docker-setup — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited docker-setup (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
!ls package.json requirements.txt pyproject.toml go.mod Cargo.toml *.csproj Gemfile composer.json mix.exs 2>/dev/null !ls Dockerfile docker-compose* .dockerignore 2>/dev/null !cat package.json 2>/dev/null | grep -E '"(main|scripts)"' -A 5 | head -10
From project files, determine:
Multi-stage build pattern:
# Stage 1: Dependencies
FROM base AS deps
COPY lock-file .
RUN install-command
# Stage 2: Build
FROM deps AS build
COPY source .
RUN build-command
# Stage 3: Production
FROM base-slim AS production
COPY --from=build /app/dist ./dist
CMD ["start-command"]Best practices to include:
latest.dockerignore to minimize contextservices:
app:
build: .
ports: ["3000:3000"]
environment: ...
depends_on: ...
volumes: ... # for dev: mount source code
healthcheck: ...
# Add required services
db: # if database detected
redis: # if cache detectedInclude:
node_modules/
.git/
dist/
build/
*.log
.env
.env.*Add comments explaining:
docker build -t app .docker compose uphttp://localhost:PORT~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.