Dockerfile Security Linter — Top-5 Container Risks
Paste a Dockerfile and get an instant security review: baked secrets, unpinned base images, root containers, curl-pipe-to-shell and remote ADD — all checked locally.
Last reviewed 2026-10-19. Rates change — verify against the official sources linked below before relying on these figures.
What this is based on
- Checks the five highest-impact rules: literal secrets in ENV/ARG, mutable or untagged base images, missing USER (root), curl|wget piped to a shell, and ADD of remote URLs.
- Multi-stage builds are understood — stage aliases and 'scratch' are not flagged as unpinned.
- Everything runs locally in your browser — pasted content is never uploaded, logged or stored.
Why these five rules
Most container-image compromises trace back to a short list of mistakes: a credential baked into a layer (visible to anyone who pulls the image), a :latest tag that silently changes under you, a process running as root, an install script piped into a shell with no integrity check, or ADD quietly fetching remote code.
This linter focuses on exactly those. The full audit in the agent skill adds healthchecks, exposed ports, package pinning, .dockerignore coverage and more — but fixing these five removes most of the real-world risk.
What 'baked secret' means in practice
ENV API_KEY=abc123 looks harmless, but every image layer — including the one containing that value — is shipped to every registry that hosts the image. Deleting the line later does not remove it from history. Use BuildKit secrets (--mount=type=secret) for build-time credentials and runtime environment injection for the rest, and rotate anything that was ever committed.
Frequently asked questions
- Does it run my Dockerfile or contact a registry?
- No — it's a static pattern check on the pasted text. Nothing is executed or fetched.
- Is a FROM myorg/base:latest really a problem?
- Yes for reproducibility and supply-chain safety — the tag can be repointed at any time. Pin to a digest (@sha256:…) for deploys that matter.
- My base image is a scratch or a stage alias and it's still flagged?
- It shouldn't be — stage aliases defined by earlier FROM … AS lines and 'scratch' are recognized. If you hit a false positive, the open-source CLI version is the reference implementation to file against.
Related calculators
Paste code or a git diff and detect leaked credentials — AWS keys, GitHub and Slack tokens, private key blocks, hardcoded API keys and JWTs. Matched values are masked, never displayed.
Paste a GitHub Actions workflow YAML and catch the top-5 CI/CD risks: unpinned actions, script injection, pull_request_target abuse, secrets in run steps and write-all permissions.
Paste HTTP response headers and instantly see which security headers are missing — HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy — plus cookie flag and Server version checks.