app-level SQL injection or secrets-in-code (that is secure-coding)."
+tags: [docker, containers, dockerfile, compose, image-security]
+recommends: [deployment, secure-coding, scaling, github-actions]
+origin: risco
+---
+
+# docker — container-craft
+
+You own one question, deeply: **how do I turn this app into a small, secure, fast-building
+image — and run a frictionless local stack with Compose?** Your artifacts are the `Dockerfile`,
+the `.dockerignore`, and the `compose.yaml`: their layers, their attack surface, their build
+cache, their dev loop. You do not touch what happens after the image is built.
+
+```text
+source  →  Dockerfile (multi-stage, cache mounts)  →  small + scanned image  +  compose.yaml (dev loop)
+                                                            └──────────────┬──────────────┘
+                                                    hand off to ../deployment/SKILL.md
+```
+
+The hand-off is sharp: **the moment you have a green, scanned image and a working
+`compose.yaml`, you are done.** Pushing to a registry, building in CI, deploying to a host,
+rollback — that is `../deployment/SKILL.md`. It already references Dockerfiles; you are the
+image-internals specialist it leans on.
+
+## When to use
+
+- Authoring or auditing a `Dockerfile` for any stack (Node, Python, Go, Rust, JVM, static SPA).
+- An image is too big (800 MB+ Node image), builds too slowly, or fails `trivy`/`hadolint`.
+- A container runs as root and you need least privilege.
+- Standing up local dev with `compose.yaml` + `docker compose watch` (sync / rebuild / sync+restart).
+- Choosing a base image and getting multi-stage + BuildKit cache mounts right.
+
+## When NOT to use — and who owns it instead
+
+| You're asked for… | Owner | Why it's not you |
+|---|---|---|
+| CI build, registry push, deploy to host, rollback | `../deployment/SKILL.md` | You build + harden the image; it moves the image through CI to prod |
+| k8s manifests, HPA autoscaling, ingress | `scaling` | Orchestration above a single image |
+| App SQL injection, secrets in source, dep CVE triage | `../secure-coding/SKILL.md` | You cover only *image/container* hardening |
+| Install/operate a self-hosted PaaS | `../coolify/SKILL.md` | Host operation, not the image |
+| Containerless PaaS deploy mechanics | `../railway/SKILL.md`, `../fly-io/SKILL.md` | Platform deploy, not the Dockerfile |
+
+## The five rules
+
+1. **Multi-stage, always.** Build deps (compilers, dev packages, the full SDK) must never reach
+   the runtime image. Multiple `FROM` stages; copy only the built artifact into a minimal final
+   stage. *Why: a Go binary needs ~10 MB, not a 900 MB toolchain — and every extra package is CVE
+   surface.*
+2. **Choose the base deliberately and pin it — never `:latest`.** Pin a tag (ideally a digest)
+   so a rebuild is reproducible. *Why: `:latest` silently changes under you, breaking builds and
+   busting the scan you just passed.*
+3. **Install deps before copying source.** Order layers so the lockfile install is cached and use
+   BuildKit cache mounts. *Why: copying everything first invalidates the dependency layer on every
+   one-character source edit.*
+4. **Run as a non-root `USER`.** Default PID 1 is root (UID 0); a container escape from root is a
+   host compromise. *Why: least privilege is the cheapest blast-radius reduction you can ship.*
+5. **One concern per container; EXEC-form `CMD`; add a `HEALTHCHECK`.** *Why: shell-form `CMD foo`
+   wraps your process in `/bin/sh -c`, which swallows `SIGTERM` so the container ignores graceful
+   shutdown; a healthcheck lets Compose/orchestrators gate on readiness.*
+
+## Pick a base image (2026 reality)
+
+| Base | Size | CVE / patch velocity | Debuggable? | Wins when |
+|---|---|---|---|---|
+| `*-slim` (e.g. `bookworm-slim`) | ~30–80 MB | moderate, glibc | yes (shell, apt) | pragmatic default, native deps / Python wheels |
+| `distroless` (`gcr.io/distroless/*`) | ~2–25 MB | convenient but **patches slower** | no shell | static/compiled runtimes, want minimal surface |
+| **Chainguard / Wolfi** | tiny, glibc | **lowest live CVE count**, SLSA L3 attestations | minimal | security-first; real scans found high-sev CVEs where the Chainguard equivalent had zero |
+| `alpine` | ~5 MB, musl | small surface | yes (apk) | tiny static services — **but musl breaks many Python wheels / native deps** |
+| `scratch` | 0 | nothing to patch | no | a fully static binary (Go), nothing else |
+
+Rule of thumb: glibc app with native deps → `*-slim` or Wolfi. Static Go binary → `scratch` or
+`distroless/static`. Security mandate → Chainguard. Reach for `alpine` only when you've confirmed
+your wheels/native libs build against musl. Per-language tag maps live in
+[references/base-images-and-stages.md](references/base-images-and-stages.md).
+
+## Multi-stage skeletons
+
+**Node — `npm ci` with a cache mount → distroless nonroot.** Bad: single-stage `node:20` ≈ 1.1 GB.
+Good: this ≈ 180 MB. Tags track Node 24 (the active LTS as of mid-2026); Node 22 is in Maintenance
+LTS, so swap `24`→`22` only when you deliberately want the conservative maintenance line.
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM node:24-bookworm-slim AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN --mount=type=cache,target=/root/.npm npm ci
+COPY . .
+RUN npm run build && npm prune --omit=dev
+
+FROM gcr.io/distroless/nodejs24-debian13:nonroot
+WORKDIR /app
+COPY --from=build /app/node_modules ./node_modules
+COPY --from=build /app/dist ./dist
+USER nonroot
+EXPOSE 3000
+HEALTHCHECK --interval=30s --timeout=3s CMD ["node", "dist/healthcheck.js"]
+CMD ["dist/server.js"]
+```
+
+**Python — `uv` into a venv → slim, non-root.** Bad: `python:3.12` + `pip` ≈ 1 GB. Good: ≈ 130 MB.
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM python:3.13-slim-bookworm AS build
+COPY --from=ghcr.io/astral-sh/uv:latest /uv /usr/local/bin/uv
+WORKDIR /app
+ENV UV_PROJECT_ENVIRONMENT=/opt/venv
+COPY pyproject.toml uv.lock ./
+RUN --mount=type=cache,target=/root/.cache/uv uv sync --frozen --no-dev
+
+FROM python:3.13-slim-bookworm
+RUN useradd --create-home --uid 10001 app
+COPY --from=build --chown=app:app /opt/venv /opt/venv
+COPY --chown=app:app . /app
+WORKDIR /app
+ENV PATH="/opt/venv/bin:$PATH"
+USER app
+EXPOSE 8000
+HEALTHCHECK CMD ["python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://localhost:8000/health').status==200 else 1)"]
+CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]
+```
+
+**Go — static binary → `scratch`.** Bad: `golang:1.26` ≈ 900 MB. Good: ≈ 12 MB. Pin a
+supported toolchain: Go maintains only the latest two minors (1.26/1.25 as of mid-2026), so a
+`golang:1.23` build image is two minors past EOL and no longer gets security patches.
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM golang:1.26-bookworm AS build
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN --mount=type=cache,target=/go/pkg/mod go mod download
+COPY . .
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /app ./cmd/server
+
+FROM scratch
+COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=build /app /app
+USER 10001:10001
+EXPOSE 8080
+ENTRYPOINT ["/app"]
+```
+
+The cache-mount `target` differs per ecosystem: `/root/.npm`, `/root/.cache/uv` (or
+`/root/.cache/pip`), `/go/pkg/mod`. The cache persists across builds without bloating any layer.
+
+## `.dockerignore` — load-bearing, not optional
+
+Without it the entire context (including `.git`, `node_modules`, `.env`) ships to the daemon: it
+slows the build and can bake secrets into a layer via `COPY .`.
+
+```gitignore
+.git
+.gitignore
+node_modules
+dist
+.env
+.env.*
+*.log
+.venv
+__pycache__
+Dockerfile
+.dockerignore
+README.md
+```
+
+Mirror `.gitignore`, then add build outputs and the Dockerfile itself.
+
+## Harden the runtime
+
+Non-root in the image (already shown above): create a user, `COPY --chown`, `USER`. Then lock the
+runtime down where the container actually runs:
+
+```bash
+docker run \
+  --read-only --tmpfs /tmp \
+  --security-opt=no-new-privileges \
+  --cap-drop=ALL \
+  myimage:1.4.0
+```
+
+`--read-only` rootfs + `--tmpfs /tmp` for scratch space; `no-new-privileges` blocks setuid
+escalation; `--cap-drop=ALL` then add back only what you truly need (`--cap-add=NET_BIND_SERVICE`
+to bind port < 1024).
+
+**Build secrets — never `ARG`/`ENV`.** An `ARG TOKEN` lands in the image history and any
+`ENV SECRET=...` persists in a layer. Use a BuildKit secret mount; it is never written to a layer:
+
+```dockerfile
+# Bad — leaks into image history:  ARG NPM_TOKEN
+# Good:
+RUN --mount=type=secret,id=npm_token \
+    NPM_TOKEN="$(cat /run/secrets/npm_token)" npm ci
+```
+
+```bash
+docker build --secret id=npm_token,env=NPM_TOKEN .
+```
+
+## Compose for dev
+
+Canonical filename is `compose.yaml`; **omit the obsolete `version:` key**; use `docker compose`
+(v2 subcommand), never the standalone `docker-compose` v1. `develop.watch` is GA since Compose
+2.22.0 and gives you a tight dev loop.
+
+```yaml
+services:
+  api:
+    build: .
+    ports: ["8000:8000"]
+    depends_on:
+      db:
+        condition: service_healthy
+    develop:
+      watch:
+        - action: sync          # hot-reload: copy changed files into the container
+          path: ./src
+          target: /app/src
+        - action: rebuild       # lockfile / compiled langs: rebuild the image
+          path: ./uv.lock
+        - action: sync+restart  # config change: sync then restart the process
+          path: ./config.yaml
+          target: /app/config.yaml
+  db:
+    image: postgres:17-bookworm
+    environment:
+      POSTGRES_PASSWORD: dev
+    volumes: ["pgdata:/var/lib/postgresql/data"]
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U postgres"]
+      interval: 5s
+      timeout: 3s
+      retries: 5
+  seed:
+    profiles: ["tools"]         # only runs with: docker compose --profile tools up
+    build: .
+    command: ["python", "-m", "app.seed"]
+
+volumes:
+  pgdata:
+```
+
+Run the dev loop with `docker compose watch` (or `docker compose up --watch`). Fuller patterns —
+watch-per-stack, multi-service healthcheck graphs, override files, `env_file` vs `secrets`, and
+when to graduate to `deployment`/`scaling` — are in
+[references/compose-recipes.md](references/compose-recipes.md).
+
+## Verify the image
+
+These are exactly what `scripts/verify.sh` automates (it skips a tool gracefully if absent):
+
+- `hadolint Dockerfile` — static lint of the Dockerfile (no error-level findings).
+- `docker compose config -q` — the `compose.yaml` parses and resolves.
+- `trivy image myimage:1.4.0` — CVE + misconfig + secret scan of the built image.
+- `trivy config .` — scan the Dockerfile/compose for misconfiguration without a build.
+- `dockle myimage:1.4.0` — CIS-style image hygiene.
+- size check — assert the final image is under your threshold (`docker image inspect -f '{{.Size}}'`).
+
+## Anti-patterns
+
+| Bad | Good | Why |
+|---|---|---|
+| `FROM node:latest` | `FROM node:24-bookworm-slim` (pin/digest) | `:latest` drifts; builds + scans become non-reproducible |
+| runs as root (no `USER`) | `USER nonroot` / `USER 10001` | root escape == host compromise |
+| `ARG TOKEN` / `ENV SECRET=` | `RUN --mount=type=secret,...` | ARG/ENV persist in image history & layers |
+| `COPY . .` then `RUN npm ci` | copy lockfile → install → copy source | source edits bust the dep cache layer every build |
+| single `FROM`, ship the SDK | multi-stage, copy only the artifact | runtime carries compilers & dev CVE surface |
+| `apt-get install x` | `apt-get install --no-install-recommends x && rm -rf /var/lib/apt/lists/*` | recommends + apt lists bloat the layer |
+| no `.dockerignore` | mirror `.gitignore` + build outputs | whole context ships; `.env`/`.git` can leak |
+| `version: "3.8"` / `docker-compose` v1 | omit `version:`; `docker compose` v2 | the key is obsolete; v1 is EOL |
+| `CMD npm start` (shell form) | `CMD ["node", "server.js"]` (exec) | shell form swallows `SIGTERM`; no graceful shutdown |
+
+## References & siblings
+
+- [references/base-images-and-stages.md](references/base-images-and-stages.md) — per-language
+  multi-stage templates (Rust, JVM jlink, static SPA → nginx), tag maps, multi-arch buildx.
+- [references/compose-recipes.md](references/compose-recipes.md) — fuller Compose patterns.
+- Once the image is green and scanned: `../deployment/SKILL.md`. Image/container hardening pairs
+  with `../secure-coding/SKILL.md`. Self-hosted host ops: `../coolify/SKILL.md`.

package/skills/docker/evals/README.md

@@ -0,0 +1,10 @@
+# Evals — docker
+
+`cases.yaml` has two kinds of checks. `should_trigger` / `should_not_trigger` are routing cases:
+they validate that this skill's `description` fires on real container/image/Compose phrasings
+(including the size-symptom and Catalan/Spanish ones) and stays quiet for CI-deploy, k8s,
+app-security, and PaaS-host prompts, each routing to a named sibling. The `capability` case is a
+rubric-graded scenario: feed the naive single-stage root Dockerfile to the skill and grade the
+output against `must_include` (multi-stage, cache mount, non-root, pinned base, `.dockerignore`,
+exec-form CMD, healthcheck, compose watch, no ARG/ENV secrets, hadolint/trivy). Run these through
+the repo's eval harness; routing cases are mechanical, the capability case is manual or LLM-graded.

package/skills/docker/evals/cases.yaml

@@ -0,0 +1,44 @@
+skill: docker
+
+should_trigger:
+  - prompt: "Dockerize this FastAPI service so it's ready for prod."
+    why: Core authoring of a Dockerfile for a Python web app — the skill's primary job.
+  - prompt: "Our node image is 1.2GB, shrink it."
+    why: Size symptom with no mention of "Dockerfile" — non-obvious entry that maps to multi-stage + base choice.
+  - prompt: "Set up docker compose with live reload for local dev."
+    why: Compose dev loop via develop.watch, the skill's Compose half.
+  - prompt: "This Dockerfile runs as root and trivy flags it — harden it."
+    why: Image/container hardening (non-root, scan) which is in-scope, not app-level security.
+  - prompt: "El build de docker tarda siglos y la imagen pesa demasiado."
+    why: Catalan/Spanish, non-obvious — slow build + heavy image map to cache mounts, layer order, multi-stage.
+
+should_not_trigger:
+  - prompt: "Write the GitHub Actions workflow to build and push to ghcr."
+    route_to: deployment
+    why: CI pipeline + registry push is downstream of the image; deployment owns it.
+  - prompt: "Add k8s HPA autoscaling for this service."
+    route_to: scaling
+    why: Orchestration/autoscaling above a single image is scaling's domain.
+  - prompt: "Fix the SQL injection in this endpoint."
+    route_to: secure-coding
+    why: App-level vulnerability, not image/container hardening.
+  - prompt: "Install and configure Coolify on my Hetzner box."
+    route_to: coolify
+    why: Self-hosted PaaS host operation, not authoring the image.
+
+capability:
+  - scenario: >
+      Given a naive single-stage Dockerfile that uses FROM node:latest, runs npm install after
+      COPY . ., runs as root, has no .dockerignore and no healthcheck, produce a hardened
+      replacement plus the supporting files.
+    must_include:
+      - Multi-stage build (separate build and runtime FROM stages)
+      - BuildKit cache mount on the dependency install (e.g. --mount=type=cache,target=/root/.npm)
+      - Non-root USER in the final image
+      - Pinned, non-latest base image (tag or digest, not :latest)
+      - A .dockerignore that excludes .git, node_modules, .env
+      - EXEC-form CMD/ENTRYPOINT (JSON array, not shell form)
+      - A HEALTHCHECK instruction
+      - A compose.yaml using develop.watch for the dev loop
+      - No secrets in ARG/ENV (build secrets via --mount=type=secret)
+      - Mentions verifying with hadolint and trivy

package/skills/docker/references/base-images-and-stages.md

@@ -0,0 +1,104 @@
+# Base images & multi-stage templates
+
+Per-language skeletons beyond the three in SKILL.md, plus tag maps and multi-arch notes.
+
+## Tag map (2026)
+
+| Goal | Tag |
+|---|---|
+| Pragmatic glibc default | `debian:bookworm-slim`, `python:3.13-slim-bookworm`, `node:24-bookworm-slim` |
+| Distroless runtime | `gcr.io/distroless/static-debian12:nonroot`, `gcr.io/distroless/nodejs24-debian13:nonroot`, `gcr.io/distroless/python3-debian12:nonroot` |
+| Chainguard / Wolfi | `cgr.dev/chainguard/node:latest`, `cgr.dev/chainguard/python:latest`, `cgr.dev/chainguard/static:latest` (pin the digest in prod) |
+| Fully static binary | `scratch` |
+
+Node tags follow the active LTS (`24` as of mid-2026); `22` is Maintenance LTS — pick it only as
+the conservative choice. Go tags follow the two supported minors (`1.26`/`1.25`); never ship a
+build image off the supported window since it stops getting security patches.
+
+Chainguard images carry SLSA L3 build attestations and track the lowest live CVE counts; real
+scans have found high-severity CVEs in a distroless image where the Chainguard equivalent had zero.
+Distroless is convenient but patches more slowly. Pin by digest for reproducibility.
+
+## Rust → scratch / distroless-static
+
+Pin the build image to your project's MSRV (the minimum Rust your `Cargo.toml` declares), or to a
+current stable minor if you have none — `1.96` is the latest stable as of mid-2026. *Why: a stale
+build image (e.g. `1.83`, ~13 minors back) compiles fine but stops getting toolchain security
+fixes, the same supported-window rule as the Node/Go skeletons.*
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM rust:1.96-bookworm AS build
+WORKDIR /src
+COPY Cargo.toml Cargo.lock ./
+RUN mkdir src && echo "fn main() {}" > src/main.rs
+RUN --mount=type=cache,target=/usr/local/cargo/registry cargo build --release
+COPY . .
+RUN --mount=type=cache,target=/usr/local/cargo/registry \
+    touch src/main.rs && cargo build --release
+
+FROM gcr.io/distroless/cc-debian12:nonroot
+COPY --from=build /src/target/release/app /app
+USER nonroot
+ENTRYPOINT ["/app"]
+```
+
+Use `distroless/cc` (not `static`) when you link against glibc/`libgcc`. For musl-static, build the
+`x86_64-unknown-linux-musl` target and ship on `scratch`.
+
+## JVM → jlink custom runtime
+
+A full JRE is ~200 MB; a `jlink`-trimmed runtime with only the modules you use is ~50–80 MB.
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM eclipse-temurin:21-jdk AS build
+WORKDIR /src
+COPY . .
+RUN ./mvnw -q package -DskipTests
+RUN jlink --add-modules java.base,java.logging,java.sql,java.naming \
+      --strip-debug --no-man-pages --no-header-files --compress=2 \
+      --output /javaruntime
+
+FROM debian:bookworm-slim
+RUN useradd --uid 10001 app
+COPY --from=build /javaruntime /opt/java
+COPY --from=build --chown=app:app /src/target/app.jar /app/app.jar
+ENV PATH="/opt/java/bin:$PATH"
+USER app
+ENTRYPOINT ["java", "-jar", "/app/app.jar"]
+```
+
+Run `jdeps --print-module-deps target/app.jar` to discover the real module list.
+
+## Static SPA → nginx (non-root)
+
+```dockerfile
+# syntax=docker/dockerfile:1
+FROM node:24-bookworm-slim AS build
+WORKDIR /app
+COPY package.json package-lock.json ./
+RUN --mount=type=cache,target=/root/.npm npm ci
+COPY . .
+RUN npm run build
+
+FROM nginxinc/nginx-unprivileged:1.27-bookworm
+COPY --from=build /app/dist /usr/share/nginx/html
+# nginx-unprivileged already runs as UID 101 and listens on 8080
+EXPOSE 8080
+```
+
+Use `nginxinc/nginx-unprivileged` so you are not running the webserver as root. Caddy
+(`caddy:2-alpine`) is a smaller alternative with automatic compression.
+
+## Multi-arch with buildx
+
+```bash
+docker buildx build \
+  --platform linux/amd64,linux/arm64 \
+  -t myimage:1.4.0 --push .
+```
+
+Cross-compile rather than emulate where the toolchain allows it: Go uses `GOOS`/`GOARCH`, Rust uses
+`--target`. Emulated arm64 builds via QEMU are correct but slow; native cross-compile in the build
+stage then `COPY` per-arch is far faster.