docker
5 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
docker/base-pinned | error | Every image a Dockerfile builds from is pinned to a digest, so a rebuild of the same commit starts from the same bytes. |
docker/healthcheck | warning | Every Dockerfile declares a HEALTHCHECK, so the orchestrator can tell a container that is running from one that is working. |
docker/lint-clean | warning | Every finding the Dockerfile linter reported sits below the severity the team gates on. |
docker/no-build-secrets | error | No ARG or ENV a Dockerfile declares is named like a credential. |
docker/nonroot-user | error | Every Dockerfile ends on a USER that is not root, so the container runs its process unprivileged. |
Shared collectors
Every docker guardrail is handed the facts these collectors gather, and each one may ask for more of its own.
| Collector | Gathers |
|---|---|
docker | Every Dockerfile in the tree, parsed without a tool: the stages it builds, the image each one starts from and how that image is pinned, the user the image ends as, the ports it exposes, the paths it copies in and the names of the build arguments and environment variables it declares, enriched with the findings of a hadolint report when the build already left one behind. |
Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.