Docker Security Lint

Lint Dockerfiles and docker-compose files the user owns or is authorized to analyze using the bundled scripts/lint.js, then turn the JSON report into a hardening list.

• Only lint paths the user supplied or confirms they are authorized to inspect. If authorization is unclear, ask before running anything.
• The linter is static and line-based: it reads files and matches patterns. It never executes the code, pulls images, or follows symlinks.
• Never print or reuse a detected secret value. Report findings only by the rule id, file, line, and masked fingerprint the tool provides, and recommend rotation for anything that looks live.
• Do not overclaim. Zero findings means none of the known rules matched — it does not prove the configuration is secure (no image CVE scan, no runtime analysis).

Dockerfile:

• image-latest (warn) — FROM with :latest or no tag at all; mutable image, unreproducible builds.
• root-user (warn) — no USER directive anywhere; container runs as root.
• baked-secret (fail) — ENV/ARG with a secret-looking name (key, token, secret, password, …) assigned a literal value. Value is masked.
• run-curl-sh (fail) — RUN piping curl/wget output into sh/bash.
• add-remote (warn) — ADD with an http(s) URL; fetch has no integrity check.