dockerfile layer audit derived

{
  "input": {
    "body": {
      "dockerfile": "FROM node:20\nARG NPM_TOKEN=abc123\nRUN apt-get update\nRUN apt-get install -y curl git\nRUN curl -fsSL https://example.test/install.sh | sh\nWORKDIR /app\nCOPY . .\nRUN npm ci\nEXPOSE 8080\nCMD [\"node\", \"server.js\"]\n"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxFindings": 500,
        "maxYamlBytes": 262144,
        "maxDockerfileBytes": 131072,
        "maxDockerfileLines": 4000
      },
      "passed": false,
      "stages": [
        {
          "line": 1,
          "alias": null,
          "image": "node:20"
        }
      ],
      "complete": false,
      "findings": [
        {
          "code": "CREDENTIAL_SHAPED_BUILD_VARIABLE",
          "line": 2,
          "detail": "Line 2 sets NPM_TOKEN with a literal value. ARG values are recorded in the image history and readable by anyone who can pull the image. The value is not reported here."
        },
        {
          "code": "PACKAGE_INDEX_UPDATED_IN_ITS_OWN_LAYER",
          "line": 3,
          "detail": "Line 3 updates the package index without installing in the same instruction. A later install uses the cached index from this layer, which can be months old."
        },
        {
          "code": "INSTALL_WITHOUT_NO_INSTALL_RECOMMENDS",
          "line": 4,
          "detail": "Line 4 installs packages without --no-install-recommends, so recommended packages are pulled in as well."
        }
      ],
      "conformant": false,
      "final_user": null,
      "request_id": "example-request",
      "service_id": "dockerfile_layer_audit",
      "assumptions": [
        "Line continuations are joined before anything is judged, which is what makes \"updated the index and installed in one layer\" answerable at all. Reading line by line would report every multi-line RUN wr...",
        "Layer ordering findings are about cache behaviour: a dependency install after a copy of the whole context is rebuilt on every source change, which is a build cost rather than a defect.",
        "Findings about credentials name the variable and never its value."
      ],
      "limitations": [
        "The Dockerfile supplied, as a documented subset of instructions. What the base image contains, and what any downloaded script does, are outside this. Not a security assessment.",
        "conformant is true only when the file parsed, nothing was left unaudited, and every check that ran found nothing."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "stage_count": 1,
      "not_examined": [
        "BASE_IMAGE_PINNED_BY_TAG: Line 1 pins node:20 by tag rather than digest. A tag is mutable; whether that matters is the caller's decision."
      ],
      "finding_count": 7,
      "service_version": "1.0.0",
      "findings_by_code": {
        "DOWNLOAD_PIPED_TO_SHELL": 1,
        "FINAL_STAGE_RUNS_AS_ROOT": 1,
        "PACKAGE_LISTS_NOT_REMOVED": 1,
        "CREDENTIAL_SHAPED_BUILD_VARIABLE": 1,
        "DEPENDENCY_INSTALL_AFTER_BROAD_COPY": 1,
        "INSTALL_WITHOUT_NO_INSTALL_RECOMMENDS": 1,
        "PACKAGE_INDEX_UPDATED_IN_ITS_OWN_LAYER": 1
      },
      "non_root_checked": true,
      "instruction_count": 10,
      "declares_healthcheck": false
    }
  }
}