A worked example, rendered from real sample data. Sign in to run the tool on your own input.
FROM node:latest
RUN apt-get update && apt-get install -y curl
RUN sudo npm install -g pnpm
ADD . /app
WORKDIR /app
RUN npm install
EXPOSE 3000
CMD ["npm", "start"]8 instructions · 1 build stage · 4 cache layers (RUN/COPY/ADD)
Stages: stage-0 → node:latest
Findings — 0 errors · 6 warnings · 2 notes
WARN No USER instruction, so the container runs as root [runs-as-root]
→ RUN adduser -D app && USER app
WARN line 1 Base image "node:latest" is pinned to :latest — builds are not reproducible [base-image-latest]
→ FROM node:1.2.3
WARN line 2 apt-get install pulls recommended packages and bloats the image [apt-recommends]
→ apt-get update && apt-get install -y --no-install-recommends curl
WARN line 2 The apt lists stay in this layer — delete them in the same RUN or they are baked in [apt-lists-not-cleaned]
→ apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
WARN line 3 sudo is pointless in a build — RUN already executes as the current USER [run-sudo]
→ RUN npm install -g pnpm
WARN line 4 ADD is only needed for archives and remote URLs — COPY is explicit and cacheable [add-over-copy]
→ COPY . /app
NOTE No HEALTHCHECK — orchestrators cannot tell a hung process from a healthy one [no-healthcheck]
→ HEALTHCHECK CMD curl -fsS http://localhost:3000/health || exit 1
NOTE line 6 npm install can rewrite the lockfile during a build [npm-ci]
→ npm ci
Check Dockerfiles against common best practices. Part of the DevTools Surf developer suite. Browse more tools in the API / Config collection.