docker · Docker
Docker CLI for AI Agents
Build, inspect, and run containers while separating local reads from destructive cleanup.
Install for an Agent
Choose an official installation path that matches the runtime. Pin a version for team or CI use, then record the version before the first task.
Structured Output for Reliable Automation
Prefer a machine-readable format. Treat stdout as the result channel and stderr as diagnostics so the agent can parse failures separately.
R0–R3 Command Risk Guide
Risk is assigned per command. R0 is local or remote read-only, R1 is reversible local write, R2 changes remote state, and R3 can be irreversible or production-impacting.
Read-only does not mean public
R0 only means the command does not change local or remote state. A read-only command may still return secrets, identity data, configuration, or production data. Expose only the minimum needed for the task, and never place it in logs, prompts, or commits.
How the Agent Readiness Score Is Built
Readiness describes how reliably an agent can operate the tool. It does not make every command safe and it does not replace an independent execution test.
Documentation indicates an agent-readiness score of 86/100. A bounded local smoke test is recorded for 29.2.0; review its limitations before relying on untested commands.
Generate a Skill or Agent Policy
Choose an agent and safety mode to generate a copyable artifact with installation, allowed commands, approval boundaries, and the evidence limitation.
---
name: docker-cli-agent-workflow
description: Use Docker CLI for container builds, image inspection, local services with explicit command risk and evidence boundaries.
---
# Docker CLI agent workflow
Use this skill when the task needs container builds, image inspection, local services, container logs.
## Evidence boundary
- Registry confidence: `verified`
- Documentation checked: `2026-07-10`
- Locally tested version: `29.2.0`
- Treat only the recorded executed checks as independently verified; every unlisted command remains documentation-only.
## Executed smoke checks
- `docker --version` — passed; exit 0. The recorded smoke check completed successfully.
- `docker ps --format "table {{.Names}}\t{{.Image}}\t{{.Status}}"` — passed; exit 0. The designated build host daemon responded and returned the active-container table without mutation.
## Installation
- Docker Desktop with Homebrew (macos): `brew install --cask docker`
- Docker Desktop with winget (windows): `winget install Docker.DockerDesktop`
## Authentication
- Methods: none
- Secret environment variables: none
- Minimum permissions: No service credential is required; restrict filesystem and network access to the task.
- Credential storage: No service credential is stored for this CLI.
- Never print, persist, or commit credential values.
## Allowed commands (read-only)
- `docker inspect CONTAINER` — R0: Reads container configuration and state as JSON.
## Commands requiring explicit approval (read-only)
- None recorded.
## Forbidden commands (read-only)
- R1 `docker build --tag app:local .` — Writes local image layers and can execute Dockerfile build steps.
- R3 `docker system prune --all --volumes` — Deletes unused images, containers, networks, and optionally volumes.
## Execution rules
1. Mode boundary: R0 exact commands may be used; R1, R2, and R3 commands are forbidden.
2. Confirm the selected account, project, context, database, namespace, or environment before any command.
3. Prefer structured output using `--format json`, `--format "{{json .}}"`.
4. Capture the exact command, exit code, stdout, and stderr separately.
5. A generated prefix policy must prompt unless that exact prefix is explicitly marked suffix-safe; do not infer safety from the executable name.
6. Never broaden credentials or disable safety controls to make a command succeed.
## Official sources
- [Docker CLI reference](https://docs.docker.com/reference/cli/docker/)
- [Docker CLI reference source repository](https://github.com/docker/cli)
Verification History and Official Evidence
CLI Finder records documentation review separately from real execution. Installation, help, exit codes, and output cannot be called Verified until they were run.