Dockerfile Security Risk Review (risky-container-build scenario)

{
  "type": "json",
  "example": {
    "label": "paid-demo:risky-container-build",
    "stats": {
      "line_count": 8,
      "stage_count": 1,
      "instruction_count": 8,
      "findings_by_severity": {
        "low": 3,
        "high": 9,
        "medium": 0,
        "critical": 0
      }
    },
    "stages": [
      {
        "name": "stage-0",
        "user": null,
        "final": true,
        "index": 0,
        "from_line": 1,
        "base_image": "python:latest",
        "has_healthcheck": false
      }
    ],
    "profile": "production",
    "summary": "BLOCK: 12 finding(s) across 1 build stage(s); 9 require resolution or explicit approval.",
    "verdict": "BLOCK",
    "coverage": {
      "mode": "static-dockerfile",
      "checks": [
        "base-image immutability",
        "build-secret handling",
        "remote-download integrity",
        "package-manager hygiene",
        "runtime least privilege",
        "file-permission and context-copy risk",
        "process and healthcheck form"
      ],
      "limitations": [
        "Does not inspect image layers, package vulnerabilities, signatures, provenance, or runtime configuration.",
        "Cannot verify .dockerignore contents or whether a remote artifact checksum is correct.",
        "Findings are static release gates and do not replace an image scan or sandboxed build."
      ],
      "build_executed": false,
      "registry_contacted": false,
      "secret_values_returned": false,
      "filesystem_context_read": false
    },
    "findings": [
      {
        "code": "final_stage_runs_as_root",
        "line": 1,
        "stage": 0,
        "message": "The final stage does not establish a non-root runtime user.",
        "end_line": 1,
        "severity": "high",
        "standard": "container-least-privilege",
        "instruction": "FROM",
        "remediation": "Create or select a non-root account and set USER in the final stage."
      },
      {
        "code": "mutable_or_latest_base_image",
        "line": 1,
        "stage": 0,
        "message": "The base image is untagged or uses the mutable latest tag.",
        "end_line": 1,
        "severity": "high",
        "standard": "docker-build-best-practice",
        "instruction": "FROM",
        "remediation": "Use a trusted image version and pin its sha256 digest."
      },
      {
        "code": "secret_like_arg",
        "line": 2,
        "stage": 0,
        "message": "ARG declares 1 secret-like key(s); values are intentionally omitted.",
        "end_line": 2,
        "severity": "high",
        "standard": "docker-build-secrets",
        "instruction": "ARG",
        "remediation": "Pass build credentials with BuildKit secret or SSH mounts instead of ARG or ENV."
      },
      {
        "code": "secret_like_env",
        "line": 3,
        "stage": 0,
        "message": "ENV declares 1 secret-like key(s); values are intentionally omitted.",
        "end_line": 3,
        "severity": "high",
        "standard": "docker-build-secrets",
        "instruction": "ENV",
        "remediation": "Pass build credentials with BuildKit secret or SSH mounts instead of ARG or ENV."
      },
      {
        "code": "remote_add_without_checksum",
        "line": 4,
        "stage": 0,
        "message": "ADD downloads a remote resource without an explicit checksum.",
        "end_line": 4,
        "severity": "high",
        "standard": "dockerfile-reference",
        "instruction": "ADD",
        "remediation": "Use ADD --checksum=sha256:<digest>, or download and verify the artifact in one RUN layer."
      },
      {
        "code": "sensitive_file_copied",
        "line": 5,
        "stage": 0,
        "message": "A secret-like credential or configuration path is copied into an image layer; the path value is omitted.",
        "end_line": 5,
        "severity": "high",
        "standard": "docker-build-secrets",
        "instruction": "COPY",
        "remediation": "Exclude the file with .dockerignore and inject required credentials through runtime or BuildKit secrets."
      },
      {
        "code": "remote_script_piped_to_shell",
        "line": 6,
        "stage": 0,
        "message": "A remotely downloaded script is piped directly to a shell.",
        "end_line": 6,
        "severity": "high",
        "standard": "software-supply-chain",
        "instruction": "RUN",
        "remediation": "Download a versioned artifact, verify its checksum or signature, inspect it, then execute it."
      },
      {
        "code": "tls_verification_disabled",
        "line": 6,
        "stage": 0,
        "message": "A download command disables TLS certificate verification.",
        "end_line": 6,
        "severity": "high",
        "standard": "software-supply-chain",
        "instruction": "RUN",
        "remediation": "Restore certificate verification and trust only an explicit CA when required."
      },
      {
        "code": "world_writable_permissions",
        "line": 6,
        "stage": 0,
        "message": "RUN creates world-writable permissions with chmod 777.",
        "end_line": 6,
        "severity": "high",
        "standard": "container-least-privilege",
        "instruction": "RUN",
        "remediation": "Grant the narrowest owner/group permissions required by the runtime user."
      },
      {
        "code": "missing_healthcheck",
        "line": 1,
        "stage": 0,
        "message": "The production final stage has no active HEALTHCHECK instruction.",
        "end_line": 1,
        "severity": "low",
        "standard": "dockerfile-reference",
        "instruction": "FROM",
        "remediation": "Add a bounded HEALTHCHECK or document that the orchestrator owns equivalent probes."
      },
      {
        "code": "relative_workdir",
        "line": 7,
        "stage": 0,
        "message": "WORKDIR uses a relative path.",
        "end_line": 7,
        "severity": "low",
        "standard": "docker-build-best-practice",
        "instruction": "WORKDIR",
        "remediation": "Use an absolute WORKDIR for predictable filesystem layout."
      },
      {
        "code": "shell_form_process_instruction",
        "line": 8,
        "stage": 0,
        "message": "CMD uses shell form, which can complicate signal and argument handling.",
        "end_line": 8,
        "severity": "low",
        "standard": "dockerfile-reference",
        "instruction": "CMD",
        "remediation": "Use JSON exec form for CMD when shell expansion is not required."
      }
    ],
    "risk_score": 100,
    "analysis_id": "docker-324e1d9d94b0d50a2959",
    "approval_gates": [
      "Resolve or explicitly approve 9 critical/high finding(s) before publishing the image.",
      "Confirm that no credential remains in image layers, build history, or copied context.",
      "Require a documented exception if the production process must run as root."
    ],
    "analyzer_version": "dockerguard-dockerfile/1.0"
  }
}