All Posts

Release: Static analysis for Dockerfile

Release: Static analysis for Dockerfile

If you are shipping code to production today, there are very high chances that you've been using Docker to containerize your application so it runs reliably in all environments — local, staging, production, and anything in the middle. With Dockerfiles becoming a regular feature in most projects, it is important to ensure that you're shipping good Dockerfiles as well.

DeepSource now supports continuous static analysis for Dockerfiles, with 70+ issues like bug risks, anti-patterns, security vulnerabilities, and performance optimizations detected.

Using the Docker analyzer

To start analyzing your Dockerfiles, just enable the docker analyzer in your .deepsource.toml file, and you are good to go.

By default, DeepSource analyzes the Dockerfile present in your repository's root. If you have a different name for your Dockerfile, or have many of them, you can specify the paths explicitly in the meta. You can also optionally define the trusted registries if you're pulling images from a 3rd-party image registry.

Sample configuration

version = 1

name = "docker"
enabled = true

  dockerfile_paths = [  # optional

  trusted_registries = [  # optional

Look at the docs for more details.

Issues detected by the Docker analyzer

At the time of writing this, the analyzer detects 70+ issues in your Dockerfile, of categories like bug risks, anti-patterns, security vulnerabilities, and performance optimizations. Here's some of them to give you an idea:

Security issues:

  • Last user should not be root
  • Use only an allowed registry in the FROM image

Bug risks:

  • COPY --from should reference a previously defined FROM alias
  • Multiple ENTRYPOINT instructions detected
  • Multiple CMD instructions detected

Performance issues:

  • Use COPY instead of ADD for files and folders
  • Use ADD for extracting archives into an image
  • Delete the apt-get lists after installing something

We're super excited about this release, and we hope this will help you avoid many gotchas and security issues with your Docker containers. Head over to the docs or tell us what you think!

Get started with DeepSource

DeepSource is free forever for small teams and open-source projects. Start analyzing your code in less than 2 minutes.


Read product updates, company announcements, how we build DeepSource, what we think about good code, and more.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.