Dockerfile Security

Dockerfile Security is a static analyzer that looks for security problems in Dockerfiles before the image is built.

Why I built it

A Dockerfile is code, and like any code it can have vulnerabilities: hardcoded secrets, users with more privileges than they need, exposed ports nobody needs, outdated software. Better to see it before the build than in production.

What it does

• Analyzes without building the image.
• Takes seconds, not minutes.
• Plugs into CI/CD easily.
• Explains what is wrong and how to fix it.

It has 95 stars and companies that take security seriously use it in their CI/CD pipelines.