Dockerfile review with fixes

What it does

Statically checks a Dockerfile for security, image size, reproducibility and cache problems, with line numbers.

• FROM without a tag or with :latest (digest pins and ARG defaults are taken into account)
• Final stage running as root (no USER, or last USER is root)
• apt-get without cleanup, update and install in separate RUNs, missing -y or --no-install-recommends, apk add without --no-cache, pip cache left in the layer
• COPY . . before installing dependencies, which defeats layer caching
• Secret-looking names in ENV/ARG, inline credentials in RUN, COPY of .env or key files
• Missing HEALTHCHECK, duplicate or shell-form CMD/ENTRYPOINT, ADD from URLs, piping curl into sh, sudo, chmod 777, EXPOSE 22, relative WORKDIR, missing .dockerignore and more
• Handles multi-stage builds, line continuations, # escape= and RUN <<EOF heredocs

How to use

python scripts/dockerfile_lint.py Dockerfile --json dockerfile-review.json

The agent confirms each finding in context (does the base image already set a non-root user, is it deployed on Kubernetes, and so on) and proposes a corrected Dockerfile or diff.

Requirements

• Python 3 (standard library only). Docker itself is not required.

Caveats

• Static checks only: no image pulls or builds, so the base image contents are not inspected.
• Heuristic rules can misfire on unusual syntax.
• If an already pushed image contained a secret, fixing the Dockerfile is not enough: rotate the secret.