BETA Shoulder is in beta — Findings may sometimes be wrong. Your feedback shapes what we fix next. Share feedback

🐳

Dockerfile Security Rules

16 detection rules for Dockerfile across 6 vulnerability classes.

1 Critical

2 High

4 Medium

8 Low

Scan your Dockerfile code

npx @shoulderdev/cli trust --lang=dockerfile .

Frameworks

docker nodejs

5 rules

Docker Build Optimization and Best Practices LOW docker

Docker Compose Obsolete Version Field LOW docker

Docker File Operations Best Practices LOW docker

Invalid Port Number in EXPOSE ERROR docker

Multiple ENTRYPOINT Instructions MEDIUM docker

CWE-1104 CWE-1104 4 rules

Docker Base Image Security MEDIUM docker

Use npm ci for Reproducible Builds LOW docker nodejs

Dockerfile Uses Outdated Node.js Version MEDIUM docker

Node.js Version Mismatch Between Configuration Files MEDIUM nodejs

CWE-1395 CWE-1395 3 rules

Docker apt-get Missing Cache Cleanup LOW docker

Docker apt-get Missing --no-install-recommends LOW docker

Docker apt-get Missing -y Flag LOW docker

CWE-250 CWE-250 2 rules

Container runs as root HIGH docker

Docker User and File Permissions HIGH docker

CWE-693 Protection Mechanism Failure 1 rules

Missing Healthcheck Configuration LOW docker

CWE-798 Hardcoded Credentials 1 rules

Docker Secrets and Security Best Practices CRITICAL docker