Shareable instruction files for Cursor, Claude Code, Copilot, Windsurf, and more — installed alongside your existing agent rules.
1. **Multi-stage builds**: Separate build and runtime environments 2. **Minimal base images**: Use Alpine or slim variants 3. **Non-root users**: Run processes as non-privileged users 4. **Version pinning**: Pin specific base image versions