Docker & container security anti-pattern analyzer -- detects Dockerfile issues, missing health checks, resource limit gaps, privileged containers, insecure n...
---
name: ContainerLint
version: 1.0.0
description: "Docker & container security anti-pattern analyzer -- detects Dockerfile issues, missing health checks, resource limit gaps, privileged containers, insecure networking, and orchestration anti-patterns"
homepage: https://containerlint.pages.dev
metadata:
{
"openclaw": {
"emoji": "\ud83d\udc33",
"primaryEnv": "CONTAINERLINT_LICENSE_KEY",
"requires": {
"bins": ["git", "bash", "python3", "jq"]
},
"configPaths": ["~/.openclaw/openclaw.json"],
"install": [
{
"id": "lefthook",
"kind": "brew",
"formula": "lefthook",
"bins": ["lefthook"],
"label": "Install lefthook (git hooks manager)"
}
],
"os": ["darwin", "linux", "win32"]
}
}
user-invocable: true
disable-model-invocation: false
---
# ContainerLint -- Docker & Container Security Anti-Pattern Analyzer
ContainerLint scans codebases for Docker and container security anti-patterns, Dockerfile issues, missing health checks, resource limit gaps, privileged containers, insecure networking, and orchestration misconfigurations. It uses regex-based pattern matching against 90 container-specific patterns across 6 categories, lefthook for git hook integration, and produces markdown reports with actionable remediation guidance. 100% local. Zero telemetry.
## Commands
### Free Tier (No license required)
#### `containerlint scan [file|directory]`
One-shot container security scan of files or directories.
**How to execute:**
```bash
bash "<SKILL_DIR>/scripts/dispatcher.sh" --path [target]
```
**What it does:**
1. Accepts a file path or directory (defaults to current directory)
2. Discovers all source files (skips .git, node_modules, binaries, images, .min.js)
3. Runs 30 container security patterns against each file (free tier limit)
4. Calculates a container security score (0-100) per file and overall
5. Grades: A (90-100), B (80-89), C (70-79), D (60-69), F (<60)
6. Outputs findings with: file, line number, check ID, severity, description, recommendation
7. Exit code 0 if score >= 70, exit code 1 if container security is poor
8. Free tier limited to first 30 patterns (DF + SC categories)
**Example usage scenarios:**
- "Scan my code for Dockerfile issues" -> runs `containerlint scan .`
- "Check this file for container anti-patterns" -> runs `containerlint scan docker-compose.yml`
- "Find privileged containers" -> runs `containerlint scan .`
- "Audit container security in my project" -> runs `containerlint scan .`
- "Check for missing health checks" -> runs `containerlint scan .`
### Pro Tier ($19/user/month -- requires CONTAINERLINT_LICENSE_KEY)
#### `containerlint scan --tier pro [file|directory]`
Extended scan with 60 patterns covering Dockerfile, security context, health checks, and resource management.
**How to execute:**
```bash
bash "<SKILL_DIR>/scripts/dispatcher.sh" --path [target] --tier pro
```
**What it does:**
1. Validates Pro+ license
2. Runs 60 container security patterns (DF, SC, HC, RS categories)
3. Detects missing health checks and readiness probes
4. Identifies resource limit gaps and unbounded containers
5. Full category breakdown reporting
#### `containerlint scan --format json [directory]`
Generate JSON output for CI/CD integration.
```bash
bash "<SKILL_DIR>/scripts/dispatcher.sh" --path [directory] --format json
```
#### `containerlint scan --format html [directory]`
Generate HTML report for browser viewing.
```bash
bash "<SKILL_DIR>/scripts/dispatcher.sh" --path [directory] --format html
```
#### `containerlint scan --category HC [directory]`
Filter scan to a specific check category (DF, SC, HC, RS, NW, OR).
```bash
bash "<SKILL_DIR>/scripts/dispatcher.sh" --path [directory] --category HC
```
### Team Tier ($39/user/month -- requires CONTAINERLINT_LICENSE_KEY with team tier)
#### `containerlint scan --tier team [directory]`
Full scan with all 90 patterns across all 6 categories including networking and orchestration.
**How to execute:**
```bash
bash "<SKILL_DIR>/scripts/dispatcher.sh" --path [directory] --tier team
```
**What it does:**
1. Validates Team+ license
2. Runs all 90 patterns across 6 categories
3. Includes networking checks (host networking, exposed ports, insecure registries)
4. Includes orchestration checks (compose anti-patterns, missing restart policies)
5. Full category breakdown with per-file results
#### `containerlint scan --verbose [directory]`
Verbose output showing every matched line and pattern details.
```bash
bash "<SKILL_DIR>/scripts/dispatcher.sh" --path [directory] --verbose
```
#### `containerlint status`
Show license and configuration information.
```bash
bash "<SKILL_DIR>/scripts/dispatcher.sh" status
```
## Check Categories
ContainerLint detects 90 container security anti-patterns across 6 categories:
| Category | Code | Patterns | Description | Severity Range |
|----------|------|----------|-------------|----------------|
| **Dockerfile Best Practices** | DF | 15 | Missing USER directive, ADD instead of COPY, latest tag, missing .dockerignore patterns, multiple FROM without alias | medium -- high |
| **Security Context** | SC | 15 | Privileged mode, running as root, exposed secrets, capability escalation, no seccomp profile | high -- critical |
| **Health & Readiness** | HC | 15 | No HEALTHCHECK, missing readiness probes, no liveness checks, no startup probes | medium -- high |
| **Resource Management** | RS | 15 | No resource limits, no memory limits, no CPU limits, unbounded storage, no ephemeral storage limits | medium -- high |
| **Networking & Exposure** | NW | 15 | Exposing all ports, host networking, no network policy, publishing on 0.0.0.0, insecure registries | medium -- critical |
| **Orchestration & Compose** | OR | 15 | No restart policy, no replicas, hardcoded IPs in compose, no volume mounts for secrets, latest tag in compose | low -- high |
## Tier-Based Pattern Access
| Tier | Patterns | Categories |
|------|----------|------------|
| **Free** | 30 | DF, SC |
| **Pro** | 60 | DF, SC, HC, RS |
| **Team** | 90 | DF, SC, HC, RS, NW, OR |
| **Enterprise** | 90 | DF, SC, HC, RS, NW, OR + priority support |
## Scoring
ContainerLint uses a deductive scoring system starting at 100 (perfect):
| Severity | Point Deduction | Description |
|----------|-----------------|-------------|
| **Critical** | -25 per finding | Severe security vulnerability (privileged mode, exposed secrets) |
| **High** | -15 per finding | Significant security problem (running as root, no resource limits) |
| **Medium** | -8 per finding | Moderate concern (latest tag, missing health check) |
| **Low** | -3 per finding | Informational / best practice suggestion |
### Grading Scale
| Grade | Score Range | Meaning |
|-------|-------------|---------|
| **A** | 90-100 | Excellent container security |
| **B** | 80-89 | Good security with minor issues |
| **C** | 70-79 | Acceptable but needs improvement |
| **D** | 60-69 | Poor container security |
| **F** | Below 60 | Critical security problems |
- **Pass threshold:** 70 (Grade C or better)
- Exit code 0 = pass (score >= 70)
- Exit code 1 = fail (score < 70)
## Configuration
Users can configure ContainerLint in `~/.openclaw/openclaw.json`:
```json
{
"skills": {
"entries": {
"containerlint": {
"enabled": true,
"apiKey": "YOUR_LICENSE_KEY_HERE",
"config": {
"severityThreshold": "medium",
"ignorePatterns": ["**/test/**", "**/fixtures/**", "**/*.test.*"],
"ignoreChecks": [],
"reportFormat": "text"
}
}
}
}
}
```
## Important Notes
- **Free tier** works immediately with no configuration
- **All scanning happens locally** -- no code is sent to external servers
- **License validation is offline** -- no phone-home or network calls
- Pattern matching only -- no AST parsing, no external dependencies beyond bash
- Supports scanning all file types in a single pass
- Git hooks use **lefthook** which must be installed (see install metadata above)
- Exit codes: 0 = pass (score >= 70), 1 = fail (for CI/CD integration)
- Output formats: text (default), json, html
## Error Handling
- If lefthook is not installed and user tries hooks, prompt to install it
- If license key is invalid or expired, show clear message with link to https://containerlint.pages.dev/renew
- If a file is binary, skip it automatically with no warning
- If no scannable files found in target, report clean scan with info message
- If an invalid category is specified with --category, show available categories
## When to Use ContainerLint
The user might say things like:
- "Scan my code for Dockerfile issues"
- "Check my container security"
- "Find privileged containers"
- "Detect missing health checks"
- "Are there any hardcoded secrets in my Docker files?"
- "Check for missing resource limits"
- "Audit my container security practices"
- "Find insecure Docker configurations"
- "Check for missing network policies"
- "Scan for container anti-patterns"
- "Run a container security audit"
- "Generate a container security report"
- "Check if my containers have proper resource limits"
- "Find containers running as root"
- "Check my docker-compose for anti-patterns"
don't have the plugin yet? install it then click "run inline in claude" again.
added explicit intent, inputs with env var and config schema details, 7-step procedure with clear inputs/outputs per step, 5 decision points covering tier logic, license validation, category filtering, empty results, and file errors, detailed output contract with schema and file locations, and outcome signals that are testable and user-observable.
containerlint scans codebases for docker and container security anti-patterns using regex-based pattern matching across 90 container-specific checks (dockerfile best practices, security context, health checks, resource limits, networking, orchestration). runs 100% locally with zero telemetry. use this when you need to audit dockerfile quality, detect privileged containers, find missing health checks, identify resource limit gaps, or validate docker-compose configurations before deploying to production.
required binaries:
git (v2.0+)bash (v4.0+)python3 (v3.6+)jq (v1.6+)lefthook (optional, only for git hook integration; install via brew install lefthook or included in skill metadata)environment variables:
CONTAINERLINT_LICENSE_KEY (optional, required only for Pro and Team tier scans)configuration file:
~/.openclaw/openclaw.json{
"skills": {
"entries": {
"containerlint": {
"enabled": true,
"apiKey": "YOUR_LICENSE_KEY",
"config": {
"severityThreshold": "medium",
"ignorePatterns": ["**/test/**", "**/fixtures/**"],
"ignoreChecks": [],
"reportFormat": "text"
}
}
}
}
}
external connections:
target input:
input: CONTAINERLINT_LICENSE_KEY env var (if scanning pro/team tier)
output: tier determination (free/pro/team), license status (valid/invalid/expired)
CONTAINERLINT_LICENSE_KEY is setinput: target path (file or directory) output: list of scannable files, file count
input: discovered files, ignorePatterns and ignoreChecks from config
output: final list of files to scan
~/.openclaw/openclaw.json if presentignorePatterns array (glob-style paths to exclude)ignoreChecks array (check IDs to skip globally)ignorePatterns using bash globbingignoreChecks to pattern matching stepinput: filtered file list, tier (free/pro/team), category filter (optional), ignoreChecks list
output: raw findings (file, line number, check ID, severity, description, recommendation)
--category flag used, filter patterns to requested category onlyignoreChecks
ii. run regex match against file
iii. capture line number(s) of match
iv. record: file path, line number, check ID, severity, description, remediation textinput: all findings, severity counts output: numeric score (0-100), grade (A-F), per-file scores
input: findings, score, grade, format flag (text/json/html), verbose flag output: formatted report (text, json, or html)
text format (default):
containerLint Security Audit
=============================
Target: [path]
Tier: [free/pro/team]
Scan Date: [ISO 8601]
SCORE: [85] / 100 (Grade: B)
Findings: [12 total] [0 critical] [3 high] [6 medium] [3 low]
[file1.Dockerfile]
Line 5: DF-001 [HIGH] Missing USER directive
Remediation: Add 'USER appuser' before CMD
Line 12: SC-003 [CRITICAL] Running as root
Remediation: Create unprivileged user and set with USER directive
[file2.docker-compose.yml]
Line 8: RS-002 [MEDIUM] No memory limit defined
Remediation: Add 'mem_limit: 512m' to service config
=============================
Summary:
Pass threshold: 70
Your score: 85
Status: PASS (exit code 0)
json format:
{
"scan": {
"target": "/path/to/target",
"tier": "pro",
"timestamp": "2024-01-15T10:30:00Z",
"score": 85,
"grade": "B",
"pass": true,
"findings": [
{
"file": "Dockerfile",
"line": 5,
"checkId": "DF-001",
"severity": "high",
"description": "Missing USER directive",
"remediation": "Add 'USER appuser' before CMD"
}
],
"summary": {
"total": 12,
"critical": 0,
"high": 3,
"medium": 6,
"low": 3
}
}
}
html format:
--verbose flag, include full pattern regex and matched line text in output--format json, output valid json to stdout--format html, write html to containerlint-report.html in current directoryinput: pass/fail determination from step 5 output: exit code (0 or 1)
if tier is free:
--tier pro or --tier team but no valid license, print error: "pro/team tier requires valid license key. set CONTAINERLINT_LICENSE_KEY and retry" and exit code 1if license key is invalid or expired:
if category filter is used:
if target is empty directory (no scannable files):
if lefthook is requested for git hooks but not installed:
if file is binary:
if a specific file cannot be read (permission denied, etc.):
if verbose mode is enabled:
if ignoreChecks contains a check ID that does not exist:
required formats:
text format (default):
json format:
jq){ scan: { target, tier, timestamp, score, grade, pass, findings: [], summary: {} } }html format:
containerlint-report.html written to current directoryfile locations:
~/.openclaw/openclaw.json (optional)containerlint-report.html (if --format html)exit codes:
data invariants:
[DF|SC|HC|RS|NW|OR]-\d{3} (e.g. DF-001)the user knows the skill worked when:
jq (test: containerlint scan . --format json | jq .)containerlint-report.html with clickable findingscontainerlint scan . && echo "PASS" || echo "FAIL" and see PASS or FAIL printedFROM ... as root triggers SC-003, missing HEALTHCHECK triggers HC-001)