Skip to content
gspotDocs

docker

Dockerfiles and Compose files: Dockerfile best practices, valid Compose files, a .dockerignore beside each Dockerfile, and image vulnerability scans.

Checks

Section titled “Checks”
Check Stage Level What it does
docker/hadolint commit recommended Lints every Dockerfile, and runs ShellCheck over its RUN lines.
docker/compose push recommended Parses every Compose file with docker compose config, which needs no running daemon.
docker/dockerignore commit recommended Checks that an ignore file sits beside every Dockerfile and keeps the .git folder, installed dependencies, and environment files out of the build.
docker/trivy-config push recommended Scans Dockerfiles for HIGH and CRITICAL misconfigurations, including a root user and exposed secrets.
docker/trivy-image manual recommended Scans every image a Compose file names for known vulnerabilities in its packages.

Settings

Section titled “Settings”
Setting What it sets
tools.hadolint.trusted_registries The registries a base image may come from; empty allows any.
tools.trivy.severity The severities Trivy reports.

Selected when

Section titled “Selected when”

gspot selects it in a scope with file paths **/Dockerfile, **/Dockerfile.*, **/*.dockerfile, **/docker-compose*.yml, **/docker-compose*.yaml, **/compose*.yml, **/compose*.yaml, !**/*.dockerignore.

Rules for coding agents

Section titled “Rules for coding agents”
Rule file Installed when
.gspot/configurations/infrastructure/docker/rules/DOCKER.md Always

Tools and versions

Section titled “Tools and versions”
Tool Version
hadolint 2.14.0
trivy 0.69.3
docker Any, install it yourself

Files gspot writes

Section titled “Files gspot writes”

gspot writes .gspot/configurations/infrastructure/docker/hadolint.yml, .gspot/configurations/infrastructure/docker/trivy.yml, and .gspot/configurations/infrastructure/docker/trivyignore.