hu-wentao/skills
Review, change, or deploy Docker Compose services with finite container limits, host minimum-resource protection, bounded builds, and safe startup.
npx skills add hu-wentao/skills --skill docker-compose-guardrails
Related neighbors and high-traction skills in the same topics — useful to compare before installing.
Guidance for distinctive, intentional visual design when building new UI or reshaping an existi…
866.4K installsBrowser automation CLI for AI agents. Use when the user needs to interact with websites, includ…
810.4K installsReview UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "chec…
617.3K installsBuild, deploy, evaluate, optimize, fine-tune, and manage Microsoft Foundry agents, models, and …
576.5K installsDebug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …
568.9K installsOther skills from hu-wentao/skills · top by installs.
npx skills add hu-wentao/skills
Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.
main
Files included with this skill beyond the listing page.
SKILL.md
3,038 B
SUMMARY.md
331 B
Treat an omitted resource limit as a defect for every long-running service unless a documented exception names its owner and duration.
uv run python <skill-root>/scripts/resolve.py --cwd <project-root> --task deployRead the returned instructions when instructionsid changes. Project resource classes, budgets, topology, and checks belong in .agents/skills-config/docker-compose-guardrails/; see [projectconfig.md](references/project_config.md). Detailed generic deployment policy is in [deploy.md](references/deploy.md).
For each long-running service set finite service-level cpus, memlimit, and pidslimit, plus an appropriate restart policy. Do not rely only on deploy.resources; local Compose enforcement varies. Values may be provisional when workload evidence is absent, but name the measurement that will refine them.
Allow unbounded resources only for a short-lived manual task with an explicit reason and owner. Compose limits are ceilings, not minimum guarantees. When selected workloads need minimum protection, also apply the resolved host cgroup policy and verify every relevant ancestor.
Reject build commands in a long-running service command or entrypoint. Build artifacts in the Dockerfile, normally through a multi-stage build, and start only the runtime artifact. A manual short-lived build task must have no restart policy and a documented owner.
Bound the builder daemon and executor containers at the host layer or use a reviewed remote builder. Stop when admission or pressure gates fail; client-process limits alone are insufficient.
python3 <skill-root>/scripts/check_compose_guardrails.py -f compose.yaml
docker compose -f compose.yaml configResolve errors and review warnings. Run resolved preflight commands before live changes; resolution declares commands but never executes them.
After docker compose up -d, verify effective Docker HostConfig:
docker inspect <container> --format 'Memory={{.HostConfig.Memory}} NanoCPUs={{.HostConfig.NanoCpus}} PidsLimit={{.HostConfig.PidsLimit}} Restart={{.HostConfig.RestartPolicy.Name}}'Constrained services require nonzero memory/CPU and a finite PID limit. For minimum-resource protection, verify the leaf and ancestor cgroups, resource class, memory controls, CPU control, and builder containment after every recreate.
For each service report resource class, configured and effective CPU/memory/PID/restart values, host-cgroup checks, admission/build boundaries, and every exception with reason, owner, and expiry.