# Verifying Dockerfile changes

Files: `Dockerfile`, `.dockerfile`. Derived from 0 scanned source repositories and 33 review prompts on https://awesomereviewers.com. Page: https://awesomereviewers.com/verify/dockerfile/

How to use this: run every check under *Run on every change*. Then, for each section under *Add when the change touches* that describes your diff, run its checks too. Checks catch what a tool can find; then apply the listed review prompts for what tools miss (fetch each prompt's raw URL).

Usage is the share of scanned repositories in this language that run the tool. A missing tool means no scanned repository runs one the scanner recognises: fall back to the prompts.

## Run on every change

- **Formatting** — no tool detected in the sample. Catches: Layout drift that buries the real change in the diff.
- **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover.
- **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules.
- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.

## Add when the change touches

### Authentication, input handling, secrets, permissions

- **Security scanning** — no tool detected in the sample. Catches: Injection, unsafe APIs and tainted data reaching a sink.
- **Secret scanning** — no tool detected in the sample. Catches: Credentials and tokens committed to the repository.
- **Dependency audit** — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses.

Review prompts (10 in total, most discussed first):

- [Container security best practices](https://awesomereviewers.com/raw/comfyui-container-security-best-practices.md) — comfyanonymous/ComfyUI, Security
- [Ignore secrets in images](https://awesomereviewers.com/raw/agentcore-samples-ignore-secrets-in-images.md) — awslabs/agentcore-samples, Security
- [Harden build-time paths](https://awesomereviewers.com/raw/bifrost-harden-build-time-paths.md) — maximhq/bifrost, Security
- [Disable install scripts](https://awesomereviewers.com/raw/omniroute-disable-install-scripts.md) — diegosouzapw/OmniRoute, Security
- [Avoid hardcoded credentials](https://awesomereviewers.com/raw/n8n-avoid-hardcoded-credentials.md) — n8n-io/n8n, Security
- [Prefer opt-in security](https://awesomereviewers.com/raw/neon-prefer-opt-in-security.md) — neondatabase/neon, Security
- [avoid unnecessary privilege tools](https://awesomereviewers.com/raw/volcano-avoid-unnecessary-privilege-tools.md) — volcano-sh/volcano, Security
- [Secure GPG verification](https://awesomereviewers.com/raw/kafka-secure-gpg-verification.md) — apache/kafka, Security
- [Harden container security](https://awesomereviewers.com/raw/kubeflow-harden-container-security.md) — kubeflow/kubeflow, Security
- [Non-root container users](https://awesomereviewers.com/raw/frp-non-root-container-users.md) — fatedier/frp, Security

### Public APIs, signatures, error paths, nullability

- **Type checking** — no tool detected in the sample. Catches: Wrong types, unhandled null or None, call signatures broken across modules.
- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
- **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.

### Service and framework code

- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
- **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally.

### Algorithms, parsers, data transforms

- **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.
- **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders.
- **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does.
- **Proofs and specifications** — no tool detected in the sample. Catches: Design-level bugs in protocols and algorithms, checked against a specification.

### Threads, async code, locks, shared state

- **Concurrency model checking** — no tool detected in the sample. Catches: Races and orderings that fail only under specific interleavings.
- **Undefined-behaviour detection** — no tool detected in the sample. Catches: Memory-safety and aliasing violations in unsafe code.
- **Property-based tests** — no tool detected in the sample. Catches: Edge-case inputs nobody wrote a test for; invariants over generated data.

### Network calls, retries, timeouts, protocols

- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
- **Fuzzing** — no tool detected in the sample. Catches: Crashes, panics and hangs on malformed input, especially in parsers and decoders.

Review prompts (1 in total, most discussed first):

- [Standardize network tools](https://awesomereviewers.com/raw/kubeflow-standardize-network-tools.md) — kubeflow/kubeflow, Networking

### UI components and pages

- **End-to-end browser tests** — no tool detected in the sample. Catches: User flows broken across components, routing and the network.
- **Linting** — no tool detected in the sample. Catches: Bug-prone patterns, unused code and conventions the formatter does not cover.

### Databases, migrations, caching

- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.
- **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally.

Review prompts (1 in total, most discussed first):

- [Cache sharing strategy](https://awesomereviewers.com/raw/uv-cache-sharing-strategy.md) — astral-sh/uv, Caching

### Hot paths and performance

- No tool-based check applies; rely on the prompts.

Review prompts (1 in total, most discussed first):

- [Split Dependency Installs](https://awesomereviewers.com/raw/celery-split-dependency-installs.md) — celery/celery, Performance Optimization

### Model, prompt and LLM code

- **Unit and integration tests** — no tool detected in the sample. Catches: Behaviour regressions on the paths the tests exercise.

Review prompts (1 in total, most discussed first):

- [CUDA compatibility verification](https://awesomereviewers.com/raw/sglang-cuda-compatibility-verification.md) — sgl-project/sglang, AI

### CI workflows and configuration files

- **CI workflow linting** — no tool detected in the sample. Catches: Broken GitHub Actions syntax, script injection, over-broad token permissions.
- **File hygiene** — no tool detected in the sample. Catches: Invalid JSON, YAML or TOML, merge markers, trailing whitespace, oversized files.

Review prompts (17 in total, most discussed first):

- [Environment variable management](https://awesomereviewers.com/raw/kubeflow-environment-variable-management.md) — kubeflow/kubeflow, Configurations
- [Environment-consistent builds](https://awesomereviewers.com/raw/celery-environment-consistent-builds.md) — celery/celery, Configurations
- [optimize Docker layers](https://awesomereviewers.com/raw/browser-use-optimize-docker-layers.md) — browser-use/browser-use, Configurations
- [Pin configuration versions](https://awesomereviewers.com/raw/poetry-pin-configuration-versions.md) — python-poetry/poetry, Configurations
- [Environment variable consistency](https://awesomereviewers.com/raw/comfyui-environment-variable-consistency.md) — comfyanonymous/ComfyUI, Configurations
- [Pin build dependency versions](https://awesomereviewers.com/raw/compose-pin-build-dependency-versions.md) — docker/compose, Configurations
- [Centralize configuration values](https://awesomereviewers.com/raw/kafka-centralize-configuration-values.md) — apache/kafka, Configurations
- [Parameterize configuration values](https://awesomereviewers.com/raw/prowler-parameterize-configuration-values.md) — prowler-cloud/prowler, Configurations
- [Optimize docker build caching](https://awesomereviewers.com/raw/uv-optimize-docker-build-caching.md) — astral-sh/uv, CI/CD
- [Use latest patch versions](https://awesomereviewers.com/raw/volcano-use-latest-patch-versions.md) — volcano-sh/volcano, Configurations
- [Keep container images current](https://awesomereviewers.com/raw/ollama-keep-container-images-current.md) — ollama/ollama, Configurations
- [Parameterize hardcoded configuration values](https://awesomereviewers.com/raw/unstructured-parameterize-hardcoded-configuration-values.md) — Unstructured-IO/unstructured, Configurations

### Dependencies and lockfiles

- **Dependency audit** — no tool detected in the sample. Catches: Known-vulnerable or disallowed dependencies and licenses.
- **Lockfile consistency** — no tool detected in the sample. Catches: A lockfile that no longer matches its manifest.
- **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally.

### The tests themselves

- **Mutation testing** — no tool detected in the sample. Catches: Tests that keep passing whatever the code does.
- **Version and platform matrix** — no tool detected in the sample. Catches: Breakage on a runtime version, OS or feature combination you did not run locally.

Review prompts (1 in total, most discussed first):

- [Pin testing dependency versions](https://awesomereviewers.com/raw/browser-use-pin-testing-dependency-versions.md) — browser-use/browser-use, Testing

### Documentation and comments

- **Docs build** — no tool detected in the sample. Catches: Broken cross-references, links and markup in documentation.
- **Spelling** — no tool detected in the sample. Catches: Typos in identifiers, comments and docs.

Review prompts (1 in total, most discussed first):

- [Document with precision](https://awesomereviewers.com/raw/kubeflow-document-with-precision.md) — kubeflow/kubeflow, Documentation