# Dockerfile Linter

> Dockerfile Linter is a paid API for AI agents from bess-x402.onrender.com, paid per call via x402, $0.003/call, status unknown (last checked 2026-10-29).

Lints a Dockerfile for security vulnerabilities and best-practice violations, returning scored findings across multiple checks.

## Facts

- Endpoint: GET https://bess-x402.onrender.com/v1/dev/dockerfile-lint?utm_source=zero.xyz
- Price: $0.003/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/dockerfile-linter-1de2193f
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_TB9m2cXsL3JZMkHvOfxEi

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability dockerfile-linter-1de2193f
```

Example prompt: Can you lint this Dockerfile for security issues and best practices — check for things like running as root, unpinned images, secrets in ENV, and missing HEALTHCHECK?

FROM ubuntu:latest
RUN apt-get install -y curl
ENV SECRET_KEY=abc123
RUN curl https://example.com/setup.sh | sh

## When to prefer this

Use this endpoint when you need a fast, scored, multi-check security and best-practice audit of a Dockerfile without setting up a local linting tool like Hadolint. It is especially useful in CI/CD pipelines, pre-commit hooks, or agent workflows where you want a programmatic score and structured findings for a single Dockerfile. Prefer this over general code review endpoints when Docker-specific checks (unpinned images, HEALTHCHECK, curl-to-shell) are the priority.

## Known failure modes

- Missing 'dockerfile' query parameter returns an error
- Malformed or empty Dockerfile content may produce no findings or an error
- Very large Dockerfiles may hit request size limits
- Service unavailability on Render free tier (cold starts or downtime)
- Payment failure for x402 micropayment may block the request

## How this service works

Lint a Dockerfile for security and best practice: unpinned or latest images, running as root, secrets in ENV/ARG, curl piped to sh, ADD of URLs, apt and pip caches, sudo, chmod 777, missing HEALTHCHECK. Scored.

## Output

A scored report of Dockerfile issues, with findings across checks including: unpinned or 'latest' base images, running as root, secrets exposed in ENV/ARG, curl-piped-to-shell patterns, ADD with URLs, uncleaned apt/pip caches, use of sudo, chmod 777 permissions, and missing HEALTHCHECK directives. Each finding is categorized by severity or best-practice type, and an aggregate score is returned.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "dockerfile"
     ],
     "properties": {
      "dockerfile": {
       "type": "string",
       "description": "Dockerfile contents"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dockerfile-linter-1de2193f/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from bess-x402.onrender.com](https://www.zero.xyz/host/bess-x402.onrender.com/llms.txt)