Docker and Kubernetes AI Prompts: Containers, CI/CD, and Operations

How to Get the Best Results from These Prompts

• Specify your app language and base image preference (Alpine, Debian slim, distroless)
• Include the port your application listens on in every Dockerfile prompt
• For Kubernetes prompts, state your cloud provider and cluster version
• Paste your existing Dockerfile or deployment YAML when asking for modifications

Dockerfiles and Multi-Stage Builds (Prompts 1-12)

• Prompt 4: Write a Dockerfile for a Go application. Use golang:1.22-alpine to build a statically linked binary with CGO disabled. Copy only the binary into a distroless or scratch final image. Show how to add CA certificates so the binary can make HTTPS requests without a full OS layer.
• Prompt 5: Create a .dockerignore file for a Node.js project. Exclude node_modules, .git, test files, development config files, local environment files, coverage reports, and build artifacts that should not be in the image. Explain why each exclusion matters for build performance and security.
• Prompt 6: Write a Dockerfile for a monorepo with a frontend (React) and backend (Node.js) package. Use a shared base stage that installs root dependencies, then a frontend build stage, a backend build stage, and a final production stage that runs only the backend but serves the frontend static files from the same container.
• Prompt 7: Create a build argument pattern in a Dockerfile that allows switching between development and production builds using the same Dockerfile. Show how to pass the BUILD_ENV arg via docker build --build-arg and change the final CMD, installed packages, and environment variables based on its value.
• Prompt 8: Write a Dockerfile that caches pip install or npm install more efficiently using layer ordering. Show the correct order of COPY commands so that the dependency install layer is only invalidated when the requirements.txt or package.json changes, not when application source code changes.
• Prompt 9: Create a Dockerfile for a scheduled job container (a cronjob that runs a Python script). Include the cron daemon, mount the script from the COPY instruction, configure the crontab, and show how to redirect cron output to stdout so it is visible in docker logs.
• Prompt 10: Write a Dockerfile that runs database migrations on startup before launching the main application process. Use a shell entrypoint script that runs the migration command, checks the exit code, and only starts the application if migrations succeed. Show how to handle the case where the database is not yet ready.
• Prompt 11: Create a Docker image scanning step for a CI/CD pipeline using Trivy. Show the GitHub Actions step that builds the image, scans it for critical and high vulnerabilities, outputs a SARIF report, fails the pipeline if critical vulnerabilities are found, and ignores specific CVEs that have been reviewed and accepted.
• Prompt 12: Write a Dockerfile that uses BuildKit cache mounts to speed up repeated builds. Show how to use --mount=type=cache for the npm cache directory and how to enable BuildKit in the Docker build command and in CI/CD environments.

Docker Compose for Local Development (Prompts 13-22)

• Prompt 16: Create a docker-compose.yml with profiles so you can start only a subset of services. Define a core profile with the app and database, a monitoring profile with Prometheus and Grafana, and a full profile that starts everything. Show the docker compose --profile command syntax.
• Prompt 17: Write a docker-compose.yml for running end-to-end tests in CI. Use a service that runs the test suite, depends_on the app and database services, sets an exit code based on test pass/fail, and tears down all containers after the tests complete regardless of outcome.
• Prompt 18: Create a Docker Compose setup for local HTTPS development using a self-signed certificate and Nginx as a reverse proxy. Show how to generate the certificate, configure the Nginx container to use it, and trust the certificate on macOS and Linux for browser development.
• Prompt 19: Write a docker-compose.yml that mounts a local npm package as a volume for development. Show how to link a local package from a sibling directory into a Node.js container so changes to the package are immediately reflected without republishing.
• Prompt 20: Create a docker-compose.yml for running database migrations and seeds as a one-off command using docker compose run. Show how to run the migration container with the correct environment, wait for the database to be ready, and remove the container after it exits.
• Prompt 21: Write a Makefile with targets that wrap common docker compose commands: make up, make down, make logs, make shell (opens a bash shell in the app container), make migrate, make seed, and make clean (removes volumes and images). Include help text for each target.
• Prompt 22: Create a docker-compose.yml for local Kafka development using the Bitnami Kafka image. Include a Zookeeper service, configure Kafka with a single broker, set up a kafka-ui service for topic management, and show a Node.js service that connects to Kafka using kafkajs.

Kubernetes Core Resources (Prompts 23-36)

• Prompt 26: Create Kubernetes ConfigMap and Secret manifests for a Node.js application. Store non-sensitive config in the ConfigMap (APP_PORT, LOG_LEVEL, CORS_ORIGIN) and sensitive values in the Secret (DATABASE_URL, JWT_SECRET). Show how to inject them as environment variables in the Deployment and how to reference a specific key from each resource.
• Prompt 27: Write a Kubernetes HorizontalPodAutoscaler manifest that scales a Deployment between 2 and 10 replicas based on CPU utilization (target 70%) and custom metrics from Prometheus (requests per second, target 500 rps). Include stabilization windows to prevent rapid scale-down.
• Prompt 28: Create Kubernetes resource quota and limit range manifests for a namespace. The quota should cap the namespace at 4 CPU cores and 8Gi memory. The limit range should set default requests and limits for containers that do not specify them. Explain how these work together to prevent one team from consuming all cluster resources.
• Prompt 29: Write a Kubernetes CronJob manifest that runs a database cleanup job every day at 3am UTC. The job should use a dedicated service account, set a concurrencyPolicy of Forbid to prevent overlapping runs, keep the last 3 successful and 1 failed job history, and set a deadline of 30 minutes.
• Prompt 30: Create a Kubernetes Job manifest for running database migrations. The job should run before the Deployment using an initContainer pattern, use the same image as the application but a different command, fail the deployment if migrations fail, and ensure it only runs once per deployment using a unique name derived from the image tag.
• Prompt 31: Write Kubernetes PersistentVolume and PersistentVolumeClaim manifests for a PostgreSQL StatefulSet. Use the appropriate storage class for your cloud provider, request 20Gi of storage, set the access mode to ReadWriteOnce, and show how the StatefulSet references the PVC template for automatic provisioning per pod.
• Prompt 32: Create a Kubernetes NetworkPolicy that restricts traffic between namespaces. The API namespace can receive traffic from the ingress namespace only. The database namespace accepts connections from the API namespace only. All egress is allowed. Deny all ingress by default with a catch-all deny rule.
• Prompt 33: Write a Kubernetes PodDisruptionBudget that ensures at least 2 out of 3 replicas of a Deployment remain available during voluntary disruptions such as node maintenance or cluster upgrades. Explain when PodDisruptionBudgets apply and when they do not.
• Prompt 34: Create Kubernetes RBAC manifests: a ServiceAccount for a deployment pipeline, a Role that allows creating and updating Deployments and ConfigMaps in a specific namespace, a RoleBinding linking the ServiceAccount to the Role, and a ClusterRole for a read-only monitoring agent that can list pods and nodes across all namespaces.
• Prompt 35: Write a Kubernetes StatefulSet for a Redis single-node instance with a persistent volume. Include a headless Service for stable pod DNS names, a ConfigMap with the Redis configuration, resource limits, and a readiness probe that runs redis-cli ping.
• Prompt 36: Create Kubernetes liveness, readiness, and startup probes for an application that has a slow startup time (up to 60 seconds) but fast health checks once running. Show how to use the startupProbe to prevent the liveness probe from killing the pod during initialisation, and tune the failureThreshold and periodSeconds values.

CI/CD and Production Operations (Prompts 37-50)

• Prompt 40: Create a Kubernetes deployment strategy that uses readiness gates to hold traffic from a new pod until an external health check service confirms the instance is warmed up and ready to receive production traffic, beyond the standard readiness probe.
• Prompt 41: Write a Prometheus ServiceMonitor manifest for scraping metrics from a Node.js application using the prom-client library. Include the correct labels for the Prometheus Operator to discover the monitor, configure scrape interval and timeout, and add a relabeling rule to add the namespace as a metric label.
• Prompt 42: Create a Kubernetes pod security standard configuration that enforces the restricted policy across a namespace. Show the namespace labels required, what the restricted policy prevents, and how to create a legitimate exception for a specific workload that requires a capability the restricted policy would deny.
• Prompt 43: Write a Kubernetes init container pattern for a web application that waits for a PostgreSQL service to be ready before the main container starts. Use a lightweight Alpine image with pg_isready or a loop checking the database port, set appropriate timeouts, and explain why init containers are better than application-level retry loops for this use case.
• Prompt 44: Create a Kubernetes external secrets operator manifest that syncs secrets from AWS Secrets Manager into Kubernetes Secrets. Show the ClusterSecretStore connecting to AWS, an ExternalSecret that pulls a database connection string, and how the synced Kubernetes Secret is referenced in a Deployment.
• Prompt 45: Write a Kubernetes node affinity and taint/toleration configuration that schedules GPU workloads only on nodes with GPU hardware, prevents non-GPU workloads from running on those nodes, and allows a specific monitoring DaemonSet to run on all nodes including the GPU ones.
• Prompt 46: Create a Kubernetes vertical pod autoscaler manifest for a memory-intensive batch processing job. Set it to Off mode so it only recommends resource values without automatically applying them, and show how to query the VPA recommendations to tune your resource requests and limits.
• Prompt 47: Write a Kubernetes resource that uses a post-start lifecycle hook to register a service instance with an external service registry when a pod starts, and a pre-stop lifecycle hook to deregister it before the pod shuts down. Include the termination grace period configuration.
• Prompt 48: Create a Kubernetes ConfigMap that stores Nginx configuration and mount it into an Nginx container. Show how to update the ConfigMap to change the Nginx config and trigger a rolling restart of the pods without changing the Deployment manifest.
• Prompt 49: Write a Kubernetes pod topology spread constraints configuration that distributes 6 replicas of a Deployment evenly across 3 availability zones, with a maximum skew of 1 pod, and falls back gracefully when a zone has fewer available nodes.
• Prompt 50: Create a Kubernetes admission webhook manifest using a Mutating Admission Webhook that automatically injects a sidecar container into every pod in a specific namespace. Show the MutatingWebhookConfiguration, the webhook service, and the TLS certificate setup required for the API server to trust the webhook.

Why DevOps Engineers Benefit from AI Prompts

• Generate production-ready Dockerfiles with multi-stage builds and security hardening
• Write Kubernetes Deployment, Service, Ingress, and ConfigMap manifests in seconds
• Build GitHub Actions workflows for CI/CD, testing, and container registry pushes
• Set up Prometheus and Grafana monitoring configs for your services
• Debug Kubernetes pod failures and resource constraint issues with AI assistance

Docker Container and Dockerfile Prompts

Act as a Docker expert.

Task:
Write a production-ready Dockerfile for a Node.js TypeScript application.

Requirements:
- Multi-stage build: build stage compiles TypeScript, runtime stage runs the output
- Build stage: install all dependencies (devDependencies included), run tsc
- Runtime stage: copy dist/ and node_modules (production only), run as non-root user
- Base image: node:20-alpine for both stages
- Set NODE_ENV=production in runtime stage
- Expose port 3000
- Add HEALTHCHECK: curl -f http://localhost:3000/health every 30 seconds
- .dockerignore should exclude node_modules, .env, dist

App: Express.js API, entry point is dist/index.js after compilation

Docker Compose Multi-Service Prompts

Act as a Docker Compose expert.

Task:
Write a docker-compose.yml for a full-stack application with these services:

Services:
1. api - Node.js Express app (build from ./api, port 3000)
2. web - Next.js frontend (build from ./web, port 3001)
3. postgres - PostgreSQL 16 with persistent volume, port 5432
4. redis - Redis 7 alpine with persistent volume, port 6379

Requirements:
- api depends_on postgres and redis (with health checks)
- web depends_on api
- Shared network: app-network
- Load environment variables from .env file for api service
- Named volumes for postgres data and redis data
- Restart policy: unless-stopped for all services

Kubernetes Deployment and Service Prompts

Act as a Kubernetes expert.

Task:
Write Kubernetes Deployment and Service manifests for a Node.js API.

Deployment requirements:
- 3 replicas, rolling update (maxSurge: 1, maxUnavailable: 0)
- Resource requests: 100m CPU, 128Mi memory
- Resource limits: 500m CPU, 512Mi memory
- Liveness probe: GET /health, initial delay 15s, period 30s
- Readiness probe: GET /ready, initial delay 5s, period 10s
- Env vars: DB_URL and REDIS_URL from Secret named api-secrets
- Env var: NODE_ENV=production (literal value)

Service requirements:
- Type: ClusterIP
- Port 80 targeting container port 3000

App name: node-api, namespace: production, image: myregistry/node-api:v1.0.0

GitHub Actions CI/CD Pipeline Prompts

Act as a GitHub Actions expert.

Task:
Write a GitHub Actions workflow for a Node.js TypeScript application.

Trigger: push to main branch and pull_request to main

Jobs:
1. test: run on ubuntu-latest
   - Setup Node.js 20 with npm cache
   - npm ci
   - npm run lint
   - npm test

2. build-and-push: runs only on push to main, depends on test
   - Login to GitHub Container Registry (ghcr.io) using GITHUB_TOKEN
   - Build Docker image tagged with the git SHA and latest
   - Push both tags to ghcr.io

3. deploy: runs after build-and-push, push to main only
   - SSH into the VPS using SSH_PRIVATE_KEY secret
   - Pull the new image and restart the container via docker compose up -d

Secrets used: SSH_PRIVATE_KEY, VPS_HOST, VPS_USER

Kubernetes Debugging and Troubleshooting Prompts

Act as a Kubernetes debugging expert.

Task:
Diagnose why my pod is in CrashLoopBackOff and provide a fix.

Provide:
1. The most likely root causes for this error output
2. kubectl commands to gather more information
3. The specific fix for each likely cause
4. How to verify the fix worked

kubectl describe pod output:
[paste here]

kubectl logs output:
[paste here]

Deployment manifest:
[paste here]

Monitoring and Observability Prompts

Act as a Prometheus and Node.js observability expert.

Task:
Add Prometheus metrics to a Node.js Express application using prom-client.

Metrics to expose:
1. HTTP request duration histogram (labels: method, route, status_code)
2. HTTP requests total counter (labels: method, route, status_code)
3. Active connections gauge
4. Custom business metric: orders_created_total counter

Requirements:
- Expose metrics on GET /metrics endpoint
- Use Express middleware to instrument all routes automatically
- Register default Node.js process metrics (CPU, memory, GC)
- TypeScript types for all metric objects

Also provide the Prometheus scrape config for this service.

Security Hardening and Production Readiness Prompts

Act as a Kubernetes security expert.

Task:
Audit this Kubernetes Deployment manifest and list all security issues with fixes.

Check for:
1. Containers running as root (missing securityContext)
2. Missing read-only root filesystem
3. Privileged containers
4. Missing resource limits (potential DoS)
5. Secrets passed as environment variables vs mounted as files
6. Container image using :latest tag
7. Missing pod disruption budget
8. Service account with default RBAC permissions

For each issue: explain the risk, show the insecure config, show the fixed config.

Manifest to audit:
[paste your manifest here]