---
name: review-a-dockerfile
description: 'Checks an image build for size, layer caching, and anything that ships a secret.'
---

# Review a Dockerfile

Use this when someone asks you to look over a Dockerfile before it is built
and pushed.

## Steps

1. Check the base image: pinned to a digest or a specific tag, and still
   maintained.
2. Check layer order: the things that change least come first, so the
   cache holds; dependency manifests are copied before the source tree.
3. Look for anything that ships a secret: copied .env files, tokens in
   build arguments, credentials baked into layers.
4. Check the final stage runs as a non-root user and exposes only the ports
   it needs.
5. Report what would fail a review, then what would make the image smaller
   or faster to build.

## What not to do

Do not rewrite the file. Point at the line, say what is wrong and why.