From devops-skills
Validates Dockerfiles for syntax, security vulnerabilities, best practices, and build optimizations with severity-classified findings.
npx claudepluginhub akin-ozer/cc-devops-skills --plugin devops-skillsThis skill uses the workspace's default tool permissions.
Validate Dockerfiles with deterministic stages, clear severity reporting, and explicit fallbacks when tools or network access are constrained.
examples/bad-example.Dockerfileexamples/golang-distroless.Dockerfileexamples/good-example.Dockerfileexamples/python-optimized.Dockerfileexamples/security-issues.Dockerfilereferences/docker_best_practices.mdreferences/optimization_guide.mdreferences/security_checklist.mdscripts/dockerfile-validate.shscripts/test_validate.shtests/fixtures/copy-before-yarn-lock-read.Dockerfiletests/fixtures/copy-before-yarn.Dockerfiletests/fixtures/from-platform-nonroot.Dockerfiletests/test_regression.shSearches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.
Searches prompts.chat for AI prompt templates by keyword or category, retrieves by ID with variable handling, and improves prompts via AI. Use for discovering or enhancing prompts.
Checks Next.js compilation errors using a running Turbopack dev server after code edits. Fixes actionable issues before reporting complete. Replaces `next build`.
Validate Dockerfiles with deterministic stages, clear severity reporting, and explicit fallbacks when tools or network access are constrained.
Use this skill when the user asks for tasks like:
Use this skill for:
Do not use this skill for:
dockerfile-generator)scripts/dockerfile-validate.shreferences/security_checklist.mdreferences/optimization_guide.mdreferences/docker_best_practices.mdexamples/*.DockerfileRun these steps in order. Do not skip steps unless a documented fallback branch applies.
Assume repo root as working directory:
cd /path/to/repo
SKILL_DIR="devops-skills-plugin/skills/dockerfile-validator"
TARGET_DOCKERFILE="Dockerfile" # replace when user provides a path
Validate inputs before running tools:
test -f "$SKILL_DIR/scripts/dockerfile-validate.sh"
test -f "$TARGET_DOCKERFILE"
If either check fails, stop and report the exact missing path.
Use explicit file-read commands (not abstract "Read tool" wording):
sed -n '1,220p' "$TARGET_DOCKERFILE"
If needed for long files:
sed -n '220,440p' "$TARGET_DOCKERFILE"
Primary command:
bash "$SKILL_DIR/scripts/dockerfile-validate.sh" "$TARGET_DOCKERFILE"
Optional captured run for structured reporting:
bash "$SKILL_DIR/scripts/dockerfile-validate.sh" "$TARGET_DOCKERFILE" | tee /tmp/dockerfile-validator.out
Use this standard severity model:
Critical
High
USER)Medium
:latest image tags, missing pinning, cache-cleanup missesLow
If validation has no actionable findings:
Use fast path when all are true:
Only read references that match actual findings. Read each required file once.
Issue-to-reference mapping:
| Issue category | Trigger examples | Read this file |
|---|---|---|
| Secrets, root user, exposed sensitive ports, hardening gaps | CKV_DOCKER_*, hardcoded token/password, root runtime | references/security_checklist.md |
Image size, layer count, multi-stage opportunities, cache efficiency, .dockerignore gaps | too many RUN, single-stage with build deps, cache misses | references/optimization_guide.md |
| Tag pinning, instruction usage, COPY vs ADD, WORKDIR/CMD/ENTRYPOINT conventions | :latest, unpinned packages, instruction-level best practices | references/docker_best_practices.md |
Explicit read commands:
sed -n '1,220p' "$SKILL_DIR/references/security_checklist.md"
sed -n '1,220p' "$SKILL_DIR/references/optimization_guide.md"
sed -n '1,220p' "$SKILL_DIR/references/docker_best_practices.md"
For targeted extraction:
rg -n "USER|secrets|EXPOSE|HEALTHCHECK" "$SKILL_DIR/references/security_checklist.md"
rg -n "multi-stage|cache|layer|dockerignore" "$SKILL_DIR/references/optimization_guide.md"
rg -n "FROM|COPY|ADD|WORKDIR|CMD|ENTRYPOINT|latest" "$SKILL_DIR/references/docker_best_practices.md"
Use this template for every non-fast-path run:
## Dockerfile Validation Report
- Target: <path>
- Command: `bash <skill-script> <target>`
- Overall result: PASS | FAIL | PARTIAL (fallback)
### Critical
- <issue or `None`>
### High
- <issue or `None`>
### Medium
- <issue or `None`>
### Low
- <issue or `None`>
### Recommended Fixes
- <specific code-level fix per actionable issue>
### References Used
- <list only files actually read>
### Fallbacks Used
- `None` or exact fallback branch + reason
After reporting:
When the primary script cannot complete, use deterministic fallback branches and report them.
Condition:
Action:
# Basic syntax signal (if Docker is available)
DOCKERFILE_DIR="$(dirname "$TARGET_DOCKERFILE")"
docker build --no-cache -f "$TARGET_DOCKERFILE" "$DOCKERFILE_DIR"
# High-value static checks
grep -nEi "^[[:space:]]*FROM[[:space:]]+.*:latest" "$TARGET_DOCKERFILE" || true
grep -nEi "^[[:space:]]*(ENV|ARG)[[:space:]].*(password|secret|token|api[_-]?key)[[:space:]]*=" "$TARGET_DOCKERFILE" || true
grep -nEi "^[[:space:]]*USER[[:space:]]+(root|0(:0)?)$" "$TARGET_DOCKERFILE" || true
grep -nEi "^[[:space:]]*HEALTHCHECK[[:space:]]+" "$TARGET_DOCKERFILE" || true
PARTIAL result and clearly label skipped checks.Use hadolint container image:
docker run --rm -i hadolint/hadolint < "$TARGET_DOCKERFILE"
Run only manual regex-based checks (Fallback A step 2), clearly mark as PARTIAL, and state which scanners were skipped.
cd /path/to/repo
bash devops-skills-plugin/skills/dockerfile-validator/scripts/dockerfile-validate.sh Dockerfile
cd /path/to/repo
bash devops-skills-plugin/skills/dockerfile-validator/scripts/dockerfile-validate.sh Dockerfile.prod
cd /path/to/repo/devops-skills-plugin/skills/dockerfile-validator
bash scripts/dockerfile-validate.sh examples/good-example.Dockerfile
bash scripts/dockerfile-validate.sh examples/security-issues.Dockerfile
cd /path/to/repo
bash devops-skills-plugin/skills/dockerfile-validator/scripts/test_validate.sh
Optional strict mode for CI environments that must enforce ShellCheck:
STRICT_SHELLCHECK=true bash devops-skills-plugin/skills/dockerfile-validator/scripts/test_validate.sh
Consider this skill execution complete only when all conditions below are satisfied:
Critical, High, Medium, Low).scripts/dockerfile-validate.shscripts/test_validate.shreferences/security_checklist.mdreferences/optimization_guide.mdreferences/docker_best_practices.mdexamples/good-example.Dockerfile, examples/bad-example.Dockerfile, examples/security-issues.Dockerfile, examples/python-optimized.Dockerfile, examples/golang-distroless.Dockerfile