dockerfile
Dockerfile & container image intelligence pack: generate a production-ready Dockerfile from a {stack,port} spec (node, python, go, rust, java, php, static/nginx, ruby, deno, bun), lint an existing...
dockerfile — container image intelligence pack
Generate, lint, and optimize Dockerfiles from a curated best-practice rule engine + heuristic templates. Pure ESM, Node built-ins only, zero npm deps. Every tool has a deterministic core that works fully offline; generate/lint optionally enrich via an LLM (options.ai) and always fall back.
Tools
| Tool | Input | Output |
|---|---|---|
generate | { stack, port?, version?, options? } | A production-ready single-stage Dockerfile (cache-friendly layer order, non-root USER, EXPOSE, HEALTHCHECK, CMD). |
lint | { dockerfile } | ~13 best-practice rules (latest tag, root user, apt cache, cache-busting COPY, baked secrets, missing HEALTHCHECK…) → severities, fixes, a score/grade. |
optimize | { dockerfile } | Detects the stack, flags single-stage builds that should be multi-stage, suggests slimmer bases / fewer layers, and emits a multi-stage skeleton. |
multiStage | { stack, port?, version?, options? } | A builder + runtime multi-stage Dockerfile that ships only the built artifact. |
dockerignore | { stack } | A language-aware .dockerignore. |
healthcheck | { stack?, port?, options? } | A HEALTHCHECK instruction block for the given port/path. |
Supported stacks: node, python, go, rust, java, php, ruby, deno, bun, static/nginx (plus aliases like js, py, golang, react, rails, spring).
Usage
import pack from './index.js';
const { dockerfile } = await pack.adapters.generate({ stack: 'node', port: 8080 });
const report = await pack.adapters.lint({ dockerfile: 'FROM node\nCOPY . .\nRUN npm install' });
// report.findings -> [{ id:'latest-tag', severity:'high', ... }, ...]AI mode
Set options.ai: true. When a model is reachable (via ../_shared/llm.js) generate rewrites the Dockerfile and lint adds a remediation summary; results are tagged mode: 'llm'. With no model you get the deterministic template/rules, tagged mode: 'heuristic'. A down model never throws.
DRY boundary
Docker/container tooling over Dockerfile TEXT and {stack,port} specs. It does not run docker, build images, parse package.json (see dependency-auditor), or lint application source (code-metrics). Signing/verifying webhooks lives in webhook-forge.