Dockerfile Security Analyzer
Analyze Dockerfiles for security vulnerabilities and best practices.
Last reviewed by the Radiatus Cloud team
Want this automated for your stack?
We build CI/CD, Kubernetes & IaC pipelines that scale.
Review a Dockerfile for security issues
How you write a Dockerfile determines how secure the resulting image is, and several common patterns quietly weaken it. This analyser reviews a Dockerfile for security issues and best-practice violations, so you can build hardened images from the start rather than discovering weaknesses in production.
The patterns that weaken an image
Recurring issues include running as root, using a mutable base image tag like latest so builds are not reproducible, copying secrets into layers where they persist even if later deleted, installing unnecessary packages that enlarge the attack surface, and not pinning package versions. Each makes the image larger, less reproducible or more exposed. Fixing them is mostly a matter of a few disciplined habits applied consistently.
A defensive review of your own images, kept local
Reviewing your Dockerfile before building is a cheap way to avoid shipping an insecure image, and every finding is a specific line to change. The analysis runs entirely in your browser, so your configuration is never uploaded, which matters when it describes your own infrastructure.
Related tools
- CI/CD Security Gap Analyzer — Checklist based analyzer for CI/CD pipeline security gaps.
- Docker Security Scanner — A new tool extracted from the codebase.
- Terraform Scanner — A new tool extracted from the codebase.
- SQL Formatter — Format and indent SQL queries for readability. Handles joins, subqueries and CTEs, supports common dialects, and runs entirely in your browser.
Frequently Asked Questions
Why not run as root in a Dockerfile?
Because the container then runs as root, so a container escape becomes host root access. Adding a non-root user and switching to it keeps an escape contained.
Why avoid the latest tag for a base image?
Because latest is mutable, so the same Dockerfile can produce different images over time, making builds non-reproducible and pulling in unreviewed changes. Pin a specific version.
Why do secrets in layers persist?
Because each Dockerfile instruction creates a layer, and a secret copied in one layer remains in the image history even if a later layer deletes it. Secrets should never be copied into an image.
Is this scanning a running image?
No. It reviews the Dockerfile you provide, helping you build hardened images from the start.
Is my Dockerfile uploaded?
No. The review runs entirely in your browser.
Privacy & Security
Analysis done locally.
About This Tool
This tool runs entirely in your browser. No data is sent to any server, ensuring complete privacy. Simply use the interface above to get started — no registration or login required.
Disclaimer: This tool is provided "as is" without warranty of any kind. Results are for educational and utility purposes.