{"uid":"cap_HcrllNAdBfyIVxOxdKC2f","slug":"ciaudit-dockerfile-linter-dcf8eaee","name":"CIAudit Dockerfile Linter","description":"Lint a Dockerfile: base image pinning, root user, curl|sh, remote ADD, secrets in ENV/ARG, apt/pip/npm hygiene, chmod 777, EXPOSE 22, HEALTHCHECK, layer cache order. Returns findings with line, why, fix and a score.","url":"https://ciaudit.genexxis.com/dockerfile?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"content":{"type":"string","description":"Full text of the file (max 100 KB)"}}},"responseSchema":{"type":"json","example":{"kind":"dockerfile","score":80,"summary":{"low":4,"high":0,"total":5,"medium":1},"findings":[{"id":"no_user","fix":"Create an unprivileged user and add USER app (or USER 10001) before CMD","why":"no USER in the final stage: the container runs as root","line":null,"snippet":null,"severity":"medium"},{"id":"npm_install","fix":"Use npm ci (with package-lock.json) for reproducible installs","why":"npm install can change the lockfile and resolve different versions","line":4,"snippet":"RUN npm install","severity":"low"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_NDAF2qILDVy4dzyefGnf4","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Statically analyzes a Dockerfile for security and hygiene issues including base image pinning, root user, secret exposure, and more, returning scored findings with line numbers and fix suggestions.","exampleAgentPrompt":"Can you audit this Dockerfile for security issues — check for things like running as root, pinned base images, exposed secrets in ENV or ARG, and curl-pipe-sh patterns, then give me a score and specific fixes for each finding?","exampleUseCases":[{"title":"Pre-merge Dockerfile security gate","prompt":"Before we merge this PR, can you lint the Dockerfile and flag anything critical like root user, unpinned base images, or secrets in ENV variables? Show me the line numbers and how to fix each issue."},{"title":"Onboarding new containerized service","prompt":"We're onboarding a new microservice and I want to make sure its Dockerfile is secure — can you check it for port 22 exposure, missing HEALTHCHECK, bad layer cache order, and any npm install hygiene problems?"},{"title":"Security score for compliance audit","prompt":"I need a security score for our production Dockerfile to include in our compliance report — please analyze it and list every finding by severity with suggested fixes so we can remediate before the audit."}],"resultDescription":"A JSON object containing an overall integer score (0-100), a summary of finding counts by severity (low, medium, high, total), and an array of findings each with an id, severity level, line number (if applicable), code snippet, human-readable explanation of why it's a problem, and a concrete fix recommendation.","failureModes":["Dockerfile content exceeds 100 KB limit — request rejected","Malformed or non-Dockerfile content may produce empty or misleading findings","Missing 'content' field in request body returns an error","Network timeout for very large files near the size limit","False negatives for obfuscated or multi-stage Dockerfile patterns not covered by lint rules"],"whenToPreferThis":"Choose this endpoint when you need fast, structured Dockerfile-specific security feedback with line-level findings and actionable fixes, especially in CI/CD pipelines or pre-merge checks. Prefer it over general-purpose code review tools when you need Docker-specific checks like base image pinning, USER directives, HEALTHCHECK presence, and secret leakage in ENV/ARG layers.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-29T12:32:52.477Z","isFirstParty":false,"canonicalSlug":"ciaudit-dockerfile-linter-dcf8eaee"}