Dockerfile Security

Dockerfile Security is a static analyzer that looks for security problems in your Dockerfiles before you build the image.

Why I built it

A Dockerfile is code, and like any code it can have vulnerabilities: hardcoded secrets, users with more privileges than they need, exposed ports you don’t need, outdated software. Better to see it before the build than in production.

What it does

• Analyzes without building the image.
• Takes seconds, not minutes.
• Plugs into CI/CD easily.
• Tells you what’s wrong and how to fix it.

It has 95 stars and companies that take security seriously use it in their CI/CD pipelines.