Lint Dockerfile

code.lint_dockerfile

ProductionHeuristic (Class C)Deterministicbest-effortfastv1.0.0

No network

Overview

When you send a Dockerfile, we apply a deterministic, bounded rule subset for common issues such as latest tags, root user, remote ADD, missing cache cleanup, curl|sh patterns, copied secrets, and missing HEALTHCHECK. This is line and keyword heuristics — not full ShellCheck or Hadolint parity. We never build images or execute instructions — do not use this as authoritative CI linting or vulnerability scanning.

Agent-authored Dockerfiles often ship insecure defaults. We catch a bounded set deterministically before you build.

Reliability

Best-effort heuristics; deterministic for identical input. Findings are advisory — no findings does not certify security. Oversized input throws SIZE_LIMIT_EXCEEDED — shorten the Dockerfile before retrying.

Context footprint

Returns validSyntax, findingCount, and a bounded sorted findings list. A successful call costs 1 execution credit.

When to use it

When you have Dockerfile text and want fast advisory findings.

For CVE scanning, builds, or Hadolint-equivalent coverage.

Scope

Note

Applies a bounded Dockerfile best-practice heuristic rule subset.

Non-goals

Does not build images
Does not execute instructions
Does not pull base images
Does not ShellCheck RUN shell grammar
Not Hadolint parity — documented subset only

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

analysisvalidation

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input976.6 KB

How we handle your data

Sensitive input, safe output

What this means

This skill may receive sensitive content, but it does not target sensitive data and returns only a structured non-sensitive result.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
This skill does not target sensitive data.
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
dockerfile	string	Yes	Exact Dockerfile text to inspect.
ruleSet	string	No	Rule-category selection; omit it for default.
ignoreRules	array	No	From 0 through 10 ignored rule identifiers; omit it for none.
maxFindings	integer	No	Returned finding ceiling; omit it for 500.

Output schema

Field	Type	Required	Description
validSyntax	boolean	Yes	Whether every non-comment line used a known instruction.
findingCount	integer	Yes	Number of returned findings.
findings	array	Yes	From 0 through 10,000 findings sorted by line and rule identifier.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"code.lint_dockerfile","input":{"dockerfile":"FROM node:latest"}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("code.lint_dockerfile", {"dockerfile":"FROM node:latest\nUSER root\n"});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not build images
Does not execute instructions
Does not pull base images
Does not ShellCheck RUN shell grammar
Not Hadolint parity — documented subset only
Full image vulnerability scanning
Authoritative CI lint gates

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "code.lint_dockerfile",
  "input": {
    "dockerfile": "FROM node:latest\nUSER root\n"
  }
}

Examples

Latest tag and root user flagged

Inputjson

{
  "dockerfile": "FROM node:latest\nUSER root\n"
}

Expected outputjson

{
  "validSyntax": true,
  "findings": [
    {
      "message": "Base image uses the 'latest' or an implicit tag.",
      "ruleId": "DL001",
      "recommendation": "Pin the image tag or digest.",
      "severity": "warning",
      "line": 1
    },
    {
      "message": "Base image is not pinned by digest.",
      "ruleId": "DL002",
      "recommendation": "Pin the base image by @sha256 digest for reproducibility.",
      "severity": "warning",
      "line": 1
    },
    {
      "message": "Container runs as root.",
      "ruleId": "DL004",
      "recommendation": "Create and switch to a non-root USER.",
      "severity": "warning",
      "line": 2
    }
  ],
  "findingCount": 3
}

Pinned digest and non-root user pass default rules