# docker

> Dockerfiles and Compose files: Dockerfile best practices, valid Compose files, a `.dockerignore` beside each Dockerfile, and image vulnerability scans.

Dockerfiles and Compose files: Dockerfile best practices, valid Compose files, a `.dockerignore` beside each Dockerfile, and image vulnerability scans.

## Checks

| Check                                                           | Stage    | Level         | What it does                                                                                                                                         |
| --------------------------------------------------------------- | -------- | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| [`docker/hadolint`](/reference/checks/docker/hadolint/)         | `commit` | `recommended` | Lints every Dockerfile, and runs ShellCheck over its RUN lines.                                                                                      |
| [`docker/compose`](/reference/checks/docker/compose/)           | `push`   | `recommended` | Parses every Compose file with `docker compose config`, which needs no running daemon.                                                               |
| [`docker/dockerignore`](/reference/checks/docker/dockerignore/) | `commit` | `recommended` | Checks that an ignore file sits beside every Dockerfile and keeps the `.git` folder, installed dependencies, and environment files out of the build. |
| [`docker/trivy-config`](/reference/checks/docker/trivy-config/) | `push`   | `recommended` | Scans Dockerfiles for HIGH and CRITICAL misconfigurations, including a root user and exposed secrets.                                                |
| [`docker/trivy-image`](/reference/checks/docker/trivy-image/)   | `manual` | `recommended` | Scans every image a Compose file names for known vulnerabilities in its packages.                                                                    |

## Settings

| Setting                                                                                         | What it sets                                                 |
| ----------------------------------------------------------------------------------------------- | ------------------------------------------------------------ |
| [`tools.hadolint.trusted_registries`](/reference/gspot-toml/#tools.hadolint.trusted_registries) | The registries a base image may come from; empty allows any. |
| [`tools.trivy.severity`](/reference/gspot-toml/#tools.trivy.severity)                           | The severities Trivy reports.                                |

## Selected when

gspot selects it in a scope with file paths `**/Dockerfile`, `**/Dockerfile.*`, `**/*.dockerfile`, `**/docker-compose*.yml`, `**/docker-compose*.yaml`, `**/compose*.yml`, `**/compose*.yaml`, `!**/*.dockerignore`.

## Rules for coding agents

| Rule file                                                     | Installed when |
| ------------------------------------------------------------- | -------------- |
| `.gspot/configurations/infrastructure/docker/rules/DOCKER.md` | Always         |

## Tools and versions

| Tool     | Version                  |
| -------- | ------------------------ |
| hadolint | `2.14.0`                 |
| trivy    | `0.69.3`                 |
| docker   | Any, install it yourself |

## Files gspot writes

gspot writes `.gspot/configurations/infrastructure/docker/hadolint.yml`, `.gspot/configurations/infrastructure/docker/trivy.yml`, and `.gspot/configurations/infrastructure/docker/trivyignore`.