dockerfile-skill — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dockerfile-skill (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill generates production-ready Dockerfiles through a 4-phase process:
/dockerfile # Analyze current directory
/dockerfile <github-url> # Clone and analyze GitHub repo
/dockerfile <path> # Analyze specific pathWhen invoked, ALWAYS follow this sequence:
Load and execute: modules/analyze.md
Output: Structured project metadata including:
Load and execute: modules/generate.md
Input: Analysis result from Phase 1 Output:
Dockerfile (with migration handling, build optimization).dockerignore (workspace-aware)docker-compose.yml (if external services needed).env.docker.local (auto-generated with test secrets)docker-entrypoint.sh (with migration execution)DOCKER.md (complete deployment guide)Key Enhancements:
Load and execute: modules/build-fix.md
Process:
docker buildx build --platform linux/amd64 --loadCritical Addition: Don't declare success until runtime verification passes!
Validation Steps:
docker-compose up -d and verify no crashespsql -c "\dt" → verify tables existWhy This Matters:
docker build, but app didn't work at runtime| Level | Criteria | Max Build Iterations |
|---|---|---|
| L1 | Single language, no build step, no external services, no migrations | 1 |
| L2 | Has build step, has external services (DB/Redis), simple migrations | 3 |
| L3 | Monorepo, multi-language, complex dependencies, build-time env vars, complex migrations (76+) | 5 |
Symptom: relation "users" does not exist at runtime Cause: Migrations detected but never executed Prevention: Analysis phase Step 12 detects migrations and configures execution Fix:
psql -c "\dt" after container startsSymptom: Exit code 137, Killed, heap out of memory Cause: Build script includes lint/type-check for 39+ workspace packages Prevention: Analysis phase Step 13 detects heavy operations Fix: Skip CI tasks in Docker build, increase NODE_OPTIONS to 8192MB
Symptom: ENOENT: no such file or directory, open '/app/e2e/package.json' Cause: .dockerignore excludes workspace package.json files Fix: Use e2e/* instead of e2e, then !e2e/package.json
Symptom: Cannot generate lockfile because lockfile is set to false Cause: Project has lockfile=false in .npmrc Fix: Use pnpm install instead of pnpm install --frozen-lockfile
Symptom: KEY_VAULTS_SECRET is not set Cause: Next.js SSG needs env vars at build time Fix: Add ARG/ENV placeholders in build stage
Symptom: spawn /bin/node ENOENT Cause: Scripts hardcode /bin/node but node:slim has it at /usr/local/bin/node Fix: Add RUN ln -sf /usr/local/bin/node /bin/node
Symptom: Cannot find module 'drizzle-orm' at runtime Cause: Next.js standalone doesn't include all node_modules Prevention: Analysis phase detects standalone + ORM combination Fix: Install ORM separately in /deps and copy to final image
Symptom: Build succeeds but output files missing (e.g., assets-manifest.json not found) Cause: Using yarn workspace @scope/pkg build instead of detected custom CLI syntax Prevention: Analysis phase Step 14 detects custom CLI Fix: Use detected CLI syntax for all build commands
Symptom: Failed to open git repo or nodegit errors Cause: Build tool requires git commit hash for versioning Prevention: Analysis phase Step 14 detects git hash dependency Fix: Set ENV GITHUB_SHA=docker-build to bypass git requirement
Symptom: CLI initialization (e.g., ${CLI_NAME} init) fails silently Cause: .prettierrc, .prettierignore, or other config files excluded Prevention: Analysis phase Step 14 detects config file dependencies Fix: Remove config files from .dockerignore exclusions
Symptom: ENOENT: no such file or directory, open '/app/static/assets-manifest.json' Cause: Frontend builds to different path than backend expects Prevention: Analysis phase Step 14 detects static asset path mapping Fix: Copy frontend outputs to backend's expected path in Dockerfile
A successful Dockerfile must:
Build Phase:
docker buildx build exits 0)Runtime Phase - CRITICAL:
DO NOT declare success if:
After successful build, perform FULL validation:
# 1. Start services
docker-compose up -d
sleep 30 # Wait for startup
# 2. Check container status
docker-compose ps
# Expected: All containers UP and HEALTHY
# 3. Verify database migrations
if [ migrations_detected ]; then
# List tables
docker-compose exec postgres psql -U <user> -d <db> -c "\dt"
# Expected: List of tables (users, sessions, etc.)
# If "Did not find any relations" → FAIL
# Count migrations
MIGRATION_COUNT=$(docker-compose exec postgres psql -U <user> -d <db> -t -c "SELECT COUNT(*) FROM <migration_table>;")
# Expected: Matches analysis count (e.g., 76)
fi
# 4. Test application health
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" http://localhost:3210)
# Expected: 200, 302, or 401
# Unacceptable: 500, 502, 503
if [ "$HTTP_CODE" = "500" ]; then
echo "FAILURE: App returning 500 error"
docker-compose logs app
exit 1
fi
# 5. Check for errors in logs
docker-compose logs app | grep -i "error" | tail -20
# Should NOT contain:
# - "relation does not exist"
# - "table not found"
# - "Cannot find module"
# 6. Check image size
docker images <image-name>
# 7. Cleanup (if needed)
docker-compose downValidation Checklist:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.