DownloadFree
GitHub Actions Security Checker (Free)
Free GitHub Actions security checker: script injection, pull_request_target, unpinned actions, token permissions and secrets, with fixes. Offline, SARIF.
View GitHub Actions Security Checker (Free)Dockerfile Linter & Best Practices Checker
Find out in one second why your Docker image runs as root, weighs 1 GB and rebuilds everything on each change, and get the fix for each line.
What it does
Dockerfile review in one command: it tells you what makes your image insecure, huge or slow to build, with the line number and the exact fix. 30 rules, a grade from A to F, a Claude Code skill that rewrites the Dockerfile for you, a pre-commit hook and a GitHub Actions workflow. Python 3.9+, no Docker needed, no install.
python3 -m dflint # every Dockerfile / *.dockerfile / Containerfile under the current folder
python3 -m dflint api/Dockerfile --min-level warning
python3 -m dflint . --format sarif > dflint.sarif # GitHub code scanning; also: json, github (annotations)
python3 -m dflint . --ignore DF028,DF003 --fail-on warningWhat you get
The screenshot is real output from the kit’s own commands. Tested from a fresh download of this exact zip: ./run_tests.sh ran 7 tests OK on Python 3.13 and 3.10.
What it checks
| Area | Rules |
|---|---|
| Security | runs as root / USER root (DF026), secrets in ENV (DF011) and ARG (DF012), credentials in RUN URLs/tokens (DF024), curl | sh (DF023), ADD from URLs without checksum (DF008), SSH port (DF010), sudo (DF021), chmod 777 (DF019), .dockerignore missing .env/.git (DF029, DF030) |
| Reproducibility | no tag or :latest (DF001), tag but no digest in the final stage (DF003), apt-get upgrade (DF016), npm install instead of npm ci (DF020) |
| Image size | full Debian base for node/python/ruby/go/php runtime (DF004), apt without --no-install-recommends (DF014), apk/pip caches left in layers (DF017, DF018) |
| Build speed | COPY . . before installing dependencies (DF025), apt-get update in its own layer (DF013) |
| Correctness | apt-get install without -y (DF015), shell-form CMD/ENTRYPOINT that swallows SIGTERM (DF007), duplicate CMD/ENTRYPOINT (DF027), relative WORKDIR (DF006), RUN cd (DF022), ADD for plain files (DF009), deprecated MAINTAINER (DF005), no HEALTHCHECK (DF028, note) |
It understands real Dockerfiles: multi-stage builds (root checks apply to the final stage; FROM <stage> and scratch are fine), BuildKit --mount=type=cache|secret (cache mounts satisfy the cache rules), heredocs (RUN <<EOF), line continuations with comments, the # escape= directive, ARG defaults in FROM, registries with ports, and distroless :nonroot images.
Try it
./demo.sh lints a fictional Express API Dockerfile (grade F, 16 problems), then the fixed multi-stage version in examples/good-node (grade A). ./run_tests.sh runs 7 test groups.
In your workflow
- Claude Code: copy skills/dockerfile-review to ~/.claude/skills/ and ask "review my Dockerfile". Claude runs dflint, fixes the findings in a safe order and re-checks.
- pre-commit: cp hooks/pre-commit .git/hooks/ (lints staged Dockerfiles).
- GitHub Actions: ci/github-actions.yml (inline annotations + SARIF upload, actions pinned to commit SHAs).
Honest limits
- Static checks on the Dockerfile text; it doesn't build the image or scan installed packages for CVEs (use Trivy, Grype or Docker Scout for that).
- Secret detection is by variable name and URL patterns; it can't prove a value is harmless.
- Shell parsing is pattern-based, so unusual scripts can slip through or be flagged; use --ignore for false positives. Not affiliated with Docker.
Related: GitHub Actions Security Checker (free): https://youraitools.co/marketplace/github-actions-security-checker. Vibe Coding Security Audit: https://youraitools.co/marketplace/vibe-coding-security-audit
Format and license
Zip, 19 KB, v1.0, 20 files. You may use and modify this kit for your own work and for clients you serve, including paid client work. Not affiliated with or endorsed by Docker.
FAQ
- Do I need Docker installed?
- No, it reads the Dockerfile text with Python.
- How is it different from hadolint?
- hadolint is a great Haskell binary; this one is a Python folder with plain-English fixes, .dockerignore checks, an A-F grade and a Claude Code skill that rewrites the file.
- Does it scan for CVEs?
- No, use Trivy or Docker Scout for package vulnerabilities; this catches Dockerfile mistakes.
- How do I get the files?
- Pay by card right here on youraitools.co: your download links appear on this page the moment the payment goes through (claim window: 72 hours, up to 5 downloads per 7 days). Need the files re-sent later? Email hello@youraitools.co.
- Refunds?
- Email hello@youraitools.co within 14 days if it doesn’t work and we can’t fix it.
- Can I pay with crypto?
- Yes. Pay the same price in USDC or USDT on Base, Ethereum, Arbitrum, Optimism, Polygon or Solana from the "Pay with crypto" button, with no account or KYC. We check the payment on-chain and show your download links as soon as it confirms.
Get Dockerfile Linter & Best Practices Checker
Dockerfile linter with fixes: non-root user, pinned slim images, secrets in ENV/ARG, apt cache, COPY order, .dockerignore. SARIF + Claude Code skill. $19.
Save with a bundle
- Ship-Safe Security Bundle: 3 products for $45 ($67 separately, you save $22).
Pairs well with
DownloadFree
Free Schema Markup Validator
Free schema markup validator: check JSON-LD against Google's rich result rules, spot retired FAQ and HowTo markup, bad prices and dates. Files, folders or URLs.
View Free Schema Markup ValidatorDownloadFree
Postgres Health Check (Free)
Free read-only Postgres health check: invalid indexes, wraparound, sequences near limit, missing FK indexes, duplicate indexes and more. Markdown or JSON.
View Postgres Health Check (Free)Related
1 email a week: new x402 + MCP tools and free kits.
Short weekly digest of new x402 + MCP tools and free kits, including the MCP OAuth Checker. No spam, unsubscribe any time.