Review Dockerfiles for best practices, security, and optimization. Use when the user says "review Dockerfile", "optimize image", "Dockerfile best practices", "reduce image size", or asks to audit a container build.
666 stars
0 votes
0 copies
0 views
Added February 8, 2026
developmentpythongonodedockergitapisecurity
Works with
api
Security analysis
F19/100
criticalPipes output to a shell interpreter
criticalAccesses sensitive system or user directories
highPerforms destructive filesystem operations
criticalDownloads and executes remote scripts — classic supply chain attack
mediumInstalls packages at runtime which could introduce malicious dependencies
Installs into .claude/skills of the current project.
Are you the author of Dockerfile Review?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/majiayu000-dockerfile-review)
---
name: dockerfile-review
description: Review Dockerfiles for best practices, security, and optimization. Use when the user says "review Dockerfile", "optimize image", "Dockerfile best practices", "reduce image size", or asks to audit a container build.
allowed-tools: Read, Glob, Grep
---
# Dockerfile Review
Audit Dockerfiles for security, efficiency, and best practices.
## Instructions
1. Read the Dockerfile
2. Check for issues in each category below
3. Report findings with severity (critical/warning/suggestion)
4. Provide specific fixes with corrected code
## Security checks
- MUST flag `USER root` without switching back
- MUST flag secrets in ENV, ARG, or COPY (API keys, passwords)
- MUST flag `apt-get install` without `--no-install-recommends`
- Flag missing `USER` directive (runs as root by default)
- Flag `COPY . .` (may include secrets, .git, etc.)
- Flag `:latest` tags (unpinned versions)
- Flag `curl | sh` patterns
## Optimization checks
- Multi-stage builds for compiled languages
- Layer ordering (least-changing first)
- Combined RUN statements to reduce layers
- Cache mounts for package managers: `--mount=type=cache`
- `.dockerignore` file exists and covers .git, node_modules, etc.
- `apt-get clean && rm -rf /var/lib/apt/lists/*` in same layer
## Best practices
```dockerfile
# Good: pinned, non-root, minimal
FROM python:3.11-slim@sha256:abc123...
WORKDIR /app
RUN useradd -r -s /bin/false appuser
COPY requirements.txt .
RUN --mount=type=cache,target=/root/.cache/pip \
pip install -r requirements.txt
COPY --chown=appuser:appuser . .
USER appuser
CMD ["python", "app.py"]
```
## Output format
```
## Critical
- Line 5: Running as root without USER directive
## Warnings
- Line 12: Using :latest tag - pin to specific version
## Suggestions
- Line 8-10: Combine RUN statements to reduce layers
```
## Rules
- MUST read the Dockerfile before reviewing
- MUST categorize issues by severity
- Never approve Dockerfiles with hardcoded secrets
- Always check for corresponding .dockerignore
