---
name: docker-compose-stack-review
description: "Reviews a Docker Compose file for service wiring, networks, volumes, healthchecks, and container security, and returns a corrected file with each change explained. Use when a Docker Compose file needs a check of service startup order, networks, volumes, healthchecks, and container security. Do not use for Kubernetes manifests or optimising a single Dockerfile. Related topics: devops, coding."
---

# Docker Compose Stack Review

Reviews a Docker Compose file for service wiring, networks, volumes, healthchecks, and container security, and returns a corrected file with each change explained.

## When to use

Use this skill when a Docker Compose file needs a check of service startup order, networks, volumes, healthchecks, and container security. Do not use it for Kubernetes manifests or optimising a single Dockerfile.

## Workflow

1. Ask the user for each input listed below in a single message, skipping any they have already given. Where options are listed, offer them, but accept other answers too.
2. Read every service and note its image, ports, volumes, networks, restart policy, and dependencies.
3. Check startup order uses healthchecks that test real readiness, and that restart policies suit the stated purpose.
4. Restrict published ports and put internal services on a private network, and confirm data services use named volumes.
5. Flag security risks such as privileged mode, root users, the Docker socket mount, and secrets inline in the file.
6. Return findings by severity and the corrected compose file with a comment on each change.

## Inputs

- **The compose file** (longer free text)
- **Purpose** (choose one: Local development, CI, Single-server production)
- **Services that hold data** (free text, e.g. "Postgres and Redis")
- **Focus** (choose any: Networks, Volumes, Healthchecks, Startup order, Secrets, Container security, Resource limits)
- **Exposed to the internet** (choose one: Yes, No)

## Output

A short findings list by severity, then the corrected compose file with a comment on every changed line.

## Prompt template

Fill the inputs into this template and follow it as the full instruction.

### Docker Compose Stack Review

Review this Compose stack and fix what is fragile or unsafe.

- The compose file: {{The compose file}}
- Purpose: {{Purpose}}
- Services that hold data: {{Services that hold data}}
- Focus: {{Focus}}
- Exposed to the internet: {{Exposed to the internet}}

Check how services start and recover first: depends_on should use condition service_healthy with a real healthcheck, and restart policies should match the purpose. Look at networking: only services that need outside access should publish ports, and internal services should sit on a private network. Look at volumes: data stores need named volumes, bind mounts in production are a risk, and a data volume must not be wiped by a routine down command. For secrets, move values out of the file into env files or secrets that are not committed. For security, flag privileged mode, running as root, writable root filesystems, host network mode, and mounting the Docker socket. Set memory and CPU limits so one service cannot starve the rest.

Return findings by severity, then the corrected compose file with a comment on each change.

## Pitfalls

- Using depends_on without a health condition, so the app starts before the database accepts connections.
- Publishing the database port to the host for convenience and leaving it open on a public server.
- Committing an env file with real credentials alongside the compose file.