# CIAudit Dockerfile Linter

> CIAudit Dockerfile Linter is a paid API for AI agents from ciaudit.genexxis.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-29).

Statically analyzes a Dockerfile for security and hygiene issues including base image pinning, root user, secret exposure, and more, returning scored findings with line numbers and fix suggestions.

## Facts

- Endpoint: POST https://ciaudit.genexxis.com/dockerfile?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/ciaudit-dockerfile-linter-dcf8eaee
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_HcrllNAdBfyIVxOxdKC2f

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability ciaudit-dockerfile-linter-dcf8eaee -d '<json body>'
```

Example prompt: Can you audit this Dockerfile for security issues — check for things like running as root, pinned base images, exposed secrets in ENV or ARG, and curl-pipe-sh patterns, then give me a score and specific fixes for each finding?

## When to prefer this

Choose this endpoint when you need fast, structured Dockerfile-specific security feedback with line-level findings and actionable fixes, especially in CI/CD pipelines or pre-merge checks. Prefer it over general-purpose code review tools when you need Docker-specific checks like base image pinning, USER directives, HEALTHCHECK presence, and secret leakage in ENV/ARG layers.

## Known failure modes

- Dockerfile content exceeds 100 KB limit — request rejected
- Malformed or non-Dockerfile content may produce empty or misleading findings
- Missing 'content' field in request body returns an error
- Network timeout for very large files near the size limit
- False negatives for obfuscated or multi-stage Dockerfile patterns not covered by lint rules

## How this service works

Lint a Dockerfile: base image pinning, root user, curl|sh, remote ADD, secrets in ENV/ARG, apt/pip/npm hygiene, chmod 777, EXPOSE 22, HEALTHCHECK, layer cache order. Returns findings with line, why, fix and a score.

## Output

A JSON object containing an overall integer score (0-100), a summary of finding counts by severity (low, medium, high, total), and an array of findings each with an id, severity level, line number (if applicable), code snippet, human-readable explanation of why it's a problem, and a concrete fix recommendation.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "content": {
   "type": "string",
   "description": "Full text of the file (max 100 KB)"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "kind": "dockerfile",
  "score": 80,
  "summary": {
   "low": 4,
   "high": 0,
   "total": 5,
   "medium": 1
  },
  "findings": [
   {
    "id": "no_user",
    "fix": "Create an unprivileged user and add USER app (or USER 10001) before CMD",
    "why": "no USER in the final stage: the container runs as root",
    "line": null,
    "snippet": null,
    "severity": "medium"
   },
   {
    "id": "npm_install",
    "fix": "Use npm ci (with package-lock.json) for reproducible installs",
    "why": "npm install can change the lockfile and resolve different versions",
    "line": 4,
    "snippet": "RUN npm install",
    "severity": "low"
   }
  ]
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/ciaudit-dockerfile-linter-dcf8eaee/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from ciaudit.genexxis.com](https://www.zero.xyz/host/ciaudit.genexxis.com/llms.txt)