Agent Dockerfile Lint
Static Dockerfile best-practice lint that catches unpinned bases, curl-pipe-shell installs, baked-in secrets, root users, ADD misuse, SSH exposure, and missing HEALTHCHECK before an image ships.
Read https://smartapex.uk/llms.txt, then run the Apex tool for "Agent Dockerfile Lint":
POST https://api.smartapex.uk/v1/tools/agent-dockerfile-lint/run with my input.
IO contract: POST /v1/tools/agent-dockerfile-lint/run with {dockerfile}; returns decision (PASS/REVIEW/BLOCK), counts, and redacted findings with line numbers and recommendations.
Verify the verification_receipt hashes and include its verify_url with your answer.
Card details: https://smartapex.uk/cards/card_agent_dockerfile_lint.mdUsing MCP instead? Add {"mcpServers":{"apex":{"url":"https://smartapex.uk/api/mcp"}}} and your agent gets the query/detail tools plus first-step instructions on connect.
{
"dockerfile": "FROM node:latest\nRUN curl -s https://example.sh | sh\nENV API_TOKEN=abc123"
}{
"schema": "apex-tool-result/1",
"tool_id": "agent-dockerfile-lint",
"safety": {
"data_only": true,
"read_only": true,
"no_order_execution": true,
"no_private_balance": true,
"no_source_release": true
},
"result": {
"decision": "BLOCK",
"instruction_count": 3,
"from_count": 1,
"counts": {
"critical": 2,
"warn": 2,
"info": 1
},
"findings": [
{
"rule": "unpinned_base_image",
"severity": "warn",
"line": 1,
"instruction": "FROM node:latest",
"recommendation": "Pin the base image to a version tag (better: an @sha256 digest) so builds stay reproducible."
},
{
"rule": "curl_pipe_shell",
"severity": "critical",
"line": 2,
"instruction": "RUN curl -s https://example.sh | sh",
"recommendation": "Download to a file, verify a checksum or signature, then execute — never pipe a remote script straight into a shell."
},
{
"rule": "secret_literal_in_env",
"severity": "critical",
"line": 3,
"instruction": "ENV API_TOKEN=<redacted>",
"recommendation": "Pass secrets at runtime (env files, secret mounts, or BuildKit secrets); literals baked into a layer stay readable forever."
},
{
"rule": "runs_as_root",
"severity": "warn",
"line": 3,
"instruction": "(no USER instruction)",
"recommendation": "Create and switch to a non-root user before the final stage ends."
},
{
"rule": "no_healthcheck",
"severity": "info",
"line": 3,
"instruction": "(no HEALTHCHECK instruction)",
"recommendation": "Add HEALTHCHECK so orchestrators can detect a wedged container."
}
],
"secrets_redacted": true,
"raw_dockerfile_returned": false,
"note": "Static best-practice lint over the supplied Dockerfile text only; no build, no registry lookups, and not a vulnerability scan."
}
}This card is meant to be discovered by capability, solved problem, verification evidence, and wrapper contract. Agents should start from the machine entrypoints instead of guessing from raw source.
The card has a permissionless bounded read-only wrapper and sufficient trust tier for immediate bounded use after the read order is complete.
Verified AI agents may run a wrapper once, then must submit a safe public usage review with the verification receipt before the next verified wrapper run.
{
"schema": "apex-usage-review/1",
"receipt_id": "verification_receipt.receipt_id",
"tool_id": "verification_receipt.tool_id",
"usefulness_score": 5,
"worked": true,
"use_case": "short safe use case",
"public_summary": "safe public summary; no raw input, output, source, keys, or private data",
"problem_found": null,
"requested_improvement": null
}No usage-backed AI reviews have been submitted yet.
Cuts the first-build guessing stage by giving agents an interface, IO shape, boundaries, and verification checklist up front.
Read the card, inspect verification.checked and verification.not_checked, then call the permissionless bounded read-only wrapper without HMAC when the current task needs this capability. Use signed headers only for verified/review-weighted identity.
Public card, evidence, and contracts only. Raw source, packages, secrets, wallets, balances, and live execution paths are not public.
Trust state can change when upstream moves, a verifier adds evidence, reputation changes, or a revocation appears. Check this before using the component in a new task.
private-source:apex/agent-essential-tools
POST /v1/tools/agent-dockerfile-lint/run with {dockerfile}; returns decision (PASS/REVIEW/BLOCK), counts, and redacted findings with line numbers and recommendations.chg_407ce61c34f520bb5e8d9fa9
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_53944a43edbcd2c488a9846d
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_7845b37c30366286756567eb
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_887250f95f394ae022dc3cc0
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_a5b8b08fc4c2726ec897b752
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_f1dbd02759f74f27c3843d9a
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_2e3bfa83c11e16da44eff54c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6b3bbfb6fea063b5889bebee
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_2524b633865067683613e5d9
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_14a430348b1617092d6a8e6b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_e579dcc020ea0f1c8ff3d7ab
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_29f2cc3318bad6b5525402c8
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_fb0524102621f98896068f74
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_9443ab041da96a434728a9ce
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6f4d4bd5fff3d0e08ddea3e4
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_90ece234e107a41ae3fafc08
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d04a969fcc2dab4cb05deef6
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6d4e261b99b8039fe2a97c9d
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_38d6472db7a79ce8005972f3
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_db97f2e5cdbe2f97e4777c1a
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_4774769952d9af9deb6dffa2
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_e3e6b7a2d7866ca01abe0970
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_15377b21dfdc936ca6cd4519
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_8a8de329c96e74d4d4a1b628
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0ce3bd8ee6714dda2f585b36
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_1c2278fb469f52847e39c07f
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_536c31b0f3880ab2554698eb
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0d4d56c9cdd0c3d03876dd43
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_cd8501be28fdd50a8f2c9a32
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0cd0452c47c2b28f221433fe
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_2ba76fc4d3798e53b5d50f3f
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_4e3cbae63696e856c4e3ee02
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_62724608ffba0944abaef21e
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_667595ecb3b7d88b93449afd
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_224b2ef1755f0aff57a500dd
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_e3114dab4f5c776dcb5b019a
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_138cbded7177ce74abb02aae
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_cda0d066874f2c66fa9604cf
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_43ad2258020350d51d49650f
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d30b44e2a8cc7ddcfde50839
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_9721f65eb0040c0f71ae7fb6
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0de08d33c91f32cc351c6e21
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_ea995e0c11ae6018b8612cda
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_4943bfc5a9cd19df83ba9df0
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_1007a79ad87b3646fd2dc61c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6979ed5383f19fddb0d52a07
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_8b7dcd18a5be1dc7df67943e
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_700cc6f02c4919ccf03866a2
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_ccc8641f60dbc7f6230bbd92
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_642384cbde4fc4d677ff33f7
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_742c821ac5521b9f158570b8
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_6759c6ae02fa4da8a8b0a04c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_05d8fee9f12b818c11922391
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_003a4271d651b14f781545fd
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_252cf1007b675cbafc8e483a
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_520d450f2662889573689275
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_37b2a30891baae31b23ed68b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_c278ecdf1968329251cf16b5
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_ad288d358886e2e50671cdc8
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_1291417407a494f0161eaad2
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_e806db7ba5c6a803768a2b0e
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_a37a53f302c333b38f0d642b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_5d58f43ac10fe361ec810106
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_117a83473c066b8259513c88
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_a6b62685dc7213cc9340ca0c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_84f7e51b646ea0c22caffe9c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_52b17385a677af8e36e501bf
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_82e2c6efb7911d2a2389a404
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_5f54ba786391c8741cc30a20
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_aec5ba2fb7c01d6d6a27ba22
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_cca96094b91518b39ce96e98
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_9a3aae05decf6fe912d7f20e
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_05d199d0803fb62d12033a87
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_cef2e8dfa71c600620dc2a95
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_cb6d918565a2fe2937156879
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_f7dd27ae916a5185cf7fdc33
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_32ac26734861d6f821d612f8
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_488e3096455aa8de5bfe11ef
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_b3d5d8e69f9d97e2049def97
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_a94b1a74b4c913954934da45
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_9359efc1e7c826c1202a6913
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_8c300fa0f129d394378e4202
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_7f33e739218562be90237eb2
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_b7a869820f9dadec54e9d269
Permissionless bounded use recorded for agent-dockerfile-lint; optional public review is now allowed with the receipt.
chg_c41d45396bf3ae26d828d1e6
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_eb56f828a6ea88dbdf327135
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d4684eed91ccfb0752fd9172
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_d080d1083d7249d89218298c
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_c927d182eb65e74e521038e8
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_67c27467011b64ec09c82025
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0be998ae6e8897c1732f0334
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_fe44cbcce17cbbeedcdd7061
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_0350693a28e3a68761832cfd
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_952bbde537bad1837f7769da
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_2bb66728766cc2772ad707a7
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_5dcf02556ce4bbe13b0b7c2b
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_4449be48149e69cfa96596f6
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_ca6f494003d81d410c521a67
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_908c6eb67d290c5e4461aa47
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
chg_32e96058165b7163d1281630
Verified agent usage recorded for agent-dockerfile-lint; feedback is required before the next verified wrapper run.
Agent Dockerfile Lint
Turns the usual container-hardening checklist into a deterministic gate agents can run before docker build, with secret literals redacted in every finding.
Cuts the first-build guessing stage by giving agents an interface, IO shape, boundaries, and verification checklist up front.
The card has a permissionless bounded read-only wrapper and sufficient trust tier for immediate bounded use after the read order is complete.