takeaseatventure dockerfile-auditor
Pro skill. This skill is part of the takeaseat Pro tier. It provides deeper analysis than the free skills. To unlock, get an All-Access license.
When to use this skill
- A user writes a Dockerfile or asks you to review one.
- A Docker image is too large (>500MB for a typical app).
- Docker builds are slow or fail to cache effectively.
- A container needs hardening for production deployment.
- A user asks "is this Dockerfile production-ready?"
The 12 Dockerfile audit checks
Run every check against the Dockerfile. Report each as PASS / WARN / FAIL with a specific, actionable recommendation.
1. Base image specificity
FAIL if the base image uses :latest tag — it's non-reproducible.
WARN if using a full OS image (ubuntu, debian) when a slim/alpine variant exists.
PASS if pinned to a specific version: node:20.11-alpine3.19.
# ❌ Bad — non-reproducible, large
FROM node:latest
# ✅ Good — pinned, small
FROM node:20.11-alpine3.19
2. Layer ordering (cache efficiency)
Docker caches layers top-to-bottom. If a layer changes, all layers below it are rebuilt. Put the least-frequently-changing instructions first.
FAIL if COPY . . appears before RUN npm install — every code change busts the
dependency cache.
# ❌ Bad — any code change reinstalls all deps
COPY . .
RUN npm install
# ✅ Good — deps cached unless package.json changes
COPY package*.json ./
RUN npm ci --omit=dev
COPY . .
3. Multi-stage builds
WARN if the Dockerfile has no build stage and the final image contains build tools compilers, or dev dependencies. The final image should contain only runtime artifacts.
# Build stage
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build
# Runtime stage — minimal
FROM node:20-alpine
WORKDIR /app
COPY --from=builder /app/dist ./dist
COPY --from=builder /app/node_modules ./node_modules
USER node
CMD ["node", "dist/index.js"]
4. Root user
FAIL if the container runs as root (no USER directive). Containers should run as
a non-root user.
# ❌ Bad — runs as root
CMD ["node", "index.js"]
# ✅ Good — dedicated user
RUN addgroup -S app && adduser -S app -G app
USER app
CMD ["node", "index.js"]
5. Secrets in layers
FAIL (critical) if secrets are baked into layers via ENV, ARG, or COPY:
# ❌ CRITICAL — secret in image layer, recoverable from image history
ENV DATABASE_PASSWORD=s3cr3t
ARG API_KEY=sk_live_abc123
Secrets must come from runtime injection (Docker secrets, env vars at docker run,
Kubernetes secrets), never baked into the image.
6. .dockerignore
WARN if there's no .dockerignore file. Without it, COPY . . includes
node_modules, .git, .env, test files, and build artifacts — bloating the image
and potentially leaking secrets.
Essential .dockerignore:
node_modules
.git
.env*
*.md
test/
tests/
__pycache__/
*.pyc
.venv/
coverage/
.nyc_output/
Dockerfile*
docker-compose*
7. HEALTHCHECK
WARN if no HEALTHCHECK directive. Without it, orchestrators can't detect a
hung process.
HEALTHCHECK --interval=30s --timeout=3s --retries=3 \
CMD wget -qO- http://localhost:3000/health || exit 1
8. APK/APT cache cleanup
WARN if apk add or apt-get install doesn't clean the package cache in the
same layer:
# ❌ Bad — cache stays in the layer (~40MB wasted)
RUN apk add curl
# ✅ Good — cache removed in same layer
RUN apk add --no-cache curl
9. Explicit CMD/ENTRYPOINT form
WARN if CMD uses shell form instead of exec form. Shell form (CMD npm start)
starts via /bin/sh -c, which doesn't forward signals properly — SIGTERM won't
reach your app, causing slow container shutdowns.
# ❌ Bad — shell form, no signal handling
CMD npm start
# ✅ Good — exec form, direct process
CMD ["node", "index.js"]
10. EXPOSE documentation
INFO if no EXPOSE directive. While not required (docker -p overrides), it
documents which ports the container listens on.
11. WORKDIR cleanliness
WARN if using WORKDIR / or no WORKDIR (files scattered in root). Always use a
dedicated directory: WORKDIR /app.
12. Image size estimation
Estimate the final image size based on the base image + installed packages. Flag if over thresholds:
- OK: <200MB (typical Alpine-based app)
- WARN: 200-500MB
- FAIL: >500MB (unless justified — ML models, etc.)
Output format
Present the audit as a table:
Dockerfile audit: ./Dockerfile
Base image: node:20.11-alpine3.19 (~45MB)
# | Check | Status | Detail
---|----------------------|--------|------------------------------------------
1 | Base image pinned | PASS | node:20.11-alpine3.19 ✓
2 | Layer ordering | FAIL | COPY . . before npm ci — cache busted on every change
3 | Multi-stage build | WARN | Single stage; devDeps in final image (~120MB)
4 | Non-root user | FAIL | No USER directive — runs as root
5 | No secrets in layers | PASS | No ENV/ARG secrets detected
6 | .dockerignore | WARN | File missing — node_modules/.git included
7 | HEALTHCHECK | WARN | No health check defined
8 | Cache cleanup | PASS | --no-cache used
9 | Exec form CMD | PASS | ["node", "dist/index.js"]
10 | EXPOSE documented | PASS | 3000/tcp
11 | WORKDIR | PASS | /app
12 | Image size estimate | WARN | ~350MB (single-stage + devDeps)
Score: 6/12. See recommendations above.
Estimated savings with fixes: ~180MB (52% reduction).
Always provide the fixed Dockerfile
After the audit, provide a corrected Dockerfile that fixes all FAIL/WARN items. This is the most valuable part — the user gets a drop-in replacement.