skills.rest
mattnowdev
mattnowdevCOMMUNITY
Explore all skills by this author →
GitHub

super-review:dockerfile

Identify insecure and non-reproducible Dockerfile patterns in pull request diffs.

Updated May 15, 2026
Search Tags:#container security#dockerfile#multi-stage builds#build reproducibility#evidence-based code review#build secrets#image hardening
One-click install
npx skills add https://github.com/mattnowdev/super-review --skill super-review-dockerfile
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: super-review:dockerfile
Source: https://github.com/mattnowdev/super-review/tree/main/skills/dockerfile
Command: npx skills add https://github.com/mattnowdev/super-review --skill super-review-dockerfile

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill reduces insecure, non-reproducible, and bloated container images by flagging Dockerfile anti-patterns that commonly slip past basic linting and lead to real runtime and supply-chain risk.

Core Features & Use Cases

  • Rootless execution enforcement: Detects missing or ineffective USER directives (including numeric UID/GID requirements).
  • Multi-stage hygiene & image bloat prevention: Identifies single-stage build leakage of compilers and build tools into production images.
  • Build cache and reproducibility improvements: Finds COPY . . ordering issues, missing .dockerignore exclusions, non-pinned base images, and multi-arch build performance gaps.
  • Secrets safety during builds: Detects credential-shaped ARG usage and recommends BuildKit --mount=type=secret.
  • Runtime operability and clarity: Flags missing HEALTHCHECK and mismatched EXPOSE declarations.

Quick Start

Ask the orchestrator to review your PR: "Run super-review:run on this diff that changes Dockerfile, .dockerignore, or docker-compose.yml and produce a bounded, evidence-quoted container build report."

Frequently Asked Questions about super-review:dockerfile

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a Dockerfile for security issues in a pull request?▼

Dockerfile security review involves detecting root-user execution, missing multi-stage build hygiene, and improper secret handling within PR diffs. Evidence-based code review identifies insecure patterns by quoting exact diff lines to pinpoint build and runtime correctness concerns.

What is the best way to prevent build secrets from leaking in Docker images?▼

Preventing build secret leaks requires avoiding credential-shaped ARG usage and mounting secrets securely during builds. Evidence-based Dockerfile review detects unsafe ARG patterns and recommends using BuildKit --mount=type=secret for safe credential injection.

Why does my Docker image build cache break frequently with COPY . . ?▼

Docker build cache breaks frequently with COPY . . due to improper layer ordering and missing .dockerignore exclusions. Evidence-based Dockerfile review identifies non-reproducible COPY patterns and suggests cache-optimized layer sequencing to improve build performance.

Does Dockerfile review check for non-pinned base images and missing healthchecks?▼

Dockerfile review checks for non-pinned base images and missing healthchecks by flagging runtime operability and reproducibility gaps. Evidence-based code review detects missing HEALTHCHECK directives and mismatched EXPOSE declarations to ensure container runtime clarity.

Can I use this to enforce rootless execution with numeric UID in Dockerfiles?▼

You can enforce rootless execution with numeric UID in Dockerfiles by detecting missing or ineffective USER directives. Evidence-based Dockerfile review identifies containers running as root and requires numeric UID/GID specifications to harden runtime security.

When should I use multi-stage builds to reduce Docker image bloat?▼

You should use multi-stage builds to reduce Docker image bloat when compilers and build tools leak into production images. Evidence-based Dockerfile review identifies single-stage build leakage and enforces multi-stage hygiene to prevent bloated container images.

Related Skills

Explore More Software Engineering Skills→
mwguerramwguerra
35

docker-init

Generate Dockerfile, docker-compose.yaml, .dockerignore, and .env.example for projects.

Community
Advanced
rbaumierrbaumier
4

docker

Optimize Dockerfiles and docker-compose configurations for reproducible, minimal, and secure container images.

Community
Advanced
jugrajsinghjugrajsingh
1

setting-up

Generate Dockerfile, .dockerignore, and docker-compose.yml for a Docker environment.

Community
Intermediate
ivanshamaevivanshamaev
14

infra-docker-best-practices

Apply multi-stage Dockerfile patterns and Trivy scanning to data engineering builds.

Community
Advanced