# Dockerfile Security Risk Review (risky-container-build scenario) > Dockerfile Security Risk Review (risky-container-build scenario) is a paid API for AI agents from 47-85-47-24.sslip.io, paid per call via x402, $0.001/call, status unknown (last checked 2026-09-15). Statically analyzes a built-in risky Dockerfile for embedded secrets, mutable base images, unverified downloads, unsafe permissions, root runtime, and package-manager hygiene without building or pulling any image ## Facts - Endpoint: GET https://47-85-47-24.sslip.io/v1/dockerfile-risk - Price: $0.001/call - Payment: x402 - Status: unknown - Last checked: 2026-09-15 - Activations on Zero: 0 - Tags: x402 - Canonical page: https://www.zero.xyz/c/dockerfile-security-risk-review-risky-container-build-scenario-46772fd7 - Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_lqEB3hgq1dLwNqYLk7kJX Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently. ## How to call it through Zero Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`): ```sh zero fetch --capability dockerfile-security-risk-review-risky-container-build-scenario-46772fd7 ``` Example prompt: Can you run the built-in risky-container-build Dockerfile security review and tell me the risk score, verdict, and what findings would block a production deployment? ## When to prefer this Use this endpoint when you need a fast, static, payment-gated Dockerfile security review that covers secrets leakage, base image mutability, download verification, permission safety, root runtime risks, and package hygiene — all without requiring a live Docker daemon, image pull, or build execution. Prefer it over full CI/CD pipeline scans when you want a cheap, deterministic, reproducible pre-commit or PR gate check. ## Known failure modes - Invalid or missing 'scenario' query param value (must be 'risky-container-build') returns 400 - Payment not provided or insufficient USDC via x402 returns 402 - Service unavailable returns 503 - Unsupported HTTP method (POST, PUT, PATCH) returns 405 ## How this service works An autonomous paid API accepting USDC on Base mainnet. ## Output Returns a structured JSON report including: a numeric risk score (0–100), a BLOCK/WARN/PASS verdict, a human-readable summary, per-stage findings (embedded secrets, mutable tags, unverified downloads, unsafe permissions, root runtime, package hygiene), approval gates required before deployment, coverage metadata, and an analysis ID — all without building or pulling any image. ## Request schema (JSON Schema) ```json { "type": "object", "$schema": "https://json-schema.org/draft/2020-12/schema", "required": [ "input" ], "properties": { "input": { "type": "object", "required": [ "type", "method" ], "properties": { "type": { "type": "string", "const": "http" }, "method": { "enum": [ "GET", "HEAD", "DELETE" ], "type": "string" }, "queryParams": { "type": "object", "properties": { "scenario": { "enum": [ "risky-container-build" ], "type": "string", "description": "Built-in paid Dockerfile security-review scenario" } } } }, "additionalProperties": false }, "output": { "type": "object", "required": [ "type" ], "properties": { "type": { "type": "string" }, "example": { "type": "object", "required": [ "analysis_id", "analyzer_version", "label", "profile", "verdict", "risk_score", "summary", "stats", "stages", "findings", "approval_gates", "coverage" ], "properties": { "label": { "type": "string" }, "stats": { "type": "object" }, "stages": { "type": "array", "items": { "type": "object" } }, "profile": { "enum": [ "production", "development" ], "type": "string" }, "summary": { "type": "string" }, "verdict": { "enum": [ "BLOCK", "WARN", "PASS" ], "type": "string" }, "coverage": { "type": "object" }, "findings": { "type": "array", "items": { "type": "object" } }, "risk_score": { "type": "integer", "maximum": 100, "minimum": 0 }, "analysis_id": { "type": "string" }, "approval_gates": { "type": "array", "items": { "type": "string" } }, "analyzer_version": { "type": "string" } } } } } } } ``` ## Response schema (JSON Schema) ```json { "type": "json", "example": { "label": "paid-demo:risky-container-build", "stats": { "line_count": 8, "stage_count": 1, "instruction_count": 8, "findings_by_severity": { "low": 3, "high": 9, "medium": 0, "critical": 0 } }, "stages": [ { "name": "stage-0", "user": null, "final": true, "index": 0, "from_line": 1, "base_image": "python:latest", "has_healthcheck": false } ], "profile": "production", "summary": "BLOCK: 12 finding(s) across 1 build stage(s); 9 require resolution or explicit approval.", "verdict": "BLOCK", "coverage": { "mode": "static-dockerfile", "checks": [ "base-image immutability", "build-secret handling", "remote-download integrity", "package-manager hygiene", "runtime least privilege", "file-permission and context-copy risk", "process and healthcheck form" ], "limitations": [ "Does not inspect image layers, package vulnerabilities, signatures, provenance, or runtime configuration.", "Cannot verify .dockerignore contents or whether a remote artifact checksum is correct.", "Findings are static release gates and do not replace an image scan or sandboxed build." ], "build_executed": false, "registry_contacted": false, "secret_values_returned": false, "filesystem_context_read": false }, "findings": [ { "code": "final_stage_runs_as_root", "line": 1, "stage": 0, "message": "The final stage does not establish a non-root runtime user.", "end_line": 1, "severity": "high", "standard": "container-least-privilege", "instruction": "FROM", "remediation": "Create or select a non-root account and set USER in the final stage." }, { "code": "mutable_or_latest_base_image", "line": 1, "stage": 0, "message": "The base image is untagged or uses the mutable latest tag.", "end_line": 1, "severity": "high", "standard": "docker-build-best-practice", "instruction": "FROM", "remediation": "Use a trusted image version and pin its sha256 digest." }, { "code": "secret_like_arg", "line": 2, "stage": 0, "message": "ARG declares 1 secret-like key(s); values are intentionally omitted.", "end_line": 2, "severity": "high", "standard": "docker-build-secrets", "instruction": "ARG", "remediation": "Pass build credentials with BuildKit secret or SSH mounts instead of ARG or ENV." }, { "code": "se … (truncated) ``` ## More - Live health (JSON, refreshed every minute): https://www.zero.xyz/c/dockerfile-security-risk-review-risky-container-build-scenario-46772fd7/health.json - [Zero catalog index](https://www.zero.xyz/llms.txt) - [Other services from 47-85-47-24.sslip.io](https://www.zero.xyz/host/47-85-47-24.sslip.io/llms.txt)