docker-review

name	docker-review
description	Reviews Dockerfiles and container configs for security and best practices. Use when reviewing or creating Docker configurations.

When reviewing a Dockerfile, check each of these areas:

Multi-Stage Builds

• Separate build stage from runtime stage
• Build stage installs dev dependencies and compiles; runtime stage copies only artifacts
• Final image should not contain build tools, source code, or dev dependencies

Non-Root User

• Runtime stage must create and switch to a non-root user
• Use USER directive after installing packages but before COPY/CMD
• Verify file permissions allow the non-root user to run the application

Minimal Base Image

• Use alpine or slim variants (e.g., python:3.12-slim, node:20-alpine)
• Avoid latest tag — pin to a specific version
• Justify any use of full-size base images

.dockerignore

• A .dockerignore file must exist alongside the Dockerfile
• Must exclude: .git, node_modules, pycache, .env, *.md, tests/
• Verify no secrets or large unnecessary files would be included in the build context

No Secrets in Build

• No secrets in ENV, ARG, or COPY instructions
• No .env files copied into the image
• No API keys, passwords, or tokens in the Dockerfile

Health Checks

• HEALTHCHECK instruction must be present
• Use curl or a lightweight check against the application's health endpoint
• Set appropriate interval, timeout, and retries