Dockerfile Audit

---
name: dockerfile-audit
description: Use when reviewing a Dockerfile (or container build) for security, image size, reproducibility, and maintainability — runs as root? secrets baked into layers? unpinned base/deps? no multi-stage? missing .dockerignore/HEALTHCHECK? Produces a severity-ranked issue list with concrete fixes. Read-only: it audits and recommends, it does not modify the build.
---

# dockerfile-audit

A read-only review of a Dockerfile against four axes: **security**, **size**,
**reproducibility**, and **maintainability**. The goal is a severity-ranked list of
named issues, each with the concrete fix — not a vague "looks fine" or a wall of
nitpicks. The most expensive Dockerfile mistakes (secrets in layers, running as
root, `latest` everywhere) are invisible until they bite, so this skill checks for
them explicitly.

## When to use

- Reviewing a new or changed `Dockerfile` / `Containerfile`
- "Is this image safe / lean / reproducible?" before it ships to a registry
- Hardening an inherited image that "just works" but was never reviewed
- A build is bloated, slow to cache, or flagged by an image scanner and you want the
  *why* and the fix

**When *not* to use:** debugging a *running* container's runtime behavior (that's
ops triage), or authoring app code. This audits the build definition, statically.
… install to load the full skill