# Dockerfile Hardening Audit

> Statically audit Dockerfiles for common container hardening risks (root user, unpinned/latest base images, missing healthchecks, and risky build patterns).

- Skill: `dvcrn/dockerfile-hardening-audit` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add dvcrn/dockerfile-hardening-audit`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dvcrn/dockerfile-hardening-audit/raw
- Safety review: pending (external: skill-scanner WARNING, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: dvcrn (https://skillmd.com/u/dvcrn)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/dvcrn/dockerfile-hardening-audit

---


# Dockerfile Hardening Audit

Use this skill to statically audit Dockerfiles before insecure container defaults land in production.

## What this skill does
- Scans Dockerfiles and scores hardening risk per file
- Flags missing non-root `USER` declarations
- Flags base images using floating tags (`:latest`, `:main`, `:master`, `:edge`) or no tag/digest
- Flags missing `HEALTHCHECK`
- Flags `ADD` instructions (when `COPY` is safer/clearer)
- Flags `curl|bash`/`wget|sh` style remote script execution
- Supports include/exclude regex filters and fail-gate mode

## Inputs
Optional:
- `DOCKERFILE_GLOB` (default: `**/Dockerfile*`)
- `TOP_N` (default: `20`)
- `OUTPUT_FORMAT` (`text` or `json`, default: `text`)
- `WARN_SCORE` (default: `3`)
- `CRITICAL_SCORE` (default: `6`)
- `REQUIRE_NON_ROOT_USER` (`0`/`1`, default: `1`)
- `REQUIRE_HEALTHCHECK` (`0`/`1`, default: `1`)
- `FLAG_FLOATING_TAGS` (`0`/`1`, default: `1`)
- `FLAG_UNPINNED_IMAGES` (`0`/`1`, default: `1`)
- `FLAG_ADD_INSTRUCTIONS` (`0`/`1`, default: `1`)
- `FLAG_REMOTE_SCRIPT_PIPE` (`0`/`1`, default: `1`)
- `FILE_MATCH` (regex include filter on Dockerfile path, optional)
- `FILE_EXCLUDE` (regex exclude filter on Dockerfile path, optional)
- `FAIL_ON_CRITICAL` (`0` or `1`, default: `0`)

## Run

Text report:

```bash
DOCKERFILE_GLOB='**/Dockerfile*' \
bash skills/dockerfile-hardening-audit/scripts/dockerfile-hardening-audit.sh
```

JSON output + fail gate:

```bash
DOCKERFILE_GLOB='**/Dockerfile*' \
OUTPUT_FORMAT=json \
FAIL_ON_CRITICAL=1 \
bash skills/dockerfile-hardening-audit/scripts/dockerfile-hardening-audit.sh
```

Run against bundled fixtures:

```bash
DOCKERFILE_GLOB='skills/dockerfile-hardening-audit/fixtures/*Dockerfile*' \
bash skills/dockerfile-hardening-audit/scripts/dockerfile-hardening-audit.sh
```

## Output contract
- Exit `0` in report mode (default)
- Exit `1` when `FAIL_ON_CRITICAL=1` and one or more Dockerfiles are critical
- Text mode prints summary + ranked Dockerfile risks
- JSON mode prints summary + ranked Dockerfiles + critical Dockerfiles