# Darwin Dockerfile Safety > Safety rules for modifying Dockerfiles and Containerfiles. Use when editing container build files. Use when this capability is needed. - Skill: `tomevault-io/darwin-dockerfile-safety` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/darwin-dockerfile-safety` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/darwin-dockerfile-safety/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/darwin-dockerfile-safety --- # Dockerfile Safety Rules ## Allowed Modifications You MAY add: - `ARG` -- build arguments - `ENV` -- environment variables - `COPY` -- copy files into the image - `RUN` -- install packages or run build commands - `EXPOSE` -- declare ports ## Forbidden Modifications You MUST NOT change: - `FROM` -- base image (changing this breaks the build chain) - `CMD` / `ENTRYPOINT` -- the container's startup command - `USER` -- the runtime user (security context) - `WORKDIR` -- the working directory You MUST NOT remove: - Existing `COPY`, `RUN`, or `CMD` lines - Running processes from `CMD` (e.g., removing a sidecar process) ## When to Stop If a task requires changing `FROM`, `CMD`, `USER`, or `WORKDIR`, **stop and report that it requires Architect review**. Do not proceed. --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/the-darwin-project) — claim your Tome and manage your conversions.