Container Security

Detects VOLUME instructions that mount the Docker socket, giving a container full control over the host's Docker daemon, equivalent to unrestricted root access.

Detects ARG instructions with names suggesting secrets. Build arguments are stored in image history and can be retrieved by anyone with access to the image.

Detects usage of sudo in RUN instructions, which is unnecessary during build and increases security risk if sudo remains in the final image.

Detects Dockerfiles without a USER instruction, causing containers to run with root privileges which significantly increases attack surface.