docker

Docker Code Review Rules

Security (Critical)

• Build-Time Variable Safety: Always sanitize build-time variables sourced from CI/CD or --build-arg to prevent injection attacks. Validate and escape externally-sourced values before using in ARG, ENV, or LABEL directives
• Template Variable Safety: Avoid template variables such as {{ }} and undeclared variables in Dockerfiles. Add linting step to scan for these patterns during review
• Run as non-root user (USER directive)
• Don't store secrets in image (use runtime injection)
• Don't use --privileged without justification
• Scan images for vulnerabilities
• Set readonly root filesystem where possible

Base Images (Essential)

• Pin base image to specific version (not latest)
• Use official images from trusted sources
• Prefer minimal images (alpine, slim, distroless)
• Regularly update base images for security patches