| name | infra-container-build-review |
| description | Container build review: Dockerfiles, image size, layers, SBOM, CVEs, reproducibility. |
Infra Container Build Review
Review image reproducibility, size, base image risk, secrets in builds, non-root runtime, SBOM/provenance, and scan gates.
Process
- Map the request path or operational path end to end.
- Read references/guide.md first; it is a routing index for focused reference files, then read only relevant sector files.
- Check rollout, rollback, observability, security, secrets, resource limits, and failure behavior.
- For review, report concrete production risks first, then maintainability issues.
- For debugging, collect evidence from config, allocation/container state, logs, metrics, and recent changes before proposing fixes.
Large PR Subagent Review
For broad or materially risky pull requests, recommend focused additional review only when independent expertise is likely to improve the verdict. Judge this from concrete risk, novelty, blast radius, reversibility, and context size—not file count or category matching alone. Small and conventional changes should remain one pragmatic pass.
When additional reviewers add value, split only by independent material surfaces. Each returns concrete evidence-based findings; the main agent removes duplicates and false positives and owns the proportional final verdict.
Evidence
Prefer job specs, Dockerfiles, proxy config, deployment manifests, logs, metrics, health checks, and runbook steps over assumptions.
