dockerfile-scanlisted

# Dockerfile Security Scan Parses a Dockerfile and flags common security and supply-chain problems, each with a concrete fix. Pure text analysis — no Docker daemon, no network, stdlib only. ## When to use this skill - "Review this Dockerfile for security issues." - "Is my container running as root?" - "Lint my Dockerfiles before I push them." ## What it checks - **Base image pinning** — missing tag or `:latest` (`docker-no-tag`, `docker-latest-tag`). - **Runs as root** — no `USER`, or final `USER` is root (`docker-root-user`). - **Remote code execution** — `curl|wget … | sh` (`docker-remote-exec`). - **Remote ADD** — `ADD http://…` without integrity checks (`docker-add-remote`). - **Hardcoded secrets** — `ENV`/`ARG` with a secret-looking name and a value (`docker-hardcoded-secret`). - **Loose permissions** — `chmod 777` (`docker-chmod-777`). - **sudo usage** in `RUN` (`docker-sudo`). ## How to run it ```bash # Scan one Dockerfile python skills/dockerfile-scan/scanner.py path/to/Dockerfile # Scan every Dockerfile under a directory, as JSON python skills/dockerfile-scan/scanner.py . --json ``` **Exit codes:** `0` clean · `1` findings present · `2` usage/IO error. ## Recommended workflow for Claude 1. Run the scan on the file or repo. 2. Present findings by severity, each with its one-line fix. 3. Offer a corrected Dockerfile snippet (pinned base image, non-root `USER`, `COPY` instead of remote `ADD`, secrets moved to runtime).