{"uid":"cap_lqEB3hgq1dLwNqYLk7kJX","slug":"dockerfile-security-risk-review-risky-container-build-scenario-46772fd7","name":"Dockerfile Security Risk Review (risky-container-build scenario)","description":"An autonomous paid API accepting USDC on Base mainnet.","url":"https://47-85-47-24.sslip.io/v1/dockerfile-risk","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","properties":{"scenario":{"enum":["risky-container-build"],"type":"string","description":"Built-in paid Dockerfile security-review scenario"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["analysis_id","analyzer_version","label","profile","verdict","risk_score","summary","stats","stages","findings","approval_gates","coverage"],"properties":{"label":{"type":"string"},"stats":{"type":"object"},"stages":{"type":"array","items":{"type":"object"}},"profile":{"enum":["production","development"],"type":"string"},"summary":{"type":"string"},"verdict":{"enum":["BLOCK","WARN","PASS"],"type":"string"},"coverage":{"type":"object"},"findings":{"type":"array","items":{"type":"object"}},"risk_score":{"type":"integer","maximum":100,"minimum":0},"analysis_id":{"type":"string"},"approval_gates":{"type":"array","items":{"type":"string"}},"analyzer_version":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"label":"paid-demo:risky-container-build","stats":{"line_count":8,"stage_count":1,"instruction_count":8,"findings_by_severity":{"low":3,"high":9,"medium":0,"critical":0}},"stages":[{"name":"stage-0","user":null,"final":true,"index":0,"from_line":1,"base_image":"python:latest","has_healthcheck":false}],"profile":"production","summary":"BLOCK: 12 finding(s) across 1 build stage(s); 9 require resolution or explicit approval.","verdict":"BLOCK","coverage":{"mode":"static-dockerfile","checks":["base-image immutability","build-secret handling","remote-download integrity","package-manager hygiene","runtime least privilege","file-permission and context-copy risk","process and healthcheck form"],"limitations":["Does not inspect image layers, package vulnerabilities, signatures, provenance, or runtime configuration.","Cannot verify .dockerignore contents or whether a remote artifact checksum is correct.","Findings are static release gates and do not replace an image scan or sandboxed build."],"build_executed":false,"registry_contacted":false,"secret_values_returned":false,"filesystem_context_read":false},"findings":[{"code":"final_stage_runs_as_root","line":1,"stage":0,"message":"The final stage does not establish a non-root runtime user.","end_line":1,"severity":"high","standard":"container-least-privilege","instruction":"FROM","remediation":"Create or select a non-root account and set USER in the final stage."},{"code":"mutable_or_latest_base_image","line":1,"stage":0,"message":"The base image is untagged or uses the mutable latest tag.","end_line":1,"severity":"high","standard":"docker-build-best-practice","instruction":"FROM","remediation":"Use a trusted image version and pin its sha256 digest."},{"code":"secret_like_arg","line":2,"stage":0,"message":"ARG declares 1 secret-like key(s); values are intentionally omitted.","end_line":2,"severity":"high","standard":"docker-build-secrets","instruction":"ARG","remediation":"Pass build credentials with BuildKit secret or SSH mounts instead of ARG or ENV."},{"code":"secret_like_env","line":3,"stage":0,"message":"ENV declares 1 secret-like key(s); values are intentionally omitted.","end_line":3,"severity":"high","standard":"docker-build-secrets","instruction":"ENV","remediation":"Pass build credentials with BuildKit secret or SSH mounts instead of ARG or ENV."},{"code":"remote_add_without_checksum","line":4,"stage":0,"message":"ADD downloads a remote resource without an explicit checksum.","end_line":4,"severity":"high","standard":"dockerfile-reference","instruction":"ADD","remediation":"Use ADD --checksum=sha256:<digest>, or download and verify the artifact in one RUN layer."},{"code":"sensitive_file_copied","line":5,"stage":0,"message":"A secret-like credential or configuration path is copied into an image layer; the path value is omitted.","end_line":5,"severity":"high","standard":"docker-build-secrets","instruction":"COPY","remediation":"Exclude the file with .dockerignore and inject required credentials through runtime or BuildKit secrets."},{"code":"remote_script_piped_to_shell","line":6,"stage":0,"message":"A remotely downloaded script is piped directly to a shell.","end_line":6,"severity":"high","standard":"software-supply-chain","instruction":"RUN","remediation":"Download a versioned artifact, verify its checksum or signature, inspect it, then execute it."},{"code":"tls_verification_disabled","line":6,"stage":0,"message":"A download command disables TLS certificate verification.","end_line":6,"severity":"high","standard":"software-supply-chain","instruction":"RUN","remediation":"Restore certificate verification and trust only an explicit CA when required."},{"code":"world_writable_permissions","line":6,"stage":0,"message":"RUN creates world-writable permissions with chmod 777.","end_line":6,"severity":"high","standard":"container-least-privilege","instruction":"RUN","remediation":"Grant the narrowest owner/group permissions required by the runtime user."},{"code":"missing_healthcheck","line":1,"stage":0,"message":"The production final stage has no active HEALTHCHECK instruction.","end_line":1,"severity":"low","standard":"dockerfile-reference","instruction":"FROM","remediation":"Add a bounded HEALTHCHECK or document that the orchestrator owns equivalent probes."},{"code":"relative_workdir","line":7,"stage":0,"message":"WORKDIR uses a relative path.","end_line":7,"severity":"low","standard":"docker-build-best-practice","instruction":"WORKDIR","remediation":"Use an absolute WORKDIR for predictable filesystem layout."},{"code":"shell_form_process_instruction","line":8,"stage":0,"message":"CMD uses shell form, which can complicate signal and argument handling.","end_line":8,"severity":"low","standard":"dockerfile-reference","instruction":"CMD","remediation":"Use JSON exec form for CMD when shell expansion is not required."}],"risk_score":100,"analysis_id":"docker-324e1d9d94b0d50a2959","approval_gates":["Resolve or explicitly approve 9 critical/high finding(s) before publishing the image.","Confirm that no credential remains in image layers, build history, or copied context.","Require a documented exception if the production process must run as root."],"analyzer_version":"dockerguard-dockerfile/1.0"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_UmQRJI0hGtC6rkKecSHr1","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Statically analyzes a built-in risky Dockerfile for embedded secrets, mutable base images, unverified downloads, unsafe permissions, root runtime, and package-manager hygiene without building or pulling any image","exampleAgentPrompt":"Can you run the built-in risky-container-build Dockerfile security review and tell me the risk score, verdict, and what findings would block a production deployment?","exampleUseCases":null,"resultDescription":"Returns a structured JSON report including: a numeric risk score (0–100), a BLOCK/WARN/PASS verdict, a human-readable summary, per-stage findings (embedded secrets, mutable tags, unverified downloads, unsafe permissions, root runtime, package hygiene), approval gates required before deployment, coverage metadata, and an analysis ID — all without building or pulling any image.","failureModes":["Invalid or missing 'scenario' query param value (must be 'risky-container-build') returns 400","Payment not provided or insufficient USDC via x402 returns 402","Service unavailable returns 503","Unsupported HTTP method (POST, PUT, PATCH) returns 405"],"whenToPreferThis":"Use this endpoint when you need a fast, static, payment-gated Dockerfile security review that covers secrets leakage, base image mutability, download verification, permission safety, root runtime risks, and package hygiene — all without requiring a live Docker daemon, image pull, or build execution. Prefer it over full CI/CD pipeline scans when you want a cheap, deterministic, reproducible pre-commit or PR gate check.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T06:45:17.024Z","isFirstParty":false}