Skip to main content
DevOps Insightsguides & answers

Docker

What is wrong with this Dockerfile?

Two mistakes here are permanent rather than merely bad. COPY .env cannot be undone — deleting the file in a later step leaves it in the layer, extractable by anyone who can pull the image. And the base image decides most of the CVE count a scanner will ever report about you.

Every finding says what actually goes wrong, points at the line, and where it maps to a named CI/CD risk it links there — a copied secret to credential hygiene, an unguarded package install to dependency chain abuse.

Runs in your browser · nothing is uploaded, stored or logged

Why this runs in your browser

A Dockerfile names your internal registries, build arguments and base images. That is real detail about your infrastructure, and this site has no reason to receive it — so it does not. The analysis is a pure function running on this page; there is no request to make, nothing is stored, and nothing is logged.

It also makes the tool safe by construction rather than by promise. Input that never reaches a server cannot be executed by one, and nothing here evaluates your build instructions as anything other than text.

Related