| name | container-scan |
| description | Dockerfile security review. Checks for running as root, leaked secrets in build layers, insecure base images, and missing best practices.
|
Dockerfile security review skill. No external tools needed -- this is
pure code review of Dockerfile content.
When to activate
Use this skill when the repository contains Dockerfile or
docker-compose.yaml files.
Scanner approach
Read each Dockerfile with read_file. Analyze line by line for the
following checks.
Checks
1. Running as root
- No
USER instruction means the container runs as root
USER root without switching to a non-root user later- Flag as high severity
2. Unpinned base image
FROM using :latest tag or no tag at all- Recommend pinning to a specific version or digest
3. Secret exposure
ENV or ARG instructions with password, secret, key, or token
values baked into the imageCOPY .env or COPY of credential files into the image- Flag as critical -- secrets persist in image layers
4. COPY vs ADD
ADD from remote URLs (use COPY + curl instead for
transparency and caching)ADD of archives without needing extraction (use COPY)
5. Missing HEALTHCHECK
- No
HEALTHCHECK instruction in the final stage
- Flag as low severity (best practice)
6. Package manager hygiene
apt-get install without --no-install-recommends- Missing
rm -rf /var/lib/apt/lists/* cleanup in the same layer
- Large image size from uncleaned package caches
7. Multi-stage builds
- Single-stage builds that include build tools (gcc, make, npm) in
the final image
- Recommend multi-stage to separate build and runtime
MUST flag
- No
USER instruction (runs as root by default)
- Secrets in
ENV or ARG instructions
COPY .env or COPY of known credential filesADD from remote URLs
MUST NOT flag
- Dev/CI Dockerfiles (Dockerfile.dev, Dockerfile.test, Dockerfile.ci)
scratch or distroless base images (no USER needed, no shell)- Multi-stage builds where root is only used in the builder stage
HEALTHCHECK absence in builder stages (only matters in final stage)
