Cybersecurity · free, no signup
Dockerfile Hardening Analyzer
Paste a Dockerfile and see the image it produces judged on the stage that actually ships. Multi-stage builds are read the way Docker reads them — earlier stages are not the image, so a USER set in a builder stage is not the user the container runs as, and the last USER in effect in the final stage is what gets reported. Covers root at runtime, mutable base tags, credential material in ARG (which persists in image history even when a later instruction appears to overwrite it), remote scripts piped to a shell at build time, ADD pulling an unverified URL, copying the whole build context, package caches left in the layer, and privilege-escalation paths added to the image. A file that declares no CMD or ENTRYPOINT is reported as insufficient however clean it reads, because it does not describe a runnable image.
Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.
Paste a Dockerfile and see the image it actually produces — judged on the final stage only, because that is what ships. A USER set in a builder stage is not the user your container runs as, and analyzers that flatten multi-stage builds report the wrong one.
Runs entirely on the text you paste — no registry is contacted and no image is pulled, so this reports what the file declares rather than what the base image brings with it. A value that looks like a credential is named and never quoted back.
What happens to what you enter
- The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
- Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
- An email address is stored only where a tool offers to send you a report and you choose to give one.
Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.
When a free check is not enough
This tool reads what is public and reports what it can see. The Container Security Review engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.
Explore Container Security Review