docker-2025-features by josiahsiegel/claude-plugin-marketplace
npx skills add https://github.com/josiahsiegel/claude-plugin-marketplace --skill docker-2025-features强制要求:在 Windows 上始终对文件路径使用反斜杠
在 Windows 上使用 Edit 或 Write 工具时,必须在文件路径中使用反斜杠 (\),而不是正斜杠 (/)。
示例:
D:/repos/project/file.tsxD:\repos\project\file.tsx这适用于:
除非用户明确要求,否则切勿创建新的文档文件。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
此技能涵盖了 2025 年引入的最新 Docker 特性,确保您能利用尖端功能提升安全性、性能和开发体验。
功能描述: 将镜像目录结构直接挂载到容器内部,无需提取到卷。
核心能力:
使用方法:
# 挂载整个镜像
docker run --rm \
--mount type=image,source=mydata:latest,target=/data \
alpine ls -la /data
# 从镜像挂载特定路径
docker run --rm \
--mount type=image,source=mydata:latest,image-subpath=/config,target=/app/config \
alpine cat /app/config/settings.json
使用场景:
功能描述: 调试端点现在可通过标准版本化 API 路径访问。
之前: 仅可通过根路径访问,如 /debug/vars
现在: 也可通过 /v1.48/debug/vars、/v1.48/debug/pprof/* 访问
可用端点:
/v1.48/debug/vars - 运行时变量/v1.48/debug/pprof/ - 性能分析索引/v1.48/debug/pprof/cmdline - 命令行/v1.48/debug/pprof/profile - CPU 性能分析/v1.48/debug/pprof/trace - 执行跟踪/v1.48/debug/pprof/goroutine - Goroutine 堆栈使用方法:
# 通过版本化 API 访问调试变量
curl --unix-socket /var/run/docker.sock http://localhost/v1.48/debug/vars
# 获取 CPU 性能分析数据
curl --unix-socket /var/run/docker.sock http://localhost/v1.48/debug/pprof/profile?seconds=30 > profile.out
Engine 28.3.3 中的最新版本:
CVE-2025-54388: 修复了 firewalld 重载问题,该问题导致即使容器端口绑定到回环地址,仍可能从本地网络访问已发布的容器端口。
影响: 对于绑定到 127.0.0.1 并期望仅限本地主机访问的容器至关重要。
Raspberry Pi OS 32 位 (armhf):
功能描述: 模型上下文协议 (MCP) 服务器目录,包含 100 多个经过验证的容器化工具。
核心能力:
访问方式:
使用场景:
新增内容:
docker model requests 命令使用方法:
# 列出正在运行的模型
docker model ls
# 查看模型详情 (新增:模型卡片)
docker model inspect llama2-7b
# 监控请求和响应 (新增)
docker model requests llama2-7b
# 性能指标
docker stats $(docker model ls -q)
功能描述: Docker Desktop 自动更新内部组件,无需完全重启应用程序。
优势:
配置:
CVE-2025-10657 (v4.47): 修复了在 4.46.0 版本中,增强容器隔离的 Docker Socket 命令限制不起作用的问题。
CVE-2025-9074 (v4.46): 修复了恶意容器逃逸漏洞,该漏洞允许在未挂载 socket 的情况下访问 Docker Engine。
功能描述: 集成到 Docker Desktop 和 CLI 中的 AI 驱动助手,用于智能容器开发。
核心能力:
使用方法:
# 在 Docker Desktop 设置 > 功能 > Docker AI (Beta) 中启用
# 用自然语言提问
"优化我的 Python Dockerfile"
"为什么我的容器在重启?"
"建议安全的 nginx 配置"
本地模型运行器:
功能描述: 额外的安全层,用于限制 Docker socket 访问和容器逃逸途径。
安全优势:
启用方法:
# Docker Desktop 设置 > 安全 > 增强容器隔离
# 或通过 CLI:
docker desktop settings set enhancedContainerIsolation=true
使用场景:
兼容性:
功能描述: 内置的 AI 模型执行引擎,允许开发者在本地运行大型语言模型。
特性:
使用方法:
# 通过 Docker Desktop 扩展安装
# 或使用 CLI:
docker model run llama2-7b
# 查看正在运行的模型:
docker model ls
# 停止模型:
docker model stop MODEL_ID
优势:
功能描述: 直接在 Docker Desktop 中使用多节点集群测试 Kubernetes 部署。
之前: 仅限单节点 现在: 2-5 节点集群,用于更真实的测试
启用方法:
# Docker Desktop 设置 > Kubernetes > 启用多节点
# 指定节点数量 (2-5)
使用场景:
功能描述: 用于复杂多目标构建的高级构建编排工具。
之前: 实验性功能 现在: 正式发布,可用于生产环境
特性:
# docker-bake.hcl
target "app" {
context = "."
dockerfile = "Dockerfile"
tags = ["myapp:latest"]
platforms = ["linux/amd64", "linux/arm64"]
cache-from = ["type=registry,ref=myapp:cache"]
cache-to = ["type=registry,ref=myapp:cache,mode=max"]
}
target "test" {
inherits = ["app"]
target = "test"
output = ["type=local,dest=./coverage"]
}
# 构建所有目标
docker buildx bake
# 构建特定目标
docker buildx bake test
1. 更快的容器启动:
2. 更好的资源管理:
3. 存储驱动增强:
1. 增强的 Seccomp 配置文件:
{
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_AARCH64"],
"syscalls": [
{
"names": ["read", "write", "exit"],
"action": "SCMP_ACT_ALLOW"
}
]
}
2. 改进的 AppArmor 集成:
3. 用户命名空间改进:
功能描述: 通过单个命令将本地的 compose.yaml 文件转换为 Kubernetes 清单文件。
核心能力:
使用方法:
# 将 Compose 文件转换为 Kubernetes 清单
docker compose convert --format kubernetes > k8s-manifests.yaml
# 或直接使用 compose-bridge
docker compose-bridge convert docker-compose.yml
# 应用到 Kubernetes 集群
kubectl apply -f k8s-manifests.yaml
转换示例:
# docker-compose.yml
services:
web:
image: nginx:latest
ports:
- "80:80"
volumes:
- data:/usr/share/nginx/html
volumes:
data:
# 转换为 Kubernetes:
# - 'web' 服务的 Deployment
# - 暴露端口 80 的 Service
# - 'data' 的 PersistentVolumeClaim
使用场景:
1. 版本字段已过时:
# 旧 (已弃用):
version: '3.8'
services:
app:
image: nginx
# 新 (2025):
services:
app:
image: nginx
version 字段现在会被忽略,可以省略。
1. Develop Watch 支持 initial_sync:
services:
app:
build: .
develop:
watch:
- action: sync
path: ./src
target: /app/src
initial_sync: full # 新增:启动时同步所有文件
2. Volume 类型:Image:
services:
app:
volumes:
- type: image
source: mydata:latest
target: /data
read_only: true
3. Build Print:
# 调试复杂的构建配置
docker compose build --print > build-config.json
4. Config No-Env-Resolution:
# 查看原始配置,不进行环境变量替换
docker compose config --no-env-resolution
5. Watch with Prune:
# 在 watch 期间自动清理未使用的资源
docker compose watch --prune
6. Run with Quiet:
# 减少输出噪音
docker compose run --quiet app npm test
1. Git SHA-256 支持:
# 使用基于 SHA-256 的仓库
ADD https://github.com/user/repo#sha256:abc123... /src
2. 增强的 COPY/ADD --exclude:
# 现已正式可用 (之前仅为实验室功能)
COPY --exclude=*.test.js --exclude=*.md . /app
3. ADD --unpack 支持 --chown:
# 一步完成解压和设置所有权
ADD --unpack=true --chown=appuser:appgroup archive.tar.gz /app
4. Git 查询参数:
# 细粒度 Git 克隆控制
ADD https://github.com/user/repo.git?depth=1&branch=main /src
5. 镜像校验和验证:
# 验证镜像完整性
FROM alpine:3.19@sha256:abc123...
# BuildKit 自动验证校验和
1. 改进的前端验证:
# 始终使用官方的 Docker 前端
# syntax=docker/dockerfile:1
# 使用摘要固定以获得最大安全性
# syntax=docker/dockerfile:1@sha256:ac85f380a63b13dfcefa89046420e1781752bab202122f8f50032edf31be0021
2. 远程缓存改进:
应该:
不应该:
应该:
不应该:
应该:
不应该:
1. 备份现有配置:
# 导出当前设置
docker context export desktop-linux > backup.tar
2. 更新 Docker Desktop:
3. 启用新特性:
# 启用 AI 助手 (beta)
docker desktop settings set enableAI=true
# 启用增强容器隔离
docker desktop settings set enhancedContainerIsolation=true
4. 测试现有容器:
# 验证容器在 ECI 下正常工作
docker compose up -d
docker compose ps
docker compose logs
之前:
version: '3.8'
services:
app:
image: nginx:latest
volumes:
- data:/data
volumes:
data:
之后:
services:
app:
image: nginx:1.26.0 # 指定版本
volumes:
- data:/data
develop:
watch:
- action: sync
path: ./config
target: /etc/nginx/conf.d
initial_sync: full
volumes:
data:
driver: local
问题: AI 助手无响应 解决方案:
# 检查 Docker Desktop 版本
docker version
# 确保启用了 beta 功能
docker desktop settings get enableAI
# 重启 Docker Desktop
问题: Model Runner 运行缓慢 解决方案:
问题: 容器因 socket 权限错误而失败 解决方案:
# 识别 socket 依赖
docker inspect CONTAINER | grep -i socket
# 如果确实需要,显式添加 socket 访问权限
# (在 docker-compose.yml 注释中记录原因)
docker run -v /var/run/docker.sock:/var/run/docker.sock ...
问题: ECI 破坏了 CI/CD 流水线 解决方案:
docker desktop settings set enhancedContainerIsolation=false问题: "version field is obsolete" 警告 解决方案:
# 直接移除 version 字段
# 旧:
version: '3.8'
services: ...
# 新:
services: ...
问题: 带有 initial_sync 的 watch 失败 解决方案:
# 检查文件权限
ls -la ./src
# 确保路径正确
docker compose config | grep -A 5 watch
# 验证同步目标在容器中存在
docker compose exec app ls -la /app/src
立即采用 (可用于生产环境):
测试阶段 (Beta 但稳定):
评估阶段 (安全关键型):
此技能确保您紧跟 Docker 2025 年的发展,同时保持稳定性、安全性和生产就绪性。
每周安装次数
81
仓库
GitHub 星标数
21
首次出现时间
2026 年 1 月 23 日
安全审计
已安装于
claude-code64
opencode64
gemini-cli62
codex60
cursor57
github-copilot54
MANDATORY: Always Use Backslashes on Windows for File Paths
When using Edit or Write tools on Windows, you MUST use backslashes (\) in file paths, NOT forward slashes (/).
Examples:
D:/repos/project/file.tsxD:\repos\project\file.tsxThis applies to:
NEVER create new documentation files unless explicitly requested by the user.
This skill covers the latest Docker features introduced in 2025, ensuring you leverage cutting-edge capabilities for security, performance, and developer experience.
What it is: Mount an image directory structure directly inside a container without extracting to a volume.
Key capabilities:
How to use:
# Mount entire image
docker run --rm \
--mount type=image,source=mydata:latest,target=/data \
alpine ls -la /data
# Mount specific path from image
docker run --rm \
--mount type=image,source=mydata:latest,image-subpath=/config,target=/app/config \
alpine cat /app/config/settings.json
Use cases:
What it is: Debug endpoints now accessible through standard versioned API paths.
Previously: Only available at root paths like /debug/vars Now: Also accessible at /v1.48/debug/vars, /v1.48/debug/pprof/*
Available endpoints:
/v1.48/debug/vars - Runtime variables/v1.48/debug/pprof/ - Profiling index/v1.48/debug/pprof/cmdline - Command line/v1.48/debug/pprof/profile - CPU profile/v1.48/debug/pprof/trace - Execution trace/v1.48/debug/pprof/goroutine - Goroutine stacksHow to use:
# Access debug vars through versioned API
curl --unix-socket /var/run/docker.sock http://localhost/v1.48/debug/vars
# Get CPU profile
curl --unix-socket /var/run/docker.sock http://localhost/v1.48/debug/pprof/profile?seconds=30 > profile.out
Latest versions in Engine 28.3.3:
CVE-2025-54388: Fixed firewalld reload issue where published container ports could be accessed from local network even when bound to loopback.
Impact: Critical for containers binding to 127.0.0.1 expecting localhost-only access.
Raspberry Pi OS 32-bit (armhf):
What it is: Model Context Protocol (MCP) server catalog with 100+ verified, containerized tools.
Key capabilities:
How to access:
Use cases:
What's new:
docker model requests command for monitoringHow to use:
# List running models
docker model ls
# View model details (new: model cards)
docker model inspect llama2-7b
# Monitor requests and responses (NEW)
docker model requests llama2-7b
# Performance metrics
docker stats $(docker model ls -q)
What it is: Docker Desktop automatically updates internal components without requiring full application restart.
Benefits:
Configuration:
CVE-2025-10657 (v4.47): Fixed Enhanced Container Isolation Docker Socket command restrictions not working in 4.46.0.
CVE-2025-9074 (v4.46): Fixed malicious container escape allowing Docker Engine access without mounted socket.
What it is: AI-powered assistant integrated into Docker Desktop and CLI for intelligent container development.
Key capabilities:
How to use:
# Enable in Docker Desktop Settings > Features > Docker AI (Beta)
# Ask questions in natural language
"Optimize my Python Dockerfile"
"Why is my container restarting?"
"Suggest secure nginx configuration"
Local Model Runner:
What it is: Additional security layer that restricts Docker socket access and container escape vectors.
Security benefits:
How to enable:
# Docker Desktop Settings > Security > Enhanced Container Isolation
# Or via CLI:
docker desktop settings set enhancedContainerIsolation=true
Use cases:
Compatibility:
What it is: Built-in AI model execution engine allowing developers to run large language models locally.
Features:
How to use:
# Install via Docker Desktop Extensions
# Or use CLI:
docker model run llama2-7b
# View running models:
docker model ls
# Stop model:
docker model stop MODEL_ID
Benefits:
What it is: Test Kubernetes deployments with multi-node clusters directly in Docker Desktop.
Previously: Single-node only Now: 2-5 node clusters for realistic testing
How to enable:
# Docker Desktop Settings > Kubernetes > Enable multi-node
# Specify node count (2-5)
Use cases:
What it is: High-level build orchestration tool for complex multi-target builds.
Previously: Experimental Now: Generally available and production-ready
Features:
# docker-bake.hcl
target "app" {
context = "."
dockerfile = "Dockerfile"
tags = ["myapp:latest"]
platforms = ["linux/amd64", "linux/arm64"]
cache-from = ["type=registry,ref=myapp:cache"]
cache-to = ["type=registry,ref=myapp:cache,mode=max"]
}
target "test" {
inherits = ["app"]
target = "test"
output = ["type=local,dest=./coverage"]
}
# Build all targets
docker buildx bake
# Build specific target
docker buildx bake test
1. Faster Container Startup:
2. Better Resource Management:
3. Storage Driver Enhancements:
1. Enhanced Seccomp Profiles:
{
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_AARCH64"],
"syscalls": [
{
"names": ["read", "write", "exit"],
"action": "SCMP_ACT_ALLOW"
}
]
}
2. Improved AppArmor Integration:
3. User Namespace Improvements:
What it is: Convert local compose.yaml files to Kubernetes manifests in a single command.
Key capabilities:
How to use:
# Convert compose file to Kubernetes manifests
docker compose convert --format kubernetes > k8s-manifests.yaml
# Or use compose-bridge directly
docker compose-bridge convert docker-compose.yml
# Apply to Kubernetes cluster
kubectl apply -f k8s-manifests.yaml
Example conversion:
# docker-compose.yml
services:
web:
image: nginx:latest
ports:
- "80:80"
volumes:
- data:/usr/share/nginx/html
volumes:
data:
# Converts to Kubernetes:
# - Deployment for 'web' service
# - Service exposing port 80
# - PersistentVolumeClaim for 'data'
Use cases:
1. Version Field Obsolete:
# OLD (deprecated):
version: '3.8'
services:
app:
image: nginx
# NEW (2025):
services:
app:
image: nginx
The version field is now ignored and can be omitted.
1. Develop Watch with initial_sync:
services:
app:
build: .
develop:
watch:
- action: sync
path: ./src
target: /app/src
initial_sync: full # NEW: Sync all files on start
2. Volume Type: Image:
services:
app:
volumes:
- type: image
source: mydata:latest
target: /data
read_only: true
3. Build Print:
# Debug complex build configurations
docker compose build --print > build-config.json
4. Config No-Env-Resolution:
# View raw config without environment variable substitution
docker compose config --no-env-resolution
5. Watch with Prune:
# Automatically prune unused resources during watch
docker compose watch --prune
6. Run with Quiet:
# Reduce output noise
docker compose run --quiet app npm test
1. Git SHA-256 Support:
# Use SHA-256 based repositories
ADD https://github.com/user/repo#sha256:abc123... /src
2. Enhanced COPY/ADD --exclude:
# Now generally available (was labs-only)
COPY --exclude=*.test.js --exclude=*.md . /app
3. ADD --unpack with --chown:
# Extract and set ownership in one step
ADD --unpack=true --chown=appuser:appgroup archive.tar.gz /app
4. Git Query Parameters:
# Fine-grained Git clone control
ADD https://github.com/user/repo.git?depth=1&branch=main /src
5. Image Checksum Verification:
# Verify image integrity
FROM alpine:3.19@sha256:abc123...
# BuildKit verifies checksum automatically
1. Improved Frontend Verification:
# Always use official Docker frontends
# syntax=docker/dockerfile:1
# Pin with digest for maximum security
# syntax=docker/dockerfile:1@sha256:ac85f380a63b13dfcefa89046420e1781752bab202122f8f50032edf31be0021
2. Remote Cache Improvements:
DO:
DON'T:
DO:
DON'T:
DO:
DON'T:
1. Backup existing configurations:
# Export current settings
docker context export desktop-linux > backup.tar
2. Update Docker Desktop:
3. Enable new features:
# Enable AI Assistant (beta)
docker desktop settings set enableAI=true
# Enable Enhanced Container Isolation
docker desktop settings set enhancedContainerIsolation=true
4. Test existing containers:
# Verify containers work with ECI
docker compose up -d
docker compose ps
docker compose logs
Before:
version: '3.8'
services:
app:
image: nginx:latest
volumes:
- data:/data
volumes:
data:
After:
services:
app:
image: nginx:1.26.0 # Specific version
volumes:
- data:/data
develop:
watch:
- action: sync
path: ./config
target: /etc/nginx/conf.d
initial_sync: full
volumes:
data:
driver: local
Problem: AI Assistant not responding Solution:
# Check Docker Desktop version
docker version
# Ensure beta features enabled
docker desktop settings get enableAI
# Restart Docker Desktop
Problem: Model Runner slow Solution:
Problem: Container fails with socket permission error Solution:
# Identify socket dependencies
docker inspect CONTAINER | grep -i socket
# If truly needed, add socket access explicitly
# (Document why in docker-compose.yml comments)
docker run -v /var/run/docker.sock:/var/run/docker.sock ...
Problem: ECI breaks CI/CD pipeline Solution:
docker desktop settings set enhancedContainerIsolation=falseProblem: "version field is obsolete" warning Solution:
# Simply remove the version field
# OLD:
version: '3.8'
services: ...
# NEW:
services: ...
Problem: watch with initial_sync fails Solution:
# Check file permissions
ls -la ./src
# Ensure paths are correct
docker compose config | grep -A 5 watch
# Verify sync target exists in container
docker compose exec app ls -la /app/src
Immediate (Production-Ready):
Testing (Beta but Stable):
Evaluation (Security-Critical):
This skill ensures you stay current with Docker's 2025 evolution while maintaining stability, security, and production-readiness.
Weekly Installs
81
Repository
GitHub Stars
21
First Seen
Jan 23, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
claude-code64
opencode64
gemini-cli62
codex60
cursor57
github-copilot54
Azure 升级评估与自动化工具 - 轻松迁移 Functions 计划、托管层级和 SKU
104,900 周安装
Android无障碍功能检查清单:内容描述、触摸目标、色彩对比度、焦点语义完整指南
202 周安装
Magento 2 Hyvä 主题列表工具 - 快速发现项目中的所有 Hyvä 主题路径
213 周安装
floor-plan:基于Drawio的Markdown平面图与布局生成器,快速创建家居/办公室设计图
205 周安装
LinkedIn广告健康度审计工具 - 25项检查清单,优化B2B广告效果与ROI
202 周安装
oh-my-claudecode技能管理CLI教程:创建、列表、删除技能命令详解
206 周安装
Hyvä子主题创建工具 - 快速生成Magento 2 Hyvä主题目录与配置文件
209 周安装