Skip to content
DevOps & Security

Dockerfile AST Security Hardener

Audit container definitions against modern CIS benchmarks, unprivileged non-root user execution, and pinned multi-stage build patterns.

Dockerfile AST Security Scanner & HardenerSecOps Guardian

রুট ইউজার, ফ্লোটিং ট্যাগ ও গোপন তথ্য স্ক্যান করে প্রোডাকশন-গ্রেড মাল্টি-স্টেজ হার্ডেনড ডকারফাইল তৈরি করুন

F
5/100 Score
SecOps Agent
Quick Presets:
Input DockerfilePaste any Dockerfile or Compose
Container executes as root user
critical

Without a non-root USER declaration, compromised processes inherit full root capabilities inside the container namespace.

Fix: Create and switch to an unprivileged user (e.g. `RUN addgroup -S appgroup && adduser -S appuser -G appgroup` followed by `USER appuser`).
Using mutable ':latest' image tag
high

Tags like `:latest` lead to non-deterministic production deployments and unexpected breaking changes or vulnerabilities.

Fix: Pin your base image to an immutable tag or SHA-256 digest (e.g. `FROM node:22.11.0-alpine3.20` or `@sha256:...`).
Hardcoded secret or credential in ENV
critical

Baking secrets into container image layers permanently leaks them to anyone with pull access via docker inspect.

Fix: Inject secrets at runtime using environment variables, Docker Secrets, or runtime KMS mounts (never bake into Dockerfile).
Missing HEALTHCHECK instruction
medium

Docker and container orchestrators (Kubernetes/Nomad) cannot detect internal deadlocks without a native probe.

Fix: Add `HEALTHCHECK --interval=30s --timeout=5s CMD curl -f http://localhost:PORT/health || exit 1`.
Uncached root COPY invalidates layer caching
medium

Copying all files before installing dependencies breaks Docker's build cache whenever any source file changes.

Fix: Copy dependency manifests first (`COPY package*.json ./`), run install, then copy source code.
Exposing privileged port (< 1024)
low

Binding to ports under 1024 requires elevated Linux capabilities (CAP_NET_BIND_SERVICE).

Fix: Expose unprivileged ports (3000, 8080, 8443) and let reverse proxies (Nginx/Cloudflare) handle port 80/443.