MetaCyberGuruPractical tools. Clear explanations.

Infrastructure / BROWSER-ONLY UTILITY

Dockerfile Static Reviewer

A small Dockerfile can hide an important build or runtime assumption. Read those assumptions before changing a base image, passing a credential or selecting the final runtime user.

Local processingNo account or AI required

Choose the Dockerfile as a local text file or paste its content. Standard instructions and named stages are supported; heredocs are not. Nothing is built. Limit: 100,000 characters.

Loading local tool code...

Input stays in this tab. No upload, AI call, analytics or ads. Reset clears the workspace. Clipboard copies and downloaded files remain under your control.

Track the last stage without pulling an image

The reviewer recognises FROM stages and carries an explicitly selected user through named-stage inheritance. It examines the last stage, not an arbitrary --target. A missing USER is reported as inherited or unknown because the base image may already define one. Explicit root selection gets a different note from an uninspected image default.

Pinning is a reproducibility question

External base images without a SHA-256 digest receive a review point; scratch and references to earlier named stages are treated separately. A digest fixes image content but does not prove that content is trustworthy or current. Build-variable substitutions are not resolved. This utility does not inspect layers, image signatures or package advisories.

Keep build credentials out of instructions

ARG and ENV names suggesting tokens, passwords or keys receive a name-based warning without repeating values. Review BuildKit secret mounts instead of assuming a build argument stays private. Other checks identify remote ADD sources, relative WORKDIR declarations, selected download-to-shell patterns and apparent certificate-verification bypasses. Shell analysis is deliberately limited.

Unsupported syntax should be visible

The line parser accepts standard instruction names and handles backslash or backtick continuations. Heredocs are rejected rather than misread as additional instructions. JSON-form arguments, shell semantics, custom frontend extensions and ONBUILD bodies are not fully parsed. Use Docker build checks and a controlled build to verify the final change; this page never runs either.

References

Documentation reviewed: . Rule results describe the supplied text, not a live application test.

Useful next steps

Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.