Metadata-Version: 2.4
Name: tesserakit-dockerfile
Version: 0.4.0
Summary: Dockerfile job pack for Tessera: lint Dockerfiles for image hygiene and security.
Project-URL: Homepage, https://github.com/ShaileshRawat1403/tessera
Project-URL: Repository, https://github.com/ShaileshRawat1403/tessera
Project-URL: Issues, https://github.com/ShaileshRawat1403/tessera/issues
Author: Shailesh Rawat
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Programming Language :: Python :: 3
Requires-Python: >=3.10
Requires-Dist: pydantic>=2.7
Requires-Dist: rich>=13.7
Requires-Dist: tesserakit-core>=0.1.0
Requires-Dist: typer>=0.12
Provides-Extra: dev
Requires-Dist: pytest>=8.0; extra == 'dev'
Description-Content-Type: text/markdown

# tesserakit-dockerfile

Lint Dockerfiles for image hygiene and security.

`tessera-dockerfile` parses Dockerfiles (handling line continuations and multi-stage builds), inventories their instructions, and flags common hygiene and security problems. No image is built and nothing is executed.

## Lint

```bash
tessera dockerfile lint --input . --output ./out/dockerfile_pack
tessera dockerfile lint --input Dockerfile --output ./out/dockerfile_pack
```

Recognizes `Dockerfile`, `Dockerfile.*`, and `*.dockerfile`.

Artifacts written:

```text
instructions.jsonl       one Instruction per parsed line (with build stage)
index.md                 instruction inventory + stage list
validation_report.md     hygiene + security findings
coverage_report.md       instruction frequency
```

## Lint rules

- `unpinned_base_image` — `FROM image` with no tag (implicitly `:latest`)
- `latest_tag` — `FROM image:latest`
- `runs_as_root` — no `USER` instruction; the container runs as root
- `secret_in_image` — `ENV`/`ARG` bakes a secret-named value into an image layer
- `add_instead_of_copy` — `ADD` used for local files (prefer `COPY`)
- `missing_healthcheck` — no `HEALTHCHECK` instruction (info)

Multi-stage builds are understood: a `FROM <stage>` that references an earlier `AS <stage>` is not flagged as an unpinned base image.
