Dockerfile Review: test results

Verdicts

Date

2026-10-19

Strong · claude-sonnet-5-5 (Claude Code alias "sonnet")

Right on all 3 cases, read by hand. On the Go service it found the source copied before the module download and the final base with no tag, and left out the digest-pinned builder and the builder running as root. On the Python image it gave the missing user, the token argument and the apt lists, and left out the build secret mount. On the clean Node image it answered exactly No findings.

Weak · claude-haiku-5-5 (Claude Code alias "haiku")

Right on all 3 cases, read by hand. It matched the strong model on both planted files, with sound fixes, and kept the secret mount and the digest-pinned builder out. On the clean image it answered exactly No findings. Its Python answer was indented by four spaces, which the check accepts.

Note

Light test: three cases (two planted, one clean), one run per model; no comparison without the skill. The three inputs were written by us; each planted one carries a safe look-alike and neither planted case has a comment pointing at the defect. Facts come from public documentation, read on 19 October 2026; there are no owner-measured facts.

What was not measured

• Models other than the two named above were not run.
• Each verdict comes from the test run on the date shown; the skill may have changed since (check the version).
• Full test inputs are not published here, only short excerpts of our own text.
• Results on your own texts, languages and domains can differ.