{"owner":"aquasecurity","repo":"docker","hasSkills":true,"totalSkillsCount":2,"totalTokensCount":727,"categories":["plugin-manifest","cursor-rule"],"hasMcp":false,"mcpConfig":null,"found":["pkg/plugins/pluginrpc-gen/README.md",".cursorrules (docker.mdc)"],"skills":{"pkg/plugins/pluginrpc-gen/README.md":"Plugin RPC Generator\n====================\n\nGenerates go code from a Go interface definition for proxying between the plugin\nAPI and the subsystem being extended.\n\n## Usage\n\nGiven an interface definition:\n\n```go\ntype volumeDriver interface {\n\tCreate(name string, opts opts) (err error)\n\tRemove(name string) (err error)\n\tPath(name string) (mountpoint string, err error)\n\tMount(name string) (mountpoint string, err error)\n\tUnmount(name string) (err error)\n}\n```\n\n**Note**: All function options and return values must be named in the definition.\n\nRun the generator:\n\n```bash\n$ pluginrpc-gen --type volumeDriver --name VolumeDriver -i volumes/drivers/extpoint.go -o volumes/drivers/proxy.go\n```\n\nWhere:\n- `--type` is the name of the interface to use\n- `--name` is the subsystem that the plugin \"Implements\"\n- `-i` is the input file containing the interface definition\n- `-o` is the output file where the the generated code should go\n\n**Note**: The generated code will use the same package name as the one defined in the input file\n\nOptionally, you can skip functions on the interface that should not be\nimplemented in the generated proxy code by passing in the function name to `--skip`.\nThis flag can be specified multiple times.\n\nYou can also add build tags that should be prepended to the generated code by\nsupplying `--tag`. This flag can be specified multiple times.\n\n## Known issues\n\n## go-generate\n\nYou can also use this with go-generate, which is pretty awesome.  \nTo do so, place the code at the top of the file which contains the interface\ndefinition (i.e., the input file):\n\n```go\n//go:generate pluginrpc-gen -i $GOFILE -o proxy.go -type volumeDriver -name VolumeDriver\n```\n\nThen cd to the package dir and run `go generate`\n\n**Note**: the `pluginrpc-gen` binary must be within your `$PATH`\n",".cursorrules (docker.mdc)":"# Docker Rules\n\nExpert Docker practitioner. Minimal, secure, reproducible images.\n\n## Dockerfile\n- Pin versions: FROM node:20.11-alpine3.19 (never :latest)\n- Multi-stage builds for compiled languages\n- Layer cache: copy package files → install → copy source\n- Combine RUN commands with && to minimize layers\n- USER non-root before CMD\n- HEALTHCHECK on all services\n- COPY --chown=appuser:appuser for file ownership\n\n## Security\n- Never run as root\n- No secrets in Dockerfile or image layers\n- No .env files copied into image\n- Scan with docker scout or trivy in CI\n\n## .dockerignore\n- Always present: node_modules, .git, *.log, .env*, test files\n\n## Volumes\n- Named volumes for persistence\n- Bind mounts for dev only, never production\n\n## Networking\n- Custom bridge networks, not host networking\n- Reference services by name in compose\n\n## Logging\n- Always stdout/stderr — never log to files inside container\n\n## Forbidden\n- No :latest tags in production\n- No ADD when COPY works\n- No root user in production\n- No secrets in build args or image layers"},"files":{"pkg/plugins/pluginrpc-gen/README.md":"Plugin RPC Generator\n====================\n\nGenerates go code from a Go interface definition for proxying between the plugin\nAPI and the subsystem being extended.\n\n## Usage\n\nGiven an interface definition:\n\n```go\ntype volumeDriver interface {\n\tCreate(name string, opts opts) (err error)\n\tRemove(name string) (err error)\n\tPath(name string) (mountpoint string, err error)\n\tMount(name string) (mountpoint string, err error)\n\tUnmount(name string) (err error)\n}\n```\n\n**Note**: All function options and return values must be named in the definition.\n\nRun the generator:\n\n```bash\n$ pluginrpc-gen --type volumeDriver --name VolumeDriver -i volumes/drivers/extpoint.go -o volumes/drivers/proxy.go\n```\n\nWhere:\n- `--type` is the name of the interface to use\n- `--name` is the subsystem that the plugin \"Implements\"\n- `-i` is the input file containing the interface definition\n- `-o` is the output file where the the generated code should go\n\n**Note**: The generated code will use the same package name as the one defined in the input file\n\nOptionally, you can skip functions on the interface that should not be\nimplemented in the generated proxy code by passing in the function name to `--skip`.\nThis flag can be specified multiple times.\n\nYou can also add build tags that should be prepended to the generated code by\nsupplying `--tag`. This flag can be specified multiple times.\n\n## Known issues\n\n## go-generate\n\nYou can also use this with go-generate, which is pretty awesome.  \nTo do so, place the code at the top of the file which contains the interface\ndefinition (i.e., the input file):\n\n```go\n//go:generate pluginrpc-gen -i $GOFILE -o proxy.go -type volumeDriver -name VolumeDriver\n```\n\nThen cd to the package dir and run `go generate`\n\n**Note**: the `pluginrpc-gen` binary must be within your `$PATH`\n",".cursorrules (docker.mdc)":"# Docker Rules\n\nExpert Docker practitioner. Minimal, secure, reproducible images.\n\n## Dockerfile\n- Pin versions: FROM node:20.11-alpine3.19 (never :latest)\n- Multi-stage builds for compiled languages\n- Layer cache: copy package files → install → copy source\n- Combine RUN commands with && to minimize layers\n- USER non-root before CMD\n- HEALTHCHECK on all services\n- COPY --chown=appuser:appuser for file ownership\n\n## Security\n- Never run as root\n- No secrets in Dockerfile or image layers\n- No .env files copied into image\n- Scan with docker scout or trivy in CI\n\n## .dockerignore\n- Always present: node_modules, .git, *.log, .env*, test files\n\n## Volumes\n- Named volumes for persistence\n- Bind mounts for dev only, never production\n\n## Networking\n- Custom bridge networks, not host networking\n- Reference services by name in compose\n\n## Logging\n- Always stdout/stderr — never log to files inside container\n\n## Forbidden\n- No :latest tags in production\n- No ADD when COPY works\n- No root user in production\n- No secrets in build args or image layers"},"items":[{"name":"README.md","path":"pkg/plugins/pluginrpc-gen/README.md","rawUrl":"https://raw.githubusercontent.com/aquasecurity/docker/HEAD/pkg/plugins/pluginrpc-gen/README.md","title":"pluginrpc-gen Documentation","category":"plugin-manifest","format":"markdown","content":"Plugin RPC Generator\n====================\n\nGenerates go code from a Go interface definition for proxying between the plugin\nAPI and the subsystem being extended.\n\n## Usage\n\nGiven an interface definition:\n\n```go\ntype volumeDriver interface {\n\tCreate(name string, opts opts) (err error)\n\tRemove(name string) (err error)\n\tPath(name string) (mountpoint string, err error)\n\tMount(name string) (mountpoint string, err error)\n\tUnmount(name string) (err error)\n}\n```\n\n**Note**: All function options and return values must be named in the definition.\n\nRun the generator:\n\n```bash\n$ pluginrpc-gen --type volumeDriver --name VolumeDriver -i volumes/drivers/extpoint.go -o volumes/drivers/proxy.go\n```\n\nWhere:\n- `--type` is the name of the interface to use\n- `--name` is the subsystem that the plugin \"Implements\"\n- `-i` is the input file containing the interface definition\n- `-o` is the output file where the the generated code should go\n\n**Note**: The generated code will use the same package name as the one defined in the input file\n\nOptionally, you can skip functions on the interface that should not be\nimplemented in the generated proxy code by passing in the function name to `--skip`.\nThis flag can be specified multiple times.\n\nYou can also add build tags that should be prepended to the generated code by\nsupplying `--tag`. This flag can be specified multiple times.\n\n## Known issues\n\n## go-generate\n\nYou can also use this with go-generate, which is pretty awesome.  \nTo do so, place the code at the top of the file which contains the interface\ndefinition (i.e., the input file):\n\n```go\n//go:generate pluginrpc-gen -i $GOFILE -o proxy.go -type volumeDriver -name VolumeDriver\n```\n\nThen cd to the package dir and run `go generate`\n\n**Note**: the `pluginrpc-gen` binary must be within your `$PATH`\n","isInternal":false,"tokens":418,"sizeBytes":1796},{"name":".cursorrules","path":".cursorrules (docker.mdc)","rawUrl":"https://raw.githubusercontent.com/PatrickJS/awesome-cursorrules/main/rules/docker.mdc","title":"Docker production rules. Pinned versions, multi-stage builds, non-root user, minimal attack surface.","category":"cursor-rule","format":"markdown","content":"# Docker Rules\n\nExpert Docker practitioner. Minimal, secure, reproducible images.\n\n## Dockerfile\n- Pin versions: FROM node:20.11-alpine3.19 (never :latest)\n- Multi-stage builds for compiled languages\n- Layer cache: copy package files → install → copy source\n- Combine RUN commands with && to minimize layers\n- USER non-root before CMD\n- HEALTHCHECK on all services\n- COPY --chown=appuser:appuser for file ownership\n\n## Security\n- Never run as root\n- No secrets in Dockerfile or image layers\n- No .env files copied into image\n- Scan with docker scout or trivy in CI\n\n## .dockerignore\n- Always present: node_modules, .git, *.log, .env*, test files\n\n## Volumes\n- Named volumes for persistence\n- Bind mounts for dev only, never production\n\n## Networking\n- Custom bridge networks, not host networking\n- Reference services by name in compose\n\n## Logging\n- Always stdout/stderr — never log to files inside container\n\n## Forbidden\n- No :latest tags in production\n- No ADD when COPY works\n- No root user in production\n- No secrets in build args or image layers","frontmatter":{"description":"Docker production rules. Pinned versions, multi-stage builds, non-root user, minimal attack surface.","globs":"Dockerfile, Dockerfile.*, docker-compose*.yml, docker-compose*.yaml, .dockerignore","alwaysApply":false},"tokens":309,"sizeBytes":1057}],"systemPromptSnippet":"<yakaai_skills repo=\"aquasecurity/docker\">\n<!-- File: pkg/plugins/pluginrpc-gen/README.md (Tokens: ~418 | Category: plugin-manifest) -->\nPlugin RPC Generator\n====================\n\nGenerates go code from a Go interface definition for proxying between the plugin\nAPI and the subsystem being extended.\n\n## Usage\n\nGiven an interface definition:\n\n```go\ntype volumeDriver interface {\n\tCreate(name string, opts opts) (err error)\n\tRemove(name string) (err error)\n\tPath(name string) (mountpoint string, err error)\n\tMount(name string) (mountpoint string, err error)\n\tUnmount(name string) (err error)\n}\n```\n\n**Note**: All function options and return values must be named in the definition.\n\nRun the generator:\n\n```bash\n$ pluginrpc-gen --type volumeDriver --name VolumeDriver -i volumes/drivers/extpoint.go -o volumes/drivers/proxy.go\n```\n\nWhere:\n- `--type` is the name of the interface to use\n- `--name` is the subsystem that the plugin \"Implements\"\n- `-i` is the input file containing the interface definition\n- `-o` is the output file where the the generated code should go\n\n**Note**: The generated code will use the same package name as the one defined in the input file\n\nOptionally, you can skip functions on the interface that should not be\nimplemented in the generated proxy code by passing in the function name to `--skip`.\nThis flag can be specified multiple times.\n\nYou can also add build tags that should be prepended to the generated code by\nsupplying `--tag`. This flag can be specified multiple times.\n\n## Known issues\n\n## go-generate\n\nYou can also use this with go-generate, which is pretty awesome.  \nTo do so, place the code at the top of the file which contains the interface\ndefinition (i.e., the input file):\n\n```go\n//go:generate pluginrpc-gen -i $GOFILE -o proxy.go -type volumeDriver -name VolumeDriver\n```\n\nThen cd to the package dir and run `go generate`\n\n**Note**: the `pluginrpc-gen` binary must be within your `$PATH`\n\n<!-- File: .cursorrules (docker.mdc) (Tokens: ~309 | Category: cursor-rule) -->\n# Docker Rules\n\nExpert Docker practitioner. Minimal, secure, reproducible images.\n\n## Dockerfile\n- Pin versions: FROM node:20.11-alpine3.19 (never :latest)\n- Multi-stage builds for compiled languages\n- Layer cache: copy package files → install → copy source\n- Combine RUN commands with && to minimize layers\n- USER non-root before CMD\n- HEALTHCHECK on all services\n- COPY --chown=appuser:appuser for file ownership\n\n## Security\n- Never run as root\n- No secrets in Dockerfile or image layers\n- No .env files copied into image\n- Scan with docker scout or trivy in CI\n\n## .dockerignore\n- Always present: node_modules, .git, *.log, .env*, test files\n\n## Volumes\n- Named volumes for persistence\n- Bind mounts for dev only, never production\n\n## Networking\n- Custom bridge networks, not host networking\n- Reference services by name in compose\n\n## Logging\n- Always stdout/stderr — never log to files inside container\n\n## Forbidden\n- No :latest tags in production\n- No ADD when COPY works\n- No root user in production\n- No secrets in build args or image layers\n</yakaai_skills>"}