Dockerfile Best Practices Linter & Multi-Stage Optimizer

Audit Dockerfiles for root vulnerabilities, layer caching flaws, and generate hardened multi-stage builds.

Try Sample:

4 Security & Optimization Findings Detected

WARNINGUnpinned Base Image (:latest)

Using :latest causes non-deterministic builds and breaking updates. Pin to specific major.minor versions (e.g. node:20-alpine).

ERRORContainer Runs as Root

Running as root in production poses serious container breakout security risks. Declare a non-root USER.

ERRORLayer Caching Broken: COPY . . Before Dependency Install

Copying the entire workspace before installing dependencies busts the Docker cache on every single source code edit.

INFOSingle Stage Build (Compilers Shipped to Production)

Build tools (gcc, npm devDependencies, git) are shipped to production. Use a multi-stage Dockerfile to separate build and run layers.

Input DockerfilePaste your current Dockerfile

Hardened Multi-Stage Build (NODEJS)

# Production Multi-Stage Node.js Dockerfile
# Stage 1: Dependency builder
FROM node:20-alpine AS deps
WORKDIR /app
RUN apk add --no-cache libc6-compat
COPY package.json package-lock.json ./
RUN npm ci --omit=dev

# Stage 2: Production runner
FROM node:20-alpine AS runner
WORKDIR /app
ENV NODE_ENV=production
ENV PORT=3000

# Run as unprivileged non-root user
RUN addgroup --system --gid 1001 nodejs && \
    adduser --system --uid 1001 nodeuser
USER nodeuser

COPY --from=deps --chown=nodeuser:nodejs /app/node_modules ./node_modules
COPY --chown=nodeuser:nodejs . .

EXPOSE 3000
CMD ["node", "server.js"]

Recommended .dockerignore

node_modules
.git
.gitignore
.env
.env*.local
Dockerfile*
docker-compose*.yml
npm-debug.log*
.DS_Store
dist
build
.coverage
__pycache__
*.pyc

Why Multi-Stage Docker Builds are Essential

Standard single-stage Dockerfiles bundle build toolchains (like GCC, npm devDependencies, Git, and package managers) directly into the final shipping artifact. This expands production container image sizes from 50MB to over 1.2GB, introduces dozens of unpatched CVE attack surfaces, and slows down Kubernetes pod startup times.

Key Dockerfile Anti-Patterns to Avoid

Running as Root (UID 0): Containers running without an explicit USER appuser directive execute as the host root user inside container namespaces, increasing container escape risk.
Busting Layer Cache with COPY . .: Copying application source files before package.json or requirements.txt causes Docker to re-download all dependencies on every code edit.
Uncleaned Package Manager Caches: Running apt-get install without rm -rf /var/lib/apt/lists/* leaves hundreds of megabytes of cached index files in the filesystem layer.