# Dockerfile Review Dockerfile Review is a tested SKILL.md that reviews ONE Dockerfile for the five build mistakes that cost security or build time, and lists only those, one line each with a fixed code, the instruction, why it hurts and the fix - or exactly No findings; an agent buys it once for $0.01 over x402. - Page: https://aiskills402.com/skills/dockerfile-review - Category: Code & Engineering (https://aiskills402.com/categories/code) - Price: $0.01 once, USD-priced, paid in USDC on Base over x402. Price as loaded on this page. The 402 response your agent receives is authoritative. - Version: 1.0.0 - Card (JSON): https://api.aiskills402.com/v1/skills/dockerfile-review ## Use it when Reviews ONE Dockerfile for the five build mistakes that cost security or build time, and lists only those, one line each with a fixed code, the instruction, why it hurts and the fix - or exactly No findings. It catches a final image that runs as root, a base image with no tag or the latest tag, a secret passed through an argument, an environment value or a file copy so that it stays in the image history, source copied in before the dependencies are installed so the cache is lost on every edit, and the package index left in the layer after apt-get. It leaves out the safe look-alikes, such as a build secret mounted for one instruction, a tag pinned by digest, and root in a build stage that never ships. Use to review a Dockerfile before merging, to audit the images of a repository, or to speed up a slow image build. ## Not for Image size, vulnerability scanning, health checks, signal handling, compose files and the contents of a dockerignore file. It reads one pasted Dockerfile and judges only what is written in it. ## Tested, honestly Tested 2026-10-19. - Strong model (claude-sonnet-5-5 (Claude Code alias "sonnet")): Right on all 3 cases, read by hand. On the Go service it found the source copied before the module download and the final base with no tag, and left out the digest-pinned builder and the builder running as root. On the Python image it gave the missing user, the token argument and the apt lists, and left out the build secret mount. On the clean Node image it answered exactly No findings. - Weak model (claude-haiku-5-5 (Claude Code alias "haiku")): Right on all 3 cases, read by hand. It matched the strong model on both planted files, with sound fixes, and kept the secret mount and the digest-pinned builder out. On the clean image it answered exactly No findings. Its Python answer was indented by four spaces, which the check accepts. Note: Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. Facts come from public documentation, read on 19 October 2026; there are no owner-measured facts. Full summary: https://aiskills402.com/skills/dockerfile-review/tests ## Example ### English (claude-sonnet-5-5) Before: > FROM golang:1.23@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef AS build WORKDIR /src COPY . . RUN go mod download RUN CGO_ENABLED=0 go build -o /out/server ./cmd/server FROM alpine RUN adduser -D -u 10001 app COPY --from=build /out/server /usr/local/bin/server USER app ENTRYPOINT ["/usr/local/bin/server"] After: > UNPINNED-BASE — final stage `FROM alpine` — no tag, so the shipped base image changes under the same line — pin a version tag (for example `alpine:3.20`), optionally with a digest CACHE-ORDER — build stage `COPY . .` before `RUN go mod download` — every source edit repeats the module download — copy `go.mod` and `go.sum`, run `go mod download`, then copy the source ## What is in the file - What the Docker documentation says, as published on 19 October 2026 - The answer - The codes - Rules - Work in this order - Short example ## Languages English ## How to buy Agent (HTTP): 1. GET https://api.aiskills402.com/v1/skills/dockerfile-review/file without a payment header. The answer is 402 with a PAYMENT-REQUIRED header (x402 v2): exact amount, asset, network, recipient. 2. Sign `accepts[0]` with an x402 client (for example @x402/core + @x402/evm). 3. Repeat the GET with the signature in the PAYMENT-SIGNATURE header. The answer is 200 with the file, its sha256 and a re-download token. Agent (MCP): https://mcp.aiskills402.com/mcp — free tools search_skills, get_skill, redownload_skill. Buying itself is over HTTP. Full flow: https://aiskills402.com/docs ## The file - Version: 1.0.0 - Size: 6.1 KB (6216 bytes) - SHA-256: c37e9558d7c39340e860183c9af9dbd756184152341378cfd8014252003ad6ec - Updated: 2026-10-19 - New versions are free through your re-download token. ## Versions ### 1.0.0 (2026-10-19) First release, written in the light-test batch of 19 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description. Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill rules after the runs. One wording change after the runs: the reason on the first line of the short example was reworded, because a tested answer repeated it word for word and that answer is the public example; the rules and codes are unchanged. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand. ## License Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Terms: https://aiskills402.com/docs#license ## FAQ ### Fixed version tag on the base image: flagged or not? No. The skill states its policy: a fixed version tag is accepted, with or without a digest, and only a missing tag or the word latest is reported. A digest is described as the stronger form, as the Docker page says. ### Is root in a build stage reported? No. Only the stage that ships matters. A builder stage without a USER line is left alone, and so is a build secret mounted for a single instruction. An argument or an environment value that holds a token is reported. ### Which Dockerfiles went into the test? Three files: a Go service that copies its source before the module download and ships on a base with no tag, a Python image that takes a token as an argument, keeps the apt lists and has no user, and a clean two-stage Node image. Each file went to Claude Sonnet one time and to Claude Haiku one time, and on reading the answers both models met each expectation. ### What does a clean Dockerfile return? The sentence No findings. alone. A defect is one line with a code, the instruction, why it hurts and the fix; nothing is said about what was checked and found fine. ## Measurement limits - Models other than the two named above were not run. - Each verdict comes from the test run on the date shown; the skill may have changed since (check the version). - Full test inputs are not published here, only short excerpts of our own text. - Results on your own texts, languages and domains can differ. Offer note: Paid in USDC (USD-pegged) over x402 by an AI agent; one-time.