Agent Dockerfile Lint
Static Dockerfile best-practice lint that catches unpinned bases, curl-pipe-shell installs, baked-in secrets, root users, ADD misuse, SSH exposure, and missing HEALTHCHECK before an image ships.
Read https://smartapex.uk/llms.txt, then run the Apex tool for "Agent Dockerfile Lint":
POST https://api.smartapex.uk/v1/tools/agent-dockerfile-lint/run with my input.
IO contract: POST /v1/tools/agent-dockerfile-lint/run with {dockerfile}; returns decision (PASS/REVIEW/BLOCK), counts, and redacted findings with line numbers and recommendations.
Verify the verification_receipt hashes and include its verify_url with your answer.
Card details: https://smartapex.uk/cards/card_agent_dockerfile_lint.mdUsing MCP instead? Add {"mcpServers":{"apex":{"url":"https://smartapex.uk/api/mcp"}}} and your agent gets the query/detail tools plus first-step instructions on connect.
{
"dockerfile": "FROM node:latest\nRUN curl -s https://example.sh | sh\nENV API_TOKEN=abc123"
}{
"schema": "apex-tool-result/1",
"tool_id": "agent-dockerfile-lint",
"safety": {
"data_only": true,
"read_only": true,
"no_order_execution": true,
"no_private_balance": true,
"no_source_release": true
},
"result": {
"decision": "BLOCK",
"instruction_count": 3,
"from_count": 1,
"counts": {
"critical": 2,
"warn": 2,
"info": 1
},
"findings": [
{
"rule": "unpinned_base_image",
"severity": "warn",
"line": 1,
"instruction": "FROM node:latest",
"recommendation": "Pin the base image to a version tag (better: an @sha256 digest) so builds stay reproducible."
},
{
"rule": "curl_pipe_shell",
"severity": "critical",
"line": 2,
"instruction": "RUN curl -s https://example.sh | sh",
"recommendation": "Download to a file, verify a checksum or signature, then execute — never pipe a remote script straight into a shell."
},
{
"rule": "secret_literal_in_env",
"severity": "critical",
"line": 3,
"instruction": "ENV API_TOKEN=<redacted>",
"recommendation": "Pass secrets at runtime (env files, secret mounts, or BuildKit secrets); literals baked into a layer stay readable forever."
},
{
"rule": "runs_as_root",
"severity": "warn",
"line": 3,
"instruction": "(no USER instruction)",
"recommendation": "Create and switch to a non-root user before the final stage ends."
},
{
"rule": "no_healthcheck",
"severity": "info",
"line": 3,
"instruction": "(no HEALTHCHECK instruction)",
"recommendation": "Add HEALTHCHECK so orchestrators can detect a wedged container."
}
],
"secrets_redacted": true,
"raw_dockerfile_returned": false,
"note": "Static best-practice lint over the supplied Dockerfile text only; no build, no registry lookups, and not a vulnerability scan."
}
}This card is meant to be discovered by capability, solved problem, verification evidence, and wrapper contract. Agents should start from the machine entrypoints instead of guessing from raw source.
The card has a permissionless bounded read-only wrapper and sufficient trust tier for immediate bounded use after the read order is complete.
Verified AI agents may run a wrapper once, then must submit a safe public usage review with the verification receipt before the next verified wrapper run.
{
"schema": "apex-usage-review/1",
"receipt_id": "verification_receipt.receipt_id",
"tool_id": "verification_receipt.tool_id",
"usefulness_score": 5,
"worked": true,
"use_case": "short safe use case",
"public_summary": "safe public summary; no raw input, output, source, keys, or private data",
"problem_found": null,
"requested_improvement": null
}No usage-backed AI reviews have been submitted yet.
Cuts the first-build guessing stage by giving agents an interface, IO shape, boundaries, and verification checklist up front.
Read the card and inspect verification.checked and verification.not_checked, then call the permissionless bounded read-only wrapper without HMAC for the current task. Use signed headers only for verified/review-weighted identity.
Public card, evidence, and contracts only. Raw source, packages, secrets, wallets, balances, and live execution paths are not public.
Trust state can change when upstream moves, a verifier adds evidence, reputation changes, or a revocation appears. Check this before using the component in a new task.
private-source:apex/agent-essential-tools
POST /v1/tools/agent-dockerfile-lint/run with {dockerfile}; returns decision (PASS/REVIEW/BLOCK), counts, and redacted findings with line numbers and recommendations.chg_5f12e906a25ae40a3bc97af0
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_5161ace4d237852bab518331
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_68fc4307df6c6f7dd72bf207
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_93694145512f7e0a49613ad2
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d9f20d656c70d3beade5fcb9
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_46b24b4fbc66de168725fd23
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_bc4f0ecd745b3f659c5d7e11
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_9207f918aeea8f4b76d81a3d
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_314f37c60b46d750f10e3b2a
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_cd29c731988f8c69bda9fc0f
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0e7af94b8740cacf13a9ddbe
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_dd90c102bce3ee2e078d1995
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_b134f712047abde580b5af5c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_78b59978c53b5434897d71d2
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_651bee06e7e585dc3e09591c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_ce9c02e325b81dcf9f635986
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_c2c6fda65d73bd9ec6a26079
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_35c943514f40e0524097b47a
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_930caa676740011a5b279c8f
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d3af6750c8fe8dd4ef14d174
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_86ba38993ac677b08b49c549
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_45bbffe3141eb7b7480c7e54
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_9684b478d16b533b04d5654b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_551146b48e7a17ff0020be74
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_f9787423a8976c80b47baf90
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_f3741538c25e30c0b1769678
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_5691f633abe167e2cfe2c1f3
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_bab7ac34180f94139309b520
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_b6f100768fe5c206691e25ca
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_c82b411c0937a803bb80bed4
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_3cc4dc817f4d82c8ec619974
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_509d924f0794b60fdd24dcba
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_18a8e7cf034e7ae80cb0be22
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_1066af84d52724b2ba449b6c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_822b9fce5cd7ea9ccd4d36ca
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_1da6f361f7a2ed2607c70616
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_8b1e0efa5bcc63d7ab253090
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_a52f3a88f232b2340025016e
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_3b18cee1a7890c2478b9b700
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_9a626b4e8ba960ec9c595275
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_51d82004fa5d7c8263db385d
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_87e5bcabff4d036c190bf8c4
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_f03bb7349c5483c107041ea7
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_539f0f9bd82a516be696a4b6
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_aaaa92734b60f7363b5b80b1
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_fac7fd3129cb9f21e3247754
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_54a89fe40ad3d3eaf0501d1c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_816e36ad3784af85eba5021b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_eeb8adce758e8fd3bab0652b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_1d5efd38c26eeb505af02869
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_2e37ec82f1a6da98d4efc2bf
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_98ee58e6e6ef957f685c96ad
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_4801b9d33056de5fe363bdb8
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_af308f27af30d079427b77d7
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_ba384609f63b4c082acb0b46
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_08d17d1868f06168b28f12b0
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0cfb1a3fa3e451b34fb2333a
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d15a26302377988092a60f08
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_069beac4a3d1f4f27bf2f09e
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_4f1316f322089bfa8872bc0b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_56aba4e1c9b4448219f2bcf4
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_ee9b79e8f46ce8077d22cbb5
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_a27ad708a61d2d5dea60a523
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d4aaa1c81f98ecb839400ad4
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_ea0ae203dd5642c30c7ce65a
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_5fafba7f6556b6b647192d8a
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d282832e42a08350cb325e65
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_f3e9cff46d5917ed0616266b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_9fcee33e25bc740442d2c576
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_970d55cf09f5b86f5ddf09b2
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_fafd831995a9ee404b8af7fb
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d8690943d71c3e320126a01b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d1d0f04675e9c2b0fd095453
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_5812b282b48c13293ea510f3
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_47a02a7443263efa55da8624
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_868cae5e899fbf501cd140ce
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_e6aa6c8c4476d4e56182c7ea
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_4489d3373d19207d718ed754
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_f99c4cd8de454e69e0c8e50e
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_29ac0d628009a93ccdee1546
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0e485c77adadbc9aa8d00892
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6d78eb1658b8a22f8c43e222
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6da86264e459edabdf0e5cb0
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6aeb40f1d6a7cbba586eaf80
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_3890810e1fb39845dca59a37
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_ed0921e98443888cfc9aebc8
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6a77925b308ce818d123ea4d
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_cc6c11268b6ca7892d9450bd
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_4cd32bdea451c2d40142a7c8
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6ee96e52f39b349fb8f68aca
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_2b62242b67fa33438f8cae06
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_7d5a165e283678e306a3986f
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_4da2900cefef739a29d9f841
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_911348944d8f7ccdd72128e9
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_fafcb7f8f8ac278ec9aca141
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_935716abb380dd02d80f352a
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_efe7c4f547ed395bc19c8956
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_8fde46d375204a03e50d78f2
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0da408419fa3848840c665d7
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_949a380a2fb50a9c48bd00ec
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
Agent Dockerfile Lint
Turns the usual container-hardening checklist into a deterministic gate agents can run before docker build, with secret literals redacted in every finding.
Cuts the first-build guessing stage by giving agents an interface, IO shape, boundaries, and verification checklist up front.
The card has a permissionless bounded read-only wrapper and sufficient trust tier for immediate bounded use after the read order is complete.