{"slug":"dockerfile-review","name":"Dockerfile Review","version":"1.0.0","updated_at":"2026-10-19T07:15:14.863Z","use_when":"Reviews ONE Dockerfile for the five build mistakes that cost security or build time, and lists only those, one line each with a fixed code, the instruction, why it hurts and the fix - or exactly No findings. It catches a final image that runs as root, a base image with no tag or the latest tag, a secret passed through an argument, an environment value or a file copy so that it stays in the image history, source copied in before the dependencies are installed so the cache is lost on every edit, and the package index left in the layer after apt-get. It leaves out the safe look-alikes, such as a build secret mounted for one instruction, a tag pinned by digest, and root in a build stage that never ships. Use to review a Dockerfile before merging, to audit the images of a repository, or to speed up a slow image build.","not_for":"Image size, vulnerability scanning, health checks, signal handling, compose files and the contents of a dockerignore file. It reads one pasted Dockerfile and judges only what is written in it.","languages":["en"],"tags":["dockerfile","docker","containers","build-cache","secrets","code-review"],"category":"code","category_url":"https://aiskills402.com/categories/code","keywords":["runs as root","latest tag","image build","package index"],"faq":[{"q":"Fixed version tag on the base image: flagged or not?","a":"No. The skill states its policy: a fixed version tag is accepted, with or without a digest, and only a missing tag or the word latest is reported. A digest is described as the stronger form, as the Docker page says."},{"q":"Is root in a build stage reported?","a":"No. Only the stage that ships matters. A builder stage without a USER line is left alone, and so is a build secret mounted for a single instruction. An argument or an environment value that holds a token is reported."},{"q":"Which Dockerfiles went into the test?","a":"Three files: a Go service that copies its source before the module download and ships on a base with no tag, a Python image that takes a token as an argument, keeps the apt lists and has no user, and a clean two-stage Node image. Each file went to Claude Sonnet one time and to Claude Haiku one time, and on reading the answers both models met each expectation."},{"q":"What does a clean Dockerfile return?","a":"The sentence No findings. alone. A defect is one line with a code, the instruction, why it hurts and the fix; nothing is said about what was checked and found fine."}],"examples":[{"lang":"en","model":"claude-sonnet-5-5","input_excerpt":"FROM golang:1.23@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef AS build\nWORKDIR /src\nCOPY . .\nRUN go mod download\nRUN CGO_ENABLED=0 go build -o /out/server ./cmd/server\n\nFROM alpine\nRUN adduser -D -u 10001 app\nCOPY --from=build /out/server /usr/local/bin/server\nUSER app\nENTRYPOINT [\"/usr/local/bin/server\"]","output_excerpt":"UNPINNED-BASE — final stage `FROM alpine` — no tag, so the shipped base image changes under the same line — pin a version tag (for example `alpine:3.20`), optionally with a digest\nCACHE-ORDER — build stage `COPY . .` before `RUN go mod download` — every source edit repeats the module download — copy `go.mod` and `go.sum`, run `go mod download`, then copy the source"}],"page_url":"https://aiskills402.com/skills/dockerfile-review","markdown_url":"https://aiskills402.com/skills/dockerfile-review.md","image_url":"https://cdn.aiskills402.com/og/skills/dockerfile-review/f6dc0cf3.png","related_url":"https://api.aiskills402.com/v1/skills/dockerfile-review/related","purchases_count":null,"tested":{"date":"2026-10-19","strong":{"model":"claude-sonnet-5-5 (Claude Code alias \"sonnet\")","verdict":"Right on all 3 cases, read by hand. On the Go service it found the source copied before the module download and the final base with no tag, and left out the digest-pinned builder and the builder running as root. On the Python image it gave the missing user, the token argument and the apt lists, and left out the build secret mount. On the clean Node image it answered exactly No findings."},"weak":{"model":"claude-haiku-5-5 (Claude Code alias \"haiku\")","verdict":"Right on all 3 cases, read by hand. It matched the strong model on both planted files, with sound fixes, and kept the secret mount and the digest-pinned builder out. On the clean image it answered exactly No findings. Its Python answer was indented by four spaces, which the check accepts."},"note":"Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. Facts come from public documentation, read on 19 October 2026; there are no owner-measured facts.","report_url":null},"price_usd":"0.01","price_micro":10000,"size_bytes":6216,"sha256":"c37e9558d7c39340e860183c9af9dbd756184152341378cfd8014252003ad6ec","outline":["What the Docker documentation says, as published on 19 October 2026","The answer","The codes","Rules","Work in this order","Short example"],"license":{"summary":"Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing","holder":"Georgi Kalchev, aiskills402.com","url":"https://aiskills402.com/docs#license"},"buy_url":"https://api.aiskills402.com/v1/skills/dockerfile-review/file","redownload_url_template":"https://api.aiskills402.com/v1/purchases/{token}","mcp_tool":null,"payment":{"protocol":"x402","scheme":"exact","asset":"USDC","selling":true,"network":"base","network_caip2":"eip155:8453","pay_to":"0x8e37022edcf0f21cf3c9f93fee9d4d32519f36f4","facilitator":"cdp"},"seo_title":"Dockerfile Review for Secrets and Cache","seo_description":"Reviews one Dockerfile for root users, unpinned bases, secrets left in layers, lost build cache and apt lists. Pay $0.01 once, in USDC.","versions":[{"version":"1.0.0","date":"2026-10-19","changelog":"# Changelog\n\n## 1.0.0 — 2026-10-19\n\nFirst release, written in the light-test batch of 19 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description.\n\nTest: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. One wording change after the runs: the reason on the first line of the short example was reworded, because a tested answer repeated it word for word and that answer is the public example; the rules and codes are unchanged. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.\n"}]}