# dockerfile — container image intelligence pack

Dockerfile & container image intelligence pack: generate a production-ready Dockerfile from a {stack,port} spec (node, python, go, rust, java, php, static/nginx, ruby, deno, bun), lint an existing...


Generate, lint, and optimize Dockerfiles from a curated best-practice rule engine + heuristic
templates. Pure ESM, Node built-ins only, zero npm deps. Every tool has a deterministic core that
works fully offline; generate/lint optionally enrich via an LLM (`options.ai`) and always fall back.

## Tools

| Tool | Input | Output |
|---|---|---|
| `generate` | `{ stack, port?, version?, options? }` | A production-ready single-stage Dockerfile (cache-friendly layer order, non-root USER, EXPOSE, HEALTHCHECK, CMD). |
| `lint` | `{ dockerfile }` | ~13 best-practice rules (latest tag, root user, apt cache, cache-busting COPY, baked secrets, missing HEALTHCHECK…) → severities, fixes, a score/grade. |
| `optimize` | `{ dockerfile }` | Detects the stack, flags single-stage builds that should be multi-stage, suggests slimmer bases / fewer layers, and emits a multi-stage skeleton. |
| `multiStage` | `{ stack, port?, version?, options? }` | A builder + runtime multi-stage Dockerfile that ships only the built artifact. |
| `dockerignore` | `{ stack }` | A language-aware `.dockerignore`. |
| `healthcheck` | `{ stack?, port?, options? }` | A `HEALTHCHECK` instruction block for the given port/path. |

Supported stacks: `node, python, go, rust, java, php, ruby, deno, bun, static/nginx` (plus aliases
like `js`, `py`, `golang`, `react`, `rails`, `spring`).

## Usage

```js
import pack from './index.js';
const { dockerfile } = await pack.adapters.generate({ stack: 'node', port: 8080 });
const report = await pack.adapters.lint({ dockerfile: 'FROM node\nCOPY . .\nRUN npm install' });
// report.findings -> [{ id:'latest-tag', severity:'high', ... }, ...]
```

## AI mode

Set `options.ai: true`. When a model is reachable (via `../_shared/llm.js`) `generate` rewrites the
Dockerfile and `lint` adds a remediation `summary`; results are tagged `mode: 'llm'`. With no model
you get the deterministic template/rules, tagged `mode: 'heuristic'`. A down model never throws.

## DRY boundary

Docker/container tooling over Dockerfile TEXT and `{stack,port}` specs. It does **not** run docker,
build images, parse `package.json` (see `dependency-auditor`), or lint application source
(`code-metrics`). Signing/verifying webhooks lives in `webhook-forge`.


---
Source: shared/engines/adapters/domain/dockerfile/README.md
Canonical: https://docs.leumas.tech/p/adapters/domain/dockerfile