Dockttier 🐳🛡

Dockerfile templates, real-time security and optimization analysis, one-click fixes, scores, a CI command-line tool and AI review, all in VS Code.

Dockttier helps teams ship containers that are secure by default, small and fast to build. Start from a verified template, get problems underlined as you type, fix them with one click, and run the same checks in CI.

✨ Features

📦 Template library (16 templates, all grade A)

• Quick Pick (Dockttier: Insert Dockerfile Template…) grouped Basic / Production, with security and optimization scores.
• Template Gallery webview: search, filter by goal or language, inspect, fill in variables ({{NODE_VERSION}}, {{PORT}} …) and create.
• Generate Dockerfile for Project detects your stack (package.json, pnpm-lock.yaml, uv.lock, go.mod, pom.xml, *.csproj, Cargo.toml …) and recommends the best template.
• Template tree view in the Dockttier activity bar.
• Team templates: save any Dockerfile as a template into .dockttier/templates/ and commit it. Add personal folders with dockttier.templates.paths, or a shared cloud repository with dockttier.templates.remoteUrl (HTTPS JSON, cached offline).
• Template scores are computed by the analyzer, not hand-written, so they can't drift.

🔍 Real-time analysis: 51 rules

Problems appear in the Problems panel as you type (debounced, typically < 5 ms per file).

• 🛡 Security (17): root user, latest / untagged images, secrets in ENV/ARG, hardcoded credentials (AWS, GitHub, Slack, Stripe, private keys …), curl | sh, ADD <url> without checksum, sudo, chmod 777, SSH port, disabled TLS verification, unsigned packages, copied .env / keys, end-of-life images, digest pinning, trusted registries and banned images policies.
• 🚀 Optimization (13): consecutive RUNs, COPY . . before dependency install, apt/apk/pip/yum cache cleanup, --no-install-recommends, slim/alpine bases, multi-stage for compiled languages, npm ci, missing .dockerignore, large build context, BuildKit cache mounts.
• ✅ Best practice (21): exec-form CMD/ENTRYPOINT, pipefail, absolute WORKDIR, HEALTHCHECK, OCI labels, duplicate CMD, invalid JSON form, invalid EXPOSE, bad COPY --from references, duplicate stage names, MAINTAINER, legacy ENV k v, apt vs apt-get, typos in instructions ("Did you mean RUN?") …

See the full rule list below.

⚡ Quick fixes

More than 25 rules have one-click fixes (Ctrl+.), for example: pin a base image, add a non-root user (aware of Alpine, Debian and distroless), reorder COPY for caching, merge RUNs, add cache cleanup, convert to exec form, npm install → npm ci --omit=dev, add pipefail (uses SHELL bash on Debian, where dash has no pipefail). Every finding also offers ignore for this line, disable rule and learn more. Fix All (Dockttier: Fix All, CodeLens, or source.fixAll.dockttier on save) applies safe fixes repeatedly until nothing changes.

📊 Scores, report and status bar

• Status bar: Dockttier B 84 with a hover breakdown.
• CodeLens: scores, fix count and per-stage issue counts above the file.
• Analysis report webview: overall, security, optimization and best-practice score rings; an image profile (non-root, multi-stage, minimal base, digests, health check, exec form, cache and secret mounts, layer count); findings grouped by category with "reveal" and "fix" buttons; export to Markdown, SARIF or JSON.

🎓 Learning mode

• Hover a keyword for instruction docs, hover FROM images for size, recommended tags and EOL warnings.
• Hover a problem for the explanation and a before/after example.
• Rules & Learning view and a Learn panel documenting every rule.
• A Getting Started walkthrough.
• Completions for instructions (snippets), base images with recommended tags, distroless images, stage names and BuildKit --mount options.

✨ AI-powered suggestions (optional)

If a VS Code language model is available (e.g. GitHub Copilot):

• Dockttier: AI Review streams a context-aware review plus an improved Dockerfile, using the static findings as grounding.
• @dockttier chat participant: /review, /template <what you're building>, /explain DT1002.

Everything else works fully offline with no AI.

🏗 CI/CD integration

The extension bundles the same engine as a command-line tool:

node out/cli.js .                          # scan all Dockerfiles, fail on errors
node out/cli.js . --fail-on warning        # stricter
node out/cli.js . -f sarif -o dockttier.sarif   # GitHub code scanning
node out/cli.js . -f markdown >> $GITHUB_STEP_SUMMARY
node out/cli.js Dockerfile --fix           # apply safe fixes
node out/cli.js . --min-score 80           # quality gate

A ready-made GitHub Actions workflow ships in examples/github-actions.yml inside the extension source.

⚙️ Configuration

Team config: .dockttierrc.json

Shared by the editor and the CLI (JSON with comments, schema-validated in VS Code):

{
  "rules": { "DT3009": "off", "no-sudo": "error" },   // id or name → off | error | warning | info | hint
  "trustedRegistries": ["docker.io/library", "ghcr.io/acme"],
  "bannedImages": ["ubuntu:1*", "*/deprecated-base*"],
  "requiredLabels": ["org.opencontainers.image.source"],
  "requireDigests": false
}

Inline suppression

# dockttier-ignore DT1002 DT3006
FROM gcr.io/my/base:1.0
# dockttier-ignore-file DT3009

Settings

📋 Rules

🧱 Architecture

src/
  core/            Pure TypeScript, no VS Code dependency (shared by extension and CLI)
    parser.ts      Position-preserving Dockerfile parser (directives, continuations, heredocs, stages, flags, JSON form)
    shell.ts       Quote-aware shell command splitter for RUN analysis
    rules/         51 rules: security.ts, optimization.ts, bestPractice.ts
    analyzer.ts    Rule engine, config/ignores, scoring, fix application
    templates.ts   Template model, validation, rendering, recommendation
    insights.ts    Image profile (non-root, multi-stage, minimal base …)
  vscode/          Diagnostics, code actions, hover, completion, CodeLens, status bar,
                   tree views, gallery/report/learn webviews, AI and chat
  cli.ts           CI command line (text, JSON, SARIF, Markdown; --fix; quality gates)
templates/         JSON template library
schemas/           JSON schemas for .dockttierrc.json and team templates

🧪 Development

npm install
npm run typecheck
npm test          # 180 unit tests: parser, every rule (positive + negative), fixes, templates, CLI, performance
npm run build     # bundles out/extension.js and out/cli.js with esbuild
npm run package   # produces dockttier-<version>.vsix

Press F5 in VS Code to launch an Extension Development Host.

📄 License

MIT