docker
5 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
docker/base-pinned | error | Every image a Dockerfile builds from is pinned to a digest, so rebuilding the same commit starts from the same bytes. |
docker/healthcheck | warning | Every Dockerfile declares a HEALTHCHECK, so the orchestrator can tell a container that is running from one that is actually working. |
docker/lint-clean | warning | Every finding the Dockerfile linter reported is below the severity your team gates on. |
docker/no-build-secrets | error | No ARG or ENV declared in a Dockerfile has a name that looks like a credential. |
docker/nonroot-user | error | Every Dockerfile ends with a USER that is not root, so the container runs its process without privileges. |
Shared collectors
Every docker guardrail receives the facts these collectors gather. Individual guardrails can ask for more collectors of their own.
| Collector | Gathers |
|---|---|
docker | Every Dockerfile in the tree, parsed without a tool: the stages it builds, the image each one starts from and how that image is pinned, the user the image ends as, the ports it exposes, the paths it copies in and the names of the build arguments and environment variables it declares, plus the findings of a hadolint report when the build already left one behind. |
You configure every guardrail in this category the same way, in the guardrails.checks array of buildnote.json. Configuring guardrails lists every option, and Guardrails lets you search the whole library.