Containerizing apps with Docker

Description

Write, advise on, and review Dockerfiles and Compose setups — multi-stage builds, minimal and pinned base images, layer caching order, .dockerignore, non-root users, BuildKit secret mounts (no secrets in layers), exec-form entrypoints and signal handling, healthchecks, image scanning, Next.js standalone output, .NET chiseled/SDK images, Docker Compose for local dev (Postgres/Supabase, volumes, healthcheck-based depends_on), and resource limits. Use whenever a Dockerfile, compose.yaml/docker-compose.yml, or .dockerignore exists, or the user wants to containerize an app, shrink an image, speed up builds, fix "works locally but not in the container", or run services locally with Docker.