360 Secure SkillHub
360 安全技能中心

Dockerignore Linter

该 Skill 通过捆绑的 Python 脚本对 .dockerignore 文件执行四类操作：lint 规则校验、security 敏感文件审计、suggest 按项目类型推荐模式、context 分析 Docker 构建上下文与体积，覆盖 18 条规则，输出 text/JSON/Markdown，可用于 CI 并以退出码表示结果。

charlie-morrison
charlie-morrison
热度 53.69
最近更新 2026-05-11 17:42:36
分类：开发依赖：代码执行 / 读写文件应用场景：DevOps / 自动化脚本 / 代码审查

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add dockerignore-linter
Metadata
name
dockerignore-linter
description
Lint, validate, and audit .dockerignore files for syntax issues, security risks, missing patterns, and optimization opportunities. Use when asked to lint, validate, audit, or check .dockerignore files, optimize Docker build context, reduce Docker image size, or review what files are included in Docker builds. Triggers on "lint dockerignore", "check .dockerignore", "docker context", "docker build size", "audit dockerignore".

Dockerignore Linter

Lint .dockerignore files for syntax issues, security risks, missing essential patterns, and optimization opportunities.

Commands

All commands use the bundled Python script at scripts/dockerignore_linter.py.

1. Lint a .dockerignore file

python3 scripts/dockerignore_linter.py lint <file> [--strict] [--format text|json|markdown]

Run all validation rules.

2. Audit for security-sensitive files

python3 scripts/dockerignore_linter.py security <file> [--format text|json|markdown]

Check if secrets, credentials, and sensitive files are properly excluded.

3. Suggest missing patterns

python3 scripts/dockerignore_linter.py suggest [--project-type node|python|go|rust|java|ruby|generic] [--format text|json]

Generate recommended .dockerignore patterns for a project type.

4. Analyze Docker build context

python3 scripts/dockerignore_linter.py context <directory> [--dockerignore <file>] [--format text|json]

Show which files would be included in the Docker build context, with size breakdown.

Lint Rules (18 total)

Syntax (4 rules)

  1. empty-file — .dockerignore is empty
  2. invalid-pattern — Malformed glob pattern
  3. duplicate-pattern — Same pattern appears twice
  4. negation-conflict — Negation ! overrides a previous exclusion (likely unintended)

Security (6 rules)

  1. missing-env — .env not excluded (may contain secrets)
  2. missing-secrets — Common secret files not excluded (*.pem, *.key, id_rsa, etc.)
  3. missing-git — .git directory not excluded (exposes history + credentials)
  4. missing-credentials — Credential files not excluded (aws/credentials, .npmrc with tokens, etc.)
  5. missing-docker — Docker-related files not excluded (docker-compose*.yml, Dockerfile*)
  6. missing-ide — IDE config not excluded (.vscode, .idea, *.swp)

Optimization (4 rules)

  1. missing-deps — Dependency directories not excluded (node_modules, pycache, vendor, target)
  2. missing-build — Build output not excluded (dist, build, *.o, *.pyc)
  3. missing-logs — Log files not excluded (*.log, logs/)
  4. missing-test — Test data/coverage not excluded (coverage, .nyc_output, htmlcov)

Best Practices (4 rules)

  1. too-broad — Pattern is overly broad (e.g., * without specific negations)
  2. commented-pattern — Inline comment after pattern (not supported, treated as literal)
  3. trailing-space — Pattern has trailing whitespace
  4. readme-excluded — README/docs excluded (usually should be kept for reference)

Output Formats

Text, JSON, Markdown — same structure as other linters.

CI Integration

- name: Lint Dockerignore
  run: python3 scripts/dockerignore_linter.py lint .dockerignore --strict

Exit codes: 0 = clean, 1 = issues found.