Analyze a Dockerfile before building image

One Dockerqueue short is not necessarily sure. The basic image, the order of the layers and the end user directly influence the attack surface and reproducibility.

Risks sought

• unfrozen basic image or tag latest ;
• Final execution with root user;
• transmitted with ARG or ENV ;
• remote download without integrity verification;
• fragile use of ADD, too wide permissions or ambiguous shell command ;
• packet manager cache kept in the image;
• absence of HEALTHCHECK when the service requires it.

Example of correction

FROM python:3.13-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
USER 10001
CMD ["python", "-m", "app"]

This base remains to be adapted: freeze image by digest further improves reproducibility, and secrets must be provided at the time of execution or by the manufacturer's dedicated mechanisms.

After analysis

First correct secrets and privileges, then improve reproducibility and size. Then complete with a built image vulnerability scan and a real test in an isolated environment.

See the checklist 10 common errors in a Dockerfile. If the project uses Compose, check also configuration of services.

Updated on August 1, 2026.