[H1][DOCKERFILE-VALIDATOR]

Dictum: Automated validation enforces security and build quality.

Docker Engine 27+ | BuildKit 0.27+ | hadolint 2.14+ | Checkov latest

Tasks:

1. Read the target Dockerfile -- Understand context before validation
2. Run validation -- bash scripts/dockerfile-validate.sh <Dockerfile>
3. Read dockerfile_reference.md -- Fix patterns for reported issues
4. Summarize by severity -- critical -> high -> medium -> low
5. Propose fixes with concrete code from reference patterns
6. Offer to apply fixes to the Dockerfile

Scope:

• Validation: All Dockerfile variants (Dockerfile, Dockerfile.prod, Dockerfile.dev)
• Not: Generating Dockerfiles (use dockerfile-generator), building/running containers, debugging

[1][VALIDATION_PIPELINE]

Dictum: Five stages catch progressively subtler issues.

Guidance:

• Stage 1 -- hadolint: Instruction validation, ShellCheck on RUN, 60+ lint rules.
• Stage 2 -- Checkov: 11 CKV_DOCKER policies + 17 CKV2_DOCKER graph checks.
• Stage 3 -- Extended security: Secrets, sudo, cert bypass (curl/wget/pip/npm/git), chpasswd, dangerous packages.
• Stage 4 -- Best practices: :latest, USER, HEALTHCHECK, STOPSIGNAL, MAINTAINER, ADD, apt, WORKDIR, shell form, cache cleanup, COPY order, BuildKit syntax, OCI labels, heredoc.
• Stage 5 -- Optimization: Base image size, multi-stage, layer count, BuildKit features (--mount, --link, --chmod), heredoc opportunities, .dockerignore, Chainguard.

Best-Practices:

• Exit codes: 0 all passed (warnings allowed), 1 validation failure (errors), 2 critical error
• Auto-install: Script installs hadolint + Checkov in temp venvs if missing, cleans up via bash trap
• Force temp: FORCE_TEMP_INSTALL=true bash scripts/dockerfile-validate.sh Dockerfile

[REFERENCE]: →dockerfile_reference.md -- Base images, security rules, hadolint/Checkov catalogs.

[2][SEVERITY_CLASSIFICATION]

Dictum: Severity determines fix priority.

Guidance:

• Critical -- Hardcoded secrets in ENV/ARG, cert bypass flags, no USER directive.
• High -- :latest tag, sudo usage, SSH port (22), no HEALTHCHECK for services.
• Medium -- Missing version pins, cache cleanup, missing OCI labels, no --no-install-recommends.
• Low -- Style (layer count, STOPSIGNAL, heredoc opportunities).

Best-Practices:

• Fix order: Critical first, then high, medium, low. Resolve all critical before moving to high.
• Iteration cap: Max 3 fix-validate cycles. Remaining warnings acceptable if no errors.

[3][KEY_RULES]

Dictum: Rule references enable precise fix targeting.

[4][RESOURCES]

Dictum: Examples demonstrate both compliance and violations.

[5][TOOL_INSTALLATION]

Dictum: Tools auto-installed by script; permanent install optional.

Troubleshooting:

[6][VALIDATION]

Dictum: Gates prevent incomplete validation reports.

[VERIFY] Completion:

• Target Dockerfile read and context understood
• scripts/dockerfile-validate.sh executed against target
• Issues summarized by severity (critical -> high -> medium -> low)
• Fix patterns referenced from dockerfile_reference.md
• Concrete fix code proposed for each issue
• All critical and high issues resolved (medium/low: fix or document rationale)

Integration:

• dockerfile-generator -- Generates Dockerfiles validated by this skill
• k8s-debug -- Container debugging when builds fail at runtime