Every new project starts the same way: a bare repository, an empty cloud account, and a vague hope that the infrastructure will somehow assemble itself. In 2026 the smartest move is not to hire a DevOps engineer on day one, but to have a structured conversation with an LLM that already knows the syntax of Docker, Kubernetes, and Terraform better than most of us remember it. The catch is that a vague prompt returns vague YAML — and broken YAML costs more than a bad Stack Overflow answer.
This roundup is a working cheat sheet: 12 prompts you can copy, adapt, and run against any modern model (GPT-class, Claude, Gemini, or a local Llama). Each one is scoped to a specific startup-stage task — containerizing an app, bootstrapping a cluster, writing IaC, wiring CI/CD — and each comes with a usage example. Treat the model as a senior pair who never sleeps, but always verify output against official docs: Docker reference, Kubernetes API, Terraform Registry.
1. The Dockerfile Auditor
Task: turn a messy Dockerfile into a lean, cache-friendly one. Example: "Act as a Docker reviewer. Here is my Dockerfile [paste]. Rewrite it using a multi-stage build, pin base images by digest, run as a non-root user, and add a HEALTHCHECK. Explain each change in one line." The model will typically suggest FROM node:20-alpine AS build, COPY package*.json before source code for layer caching, and USER node. Always test with docker build --progress=plain to confirm cache hits.
2. The Compose Generator
Task: spin up a local stack (app + Postgres + Redis) in one file. Example: "Generate a docker-compose.yml for a Python FastAPI app, PostgreSQL 16, and Redis 7. Use named volumes, healthchecks with pg_isready, and depends_on: condition: service_healthy. Add an .env file template." This is the fastest way to get a reproducible dev environment; verify service names against the Compose spec.
3. The Image Slimmer
Task: cut image size. Example: "My image is 1.2 GB. Suggest concrete steps to reduce it: distroless base, .dockerignore, removing build tools, --no-install-recommends. Show the final Dockerfile." Distroless images from Google (gcr.io/distroless) routinely shave hundreds of megabytes.
4. The Kubernetes Manifest Scaffolder
Task: generate a Deployment + Service + Ingress trio. Example: "Write Kubernetes manifests for a stateless web app: 3 replicas, resource requests/limits, liveness and readiness probes on /healthz, an Ingress with TLS via cert-manager. Output YAML with apiVersion values valid for Kubernetes 1.30." Always run kubectl apply --dry-run=server before touching a live cluster.
5. The Security Baseline Prompt
Task: apply Pod Security Standards. Example: "Rewrite this Deployment to comply with the restricted Pod Security Standard: runAsNonRoot, readOnlyRootFilesystem, drop all capabilities, seccompProfile: RuntimeDefault. Cite the field names from the Kubernetes docs." The restricted profile is documented officially on kubernetes.io.
6. The Terraform Module Explainer
Task: understand and adapt a community module. Example: "Explain what terraform-aws-modules/vpc/aws creates, list its required inputs for a 3-AZ setup, and show a main.tf that provisions a VPC with private subnets and NAT gateways. Use Terraform 1.9 syntax." This turns the Registry into a guided tour instead of a wall of variables.
7. The State Backend Prompt
Task: set up remote state safely. Example: "Write the Terraform backend block for S3 with DynamoDB locking, plus the bootstrap config that creates the bucket and table. Add prevent_destroy where appropriate." Remote state with locking is the single most important habit from day one — see the Terraform docs on backends.
8. The Drift Detective
Task: interpret terraform plan output. Example: "Here is my plan output [paste]. Which changes are destructive? Group them by resource and tell me if any -/+ replacements could cause downtime." Models are excellent at reading the # forces replacement annotations that humans skim past.
9. The CI/CD Pipeline Builder
Task: get from commit to deploy. Example: "Write a GitHub Actions workflow: lint, test, build a Docker image, push to GHCR, and run helm upgrade --install on tag. Use OIDC for AWS auth, no long-lived keys." OIDC federation is the modern default for cloud auth in CI — documented in GitHub's OIDC guide.
10. The Helm Values Translator
Task: map raw manifests to a chart. Example: "Convert these Kubernetes manifests into a values.yaml for a generic Helm chart. Keep image tags parameterized and move environment-specific settings into values." Great for teams migrating from kubectl apply to Helm without rewriting everything.
11. The Cost Sanity Check
Task: catch expensive defaults before they bill you. Example: "Review this Terraform for cost traps: NAT gateways per AZ, oversized instances, unattached EBS volumes. Suggest cheaper alternatives and mark which are safe for a staging environment." Models can't see your bill, but they reliably flag the usual suspects.
12. The Incident Playbook Prompt
Task: prepare for the 3 a.m. page. Example: "Write a runbook for CrashLoopBackOff on a Deployment: diagnostic kubectl commands, common causes, and rollback steps. Format as a numbered checklist." Pair it with kubectl rollout undo and you have a starting point that beats panic.
| Stage | Prompt | Primary tool |
|---|---|---|
| Containerize | 1–3 | Docker |
| Orchestrate | 4–5, 10 | Kubernetes / Helm |
| Provision | 6–8, 11 | Terraform |
| Automate | 9, 12 | CI/CD |
A word of caution: AI-generated infrastructure is a draft, not a contract. Run terraform validate, kubectl diff, and docker scout before anything reaches production, and keep secrets out of prompts. Used this way, these 12 prompts won't replace a DevOps engineer — they'll let a small team act like one while the real hire focuses on architecture. Start with the auditor and the state backend today; your future self will thank you.
Comments