[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-fix-dockerfile":3,"mdc--h0npdl-key":39,"related-org-azure-fix-dockerfile":3879,"related-repo-azure-fix-dockerfile":4056},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":29,"repoUrl":30,"updatedAt":31,"license":32,"forks":33,"topics":34,"repo":35,"sourceUrl":37,"mdContent":38},"fix-dockerfile","validate and remediate Dockerfiles","Validate and remediate an existing Dockerfile against security, performance, and best-practice rules. Use AFTER a Dockerfile exists (either user-authored or produced by generate-dockerfile) and BEFORE building or pushing the image. Triggers include \"fix my Dockerfile\", \"is this Dockerfile secure\", \"validate Dockerfile\", \"check Dockerfile for issues\", \"audit Dockerfile\", or any container build flow that needs a sanity check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,17,20,23,26],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Performance","performance",{"name":21,"slug":22,"type":16},"Deployment","deployment",{"name":24,"slug":25,"type":16},"Engineering","engineering",{"name":27,"slug":28,"type":16},"Docker","docker",41,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fcontainerization-assist","2026-07-12T08:18:23.567237",null,16,[],{"repoUrl":30,"stars":29,"forks":33,"topics":36,"description":32},[],"https:\u002F\u002Fgithub.com\u002FAzure\u002Fcontainerization-assist\u002Ftree\u002FHEAD\u002Fskills\u002Ffix-dockerfile","---\nname: fix-dockerfile\ndescription: Validate and remediate an existing Dockerfile against security, performance, and best-practice rules. Use AFTER a Dockerfile exists (either user-authored or produced by generate-dockerfile) and BEFORE building or pushing the image. Triggers include \"fix my Dockerfile\", \"is this Dockerfile secure\", \"validate Dockerfile\", \"check Dockerfile for issues\", \"audit Dockerfile\", or any container build flow that needs a sanity check.\nargument-hint: \u003Cpath to Dockerfile | inline Dockerfile content> [environment=production|development]\n---\n\n# Fix Dockerfile\n\nValidate an existing Dockerfile against a fixed rule set, score it, and produce\na fully remediated version. Deterministic — every rule below is a regex or a\nstructural check, not a judgment call.\n\n## Inputs\n\n| Field | Required | Description |\n|---|---|---|\n| `dockerfile` *or* `path` | yes | Either the file contents OR an absolute path. If `path` is given, read it. |\n| `environment` | optional | `production` (default) or `development`. Some rules downgrade to suggestions in dev. |\n| `targetPlatform` | optional | `linux\u002Famd64` (default) or `linux\u002Farm64`. Used only in the **Next steps** section. |\n\nIf neither is provided → ask the user for the Dockerfile path. STOP.\n\n## Procedure\n\n### Step 1 — Read the file\n\nIf `path` is given, read the file content. Reject if it doesn't contain at\nleast one `FROM ` line (case-insensitive) — that's not a Dockerfile.\n\n### Step 2 — Run every rule\n\nApply each rule below in order. For each match, record an **issue** with\n`{ ruleId, category, severity, line, message }`.\n\n`severity` ∈ `error` (must fix) | `warning` (should fix) | `info` (nice to fix).\n`category` ∈ `security` | `performance` | `bestPractices`.\n\nWhen a rule says \"scan lines\", split the file on `\\n`, trim each line, ignore\nempty lines and lines starting with `#`.\n\n#### Security rules (highest priority)\n\n| ruleId | Pattern | Severity | Message |\n|---|---|---|---|\n| `block-root-user` | Any line matches `^USER\\s+(root\\|0)\\s*$` (case-insensitive multiline) | **error** | Running as root is forbidden. Replace with a non-root user. |\n| `no-root-user` | No `USER` line at all, OR final `USER` line argument is `root`\u002F`0` | **error** | Container must declare a non-root `USER` instruction. |\n| `block-secrets-in-env` | Any `ENV` or `ARG` line matches `(?i)(PASSWORD\\|PASSWD\\|SECRET\\|TOKEN\\|API[_-]?KEY\\|PRIVATE[_-]?KEY\\|ACCESS[_-]?KEY\\|CREDENTIAL\\|DATABASE_URL\\|CONNECTION_STRING\\|REDIS_URL\\|MONGODB?_URI\\|_DSN)\\b.*=\\s*\\S+` with a non-empty, non-placeholder value | **error** | Hardcoded secret in `ENV`\u002F`ARG`. Inject via runtime (Kubernetes Secret). |\n| `no-secrets` | Same as above but covers `RUN export FOO=…` and `RUN echo \"FOO=…\"` shapes | **error** | Hardcoded secret in `RUN`. |\n| `avoid-sudo` | Any line matches `(?i)\\bsudo\\b` | warning | Drop `sudo`; run the entire stage as the required user instead. |\n| `avoid-apt-upgrade` | Any line matches `(?i)apt-get\\s+(upgrade\\|dist-upgrade)` | warning | Avoid `apt-get upgrade`; pin package versions. |\n\n#### Performance \u002F optimization rules\n\n| ruleId | Pattern | Severity | Message |\n|---|---|---|---|\n| `optimize-package-install` | `RUN` line with `apt-get install` but NO `rm -rf \u002Fvar\u002Flib\u002Fapt\u002Flists\u002F*` in the same `RUN` | warning | Combine update + install + cleanup in one `RUN`. |\n| `apk-no-cache` | `apk add` without `--no-cache` | info | Add `--no-cache` to `apk add`. |\n| `recommend-npm-ci` | `npm install` without `-g` | info | Use `npm ci` for reproducible builds. |\n| `excessive-run-commands` | Count of `RUN` lines ≥ 6 | info | Combine `RUN` instructions with `&&` to reduce layers. |\n| `dependency-order` | `COPY . .` (or `COPY . \u002F\u003Cdir>`) appears **before** any `COPY package*.json` \u002F `COPY pom.xml` \u002F `COPY go.mod` \u002F `COPY requirements*.txt` \u002F `COPY Cargo.toml` | info | Copy dependency manifests before source for better layer caching. |\n| `recommend-multistage` | Single `FROM` AND any of `mvn`, `gradle`, `npm run build`, `go build`, `cargo build`, `dotnet publish` appears in a `RUN` line | info | Use multi-stage build to drop build tools from the final image. |\n\n#### Best-practice \u002F quality rules\n\n| ruleId | Pattern | Severity | Message |\n|---|---|---|---|\n| `specific-base-image` | Any `FROM` whose tag is `latest` or missing (no `:`) | warning | Pin a specific major version tag, never `:latest`. |\n| `require-healthcheck` | No line starts with `HEALTHCHECK ` | info | Add `HEALTHCHECK` (or note why if image is distroless \u002F shell-less). |\n| `require-workdir` | No `WORKDIR` line, OR any `RUN cd \u002F` pattern | info | Use `WORKDIR` instead of `cd`. |\n| `recommend-expose` | Application code references a port (`PORT=`, `LISTEN`, `:8080`, `:3000`, `:5000`) but no `EXPOSE` line | info | Add `EXPOSE \u003Cport>` to document the listener. |\n| `missing-attribution-labels` | No `LABEL com.azure.containerizationassist.createdby` | info | Add the attribution `createdby` label (and `version` if a version is available) for traceability. |\n\n### Step 3 — Score\n\nStart at **100**. Subtract **10** per issue (any severity). Floor at 0.\n\nGrade band:\n\n| Score | Grade |\n|---|---|\n| 90–100 | A |\n| 75–89 | B |\n| 60–74 | C |\n| 40–59 | D |\n| 0–39 | F |\n\n### Step 4 — Compute overall priority\n\n- `high` if any security issue has severity `error`, OR ≥ 3 security issues total.\n- `medium` if any security\u002Fperformance\u002Fbest-practice issue exists.\n- `low` if no issues found.\n\n### Step 5 — Decide remediation strategy\n\n| Conditions | Strategy |\n|---|---|\n| Grade = F OR ≥ 1 `error` severity issue | `rewrite` — emit a fully restructured Dockerfile. |\n| Grade ∈ {C, D} | `refactor` — emit the file with targeted edits per issue. |\n| Grade ∈ {A, B} | `tweak` — emit the file with minimal edits; if no issues, return unchanged. |\n\n### Step 6 — Produce **and apply** the fixed Dockerfile\n\nWalk every recorded issue and apply the corresponding fix. The fix table:\n\n| ruleId | Fix |\n|---|---|\n| `block-root-user` \u002F `no-root-user` | Append (or replace existing) before final `CMD`\u002F`ENTRYPOINT`: `RUN adduser -D -u 10001 appuser` (Alpine) or `RUN useradd -m -u 10001 appuser` (Debian\u002FAzure Linux), then `USER appuser`. Choose flavor from base image. |\n| `block-secrets-in-env` \u002F `no-secrets` | Delete the offending `ENV`\u002F`ARG`\u002F`RUN` line. Add a comment `# SECRET: \u003CNAME> — inject via Kubernetes Secret at runtime`. |\n| `avoid-sudo` | Drop `sudo ` prefix. If the action requires root, move it before the final `USER` directive. |\n| `avoid-apt-upgrade` | Replace with `apt-get install -y --no-install-recommends \u003Cexplicit packages>`. |\n| `optimize-package-install` | Combine into: `RUN apt-get update && apt-get install -y --no-install-recommends \u003Cpkgs> && rm -rf \u002Fvar\u002Flib\u002Fapt\u002Flists\u002F*`. |\n| `apk-no-cache` | Add `--no-cache` flag. |\n| `recommend-npm-ci` | Replace `npm install` with `npm ci`. |\n| `excessive-run-commands` | Chain consecutive `RUN` lines with `&&`. |\n| `dependency-order` | Move the manifest `COPY` lines above `COPY . .` and add the dependency install step between them. |\n| `recommend-multistage` | Restructure into two stages: `FROM \u003Cbuild-image> AS build` … `FROM \u003Cruntime-image>` … `COPY --from=build …`. |\n| `specific-base-image` | Replace `:latest` (or no tag) with a pinned major version from the curated table in `generate-dockerfile` skill, matching detected language. |\n| `require-healthcheck` | Add a HEALTHCHECK matching the base image's available tools: `curl -fsS http:\u002F\u002Flocalhost:\u003Cport>\u002Fhealth \\|\\| exit 1` if curl is present; `wget --spider -q http:\u002F\u002Flocalhost:\u003Cport>\u002Fhealth \\|\\| exit 1` on Alpine\u002Fbusybox; for distroless add a comment `# HEALTHCHECK: skipped — distroless image has no shell. Use Kubernetes liveness\u002Freadiness probe.` |\n| `require-workdir` | Add `WORKDIR \u002Fapp` after `FROM`. Replace any `RUN cd \u002F\u003Cdir>` with `WORKDIR \u002F\u003Cdir>`. |\n| `recommend-expose` | Add `EXPOSE \u003Cport>` near the bottom. Infer port from the code reference. |\n| `missing-attribution-labels` | Add `LABEL com.azure.containerizationassist.createdby=\"containerization-assist\"`. If you can read the current `containerization-assist` package version from the environment, also add `LABEL com.azure.containerizationassist.version=\"\u003Cversion>\"`; otherwise omit the version label — never hard-code a stale version string. Do NOT use `org.opencontainers.image.*` keys. |\n\nAfter applying all fixes, run **Step 2 again** as a self-check on the new\ncontent. If any rule still triggers, fix it before writing. Never write a\nDockerfile that still violates a security `error` rule.\n\n### Step 7 — Apply the change\n\n- If `path` was provided **and** the file scored below A (any issues found):\n  **write the remediated content to that file immediately**, using whatever\n  file-editing capability the environment exposes. Do NOT ask the user to\n  copy-paste. Do NOT defer this to a “Next steps” list.\n- If `path` was provided **and** the file already scored A with 0 issues:\n  do nothing — the file is fine as-is.\n- If only inline `dockerfile` content was provided (no `path`): you cannot\n  write to disk — say so and include the fixed content inline.\n- If the user explicitly asks to see the fixed content (“show me the file”,\n  “print the Dockerfile”, etc.), include it under an extra **Fixed\n  Dockerfile** section. Otherwise omit it — the file on disk is the\n  artifact, not the chat output.\n\n## Output format\n\nUse these exact sections in order:\n\n````md\n**Dockerfile validation** — `\u003Cpath or \"(inline)\">`\n\n### Score\n- **Grade:** \u003CA|B|C|D|F> (\u003Cscore>\u002F100)\n- **Priority:** \u003Chigh|medium|low>\n- **Strategy:** \u003Crewrite|refactor|tweak>\n\n### Issues (\u003CN>)\n\n#### Security (\u003Ccount>)\n- *\u003Cseverity>* `\u003CruleId>` (line \u003Cline>) — \u003Cmessage>\n- ...\n\n#### Performance (\u003Ccount>)\n- *\u003Cseverity>* `\u003CruleId>` (line \u003Cline>) — \u003Cmessage>\n- ...\n\n#### Best practices (\u003Ccount>)\n- *\u003Cseverity>* `\u003CruleId>` (line \u003Cline>) — \u003Cmessage>\n- ...\n\n> If a category has 0 issues, write `- none`.\n\n### Result\n✅ Wrote remediated Dockerfile to `\u003Cpath>`. \u003CN> issue(s) fixed.\n\n> Replace this with `✅ Dockerfile already meets the baseline. No changes\n> required.` if the input scored A with 0 issues, OR with `⚠️ Inline\n> content — no path provided. Fixed content below.` when only inline\n> content was supplied.\n\n### Diff summary\n- **Added:** \u003Cbullet list of new instructions>\n- **Removed:** \u003Cbullet list of dropped\u002Freplaced instructions>\n- **Modified:** \u003Cbullet list of in-place edits>\n\n> Omit this section entirely if no changes were applied.\n\n### Fixed Dockerfile *(only when no path was given, or when the user asked to see it)*\n\n```dockerfile\n\u003Cfull remediated Dockerfile content>\n```\n\n### Next steps\n1. Rebuild: `docker buildx build --platform=\u003CtargetPlatform> -t \u003Cname>:dev \u003Cbuild-context>`.\n2. Re-run **fix-dockerfile** to confirm score is **A** (90+).\n3. Once clean, proceed to `generate-k8s-manifests`.\n````\n\nIf the input scores **A with 0 issues**, the output collapses to: the\n**Score** section, the **Issues** section (all “none”), and the **Result**\nblock — nothing else.\n\n## Constraints\n\n- The artifact is the **file on disk**, not the chat output. Always write\n  the remediated content to `path` immediately after Step 6 when changes\n  are needed.\n- NEVER write a Dockerfile that still has any `error`-severity issue.\n- NEVER print the full Dockerfile in chat unless (a) no `path` was given,\n  or (b) the user explicitly asks to see it.\n- NEVER keep a value next to any secret-pattern env var name. Even if the\n  user wrote it themselves, surface the violation and remove it.\n- NEVER replace `:latest` with another floating tag; always a specific major\n  version.\n- NEVER add a `HEALTHCHECK` that uses tools not present in the base image\n  (e.g. `curl` on distroless). Use the distroless fallback comment.\n- Preserve the user's choice of base image **family** (don't switch\n  `node:20-alpine` → `mcr.microsoft.com\u002F...` unless `:latest` forced a\n  retag).\n- Line numbers in the issue list must reference the **original** file.\n\n## Failure modes\n\n| Symptom | Action |\n|---|---|\n| Neither `dockerfile` nor `path` provided | Ask for one. STOP. |\n| `path` doesn't exist or isn't readable | Echo path, ask user to verify. STOP. **Do NOT generate a new Dockerfile** — if the user wants one created, point them at the `generate-dockerfile` skill. |\n| File has no `FROM ` line | Reject: \"This doesn't look like a Dockerfile.\" STOP. **Do NOT generate one from scratch** — use `generate-dockerfile` for that. |\n| Parse failure (unbalanced quotes, etc.) | Surface a single `parse-error` issue (severity `error`), skip remaining rules, set Grade = F, Strategy = `rewrite`. |\n| User insists on keeping a secret in `ENV` | Refuse. Explain that K8s Secrets are the only acceptable path. |\n",{"data":40,"body":42},{"name":4,"description":6,"argument-hint":41},"\u003Cpath to Dockerfile | inline Dockerfile content> [environment=production|development]",{"type":43,"children":44},"root",[45,53,59,66,222,227,233,240,260,266,286,348,368,375,703,709,1106,1112,1411,1417,1436,1441,1528,1534,1579,1585,1671,1684,1689,2225,2244,2250,2325,2331,2336,3533,3565,3571,3701,3707,3873],{"type":46,"tag":47,"props":48,"children":49},"element","h1",{"id":4},[50],{"type":51,"value":52},"text","Fix Dockerfile",{"type":46,"tag":54,"props":55,"children":56},"p",{},[57],{"type":51,"value":58},"Validate an existing Dockerfile against a fixed rule set, score it, and produce\na fully remediated version. Deterministic — every rule below is a regex or a\nstructural check, not a judgment call.",{"type":46,"tag":60,"props":61,"children":63},"h2",{"id":62},"inputs",[64],{"type":51,"value":65},"Inputs",{"type":46,"tag":67,"props":68,"children":69},"table",{},[70,94],{"type":46,"tag":71,"props":72,"children":73},"thead",{},[74],{"type":46,"tag":75,"props":76,"children":77},"tr",{},[78,84,89],{"type":46,"tag":79,"props":80,"children":81},"th",{},[82],{"type":51,"value":83},"Field",{"type":46,"tag":79,"props":85,"children":86},{},[87],{"type":51,"value":88},"Required",{"type":46,"tag":79,"props":90,"children":91},{},[92],{"type":51,"value":93},"Description",{"type":46,"tag":95,"props":96,"children":97},"tbody",{},[98,144,180],{"type":46,"tag":75,"props":99,"children":100},{},[101,127,132],{"type":46,"tag":102,"props":103,"children":104},"td",{},[105,112,114,120,121],{"type":46,"tag":106,"props":107,"children":109},"code",{"className":108},[],[110],{"type":51,"value":111},"dockerfile",{"type":51,"value":113}," ",{"type":46,"tag":115,"props":116,"children":117},"em",{},[118],{"type":51,"value":119},"or",{"type":51,"value":113},{"type":46,"tag":106,"props":122,"children":124},{"className":123},[],[125],{"type":51,"value":126},"path",{"type":46,"tag":102,"props":128,"children":129},{},[130],{"type":51,"value":131},"yes",{"type":46,"tag":102,"props":133,"children":134},{},[135,137,142],{"type":51,"value":136},"Either the file contents OR an absolute path. If ",{"type":46,"tag":106,"props":138,"children":140},{"className":139},[],[141],{"type":51,"value":126},{"type":51,"value":143}," is given, read it.",{"type":46,"tag":75,"props":145,"children":146},{},[147,156,161],{"type":46,"tag":102,"props":148,"children":149},{},[150],{"type":46,"tag":106,"props":151,"children":153},{"className":152},[],[154],{"type":51,"value":155},"environment",{"type":46,"tag":102,"props":157,"children":158},{},[159],{"type":51,"value":160},"optional",{"type":46,"tag":102,"props":162,"children":163},{},[164,170,172,178],{"type":46,"tag":106,"props":165,"children":167},{"className":166},[],[168],{"type":51,"value":169},"production",{"type":51,"value":171}," (default) or ",{"type":46,"tag":106,"props":173,"children":175},{"className":174},[],[176],{"type":51,"value":177},"development",{"type":51,"value":179},". Some rules downgrade to suggestions in dev.",{"type":46,"tag":75,"props":181,"children":182},{},[183,192,196],{"type":46,"tag":102,"props":184,"children":185},{},[186],{"type":46,"tag":106,"props":187,"children":189},{"className":188},[],[190],{"type":51,"value":191},"targetPlatform",{"type":46,"tag":102,"props":193,"children":194},{},[195],{"type":51,"value":160},{"type":46,"tag":102,"props":197,"children":198},{},[199,205,206,212,214,220],{"type":46,"tag":106,"props":200,"children":202},{"className":201},[],[203],{"type":51,"value":204},"linux\u002Famd64",{"type":51,"value":171},{"type":46,"tag":106,"props":207,"children":209},{"className":208},[],[210],{"type":51,"value":211},"linux\u002Farm64",{"type":51,"value":213},". Used only in the ",{"type":46,"tag":215,"props":216,"children":217},"strong",{},[218],{"type":51,"value":219},"Next steps",{"type":51,"value":221}," section.",{"type":46,"tag":54,"props":223,"children":224},{},[225],{"type":51,"value":226},"If neither is provided → ask the user for the Dockerfile path. STOP.",{"type":46,"tag":60,"props":228,"children":230},{"id":229},"procedure",[231],{"type":51,"value":232},"Procedure",{"type":46,"tag":234,"props":235,"children":237},"h3",{"id":236},"step-1-read-the-file",[238],{"type":51,"value":239},"Step 1 — Read the file",{"type":46,"tag":54,"props":241,"children":242},{},[243,245,250,252,258],{"type":51,"value":244},"If ",{"type":46,"tag":106,"props":246,"children":248},{"className":247},[],[249],{"type":51,"value":126},{"type":51,"value":251}," is given, read the file content. Reject if it doesn't contain at\nleast one ",{"type":46,"tag":106,"props":253,"children":255},{"className":254},[],[256],{"type":51,"value":257},"FROM ",{"type":51,"value":259}," line (case-insensitive) — that's not a Dockerfile.",{"type":46,"tag":234,"props":261,"children":263},{"id":262},"step-2-run-every-rule",[264],{"type":51,"value":265},"Step 2 — Run every rule",{"type":46,"tag":54,"props":267,"children":268},{},[269,271,276,278,284],{"type":51,"value":270},"Apply each rule below in order. For each match, record an ",{"type":46,"tag":215,"props":272,"children":273},{},[274],{"type":51,"value":275},"issue",{"type":51,"value":277}," with\n",{"type":46,"tag":106,"props":279,"children":281},{"className":280},[],[282],{"type":51,"value":283},"{ ruleId, category, severity, line, message }",{"type":51,"value":285},".",{"type":46,"tag":54,"props":287,"children":288},{},[289,295,297,303,305,311,313,319,321,327,328,333,335,340,341,347],{"type":46,"tag":106,"props":290,"children":292},{"className":291},[],[293],{"type":51,"value":294},"severity",{"type":51,"value":296}," ∈ ",{"type":46,"tag":106,"props":298,"children":300},{"className":299},[],[301],{"type":51,"value":302},"error",{"type":51,"value":304}," (must fix) | ",{"type":46,"tag":106,"props":306,"children":308},{"className":307},[],[309],{"type":51,"value":310},"warning",{"type":51,"value":312}," (should fix) | ",{"type":46,"tag":106,"props":314,"children":316},{"className":315},[],[317],{"type":51,"value":318},"info",{"type":51,"value":320}," (nice to fix).\n",{"type":46,"tag":106,"props":322,"children":324},{"className":323},[],[325],{"type":51,"value":326},"category",{"type":51,"value":296},{"type":46,"tag":106,"props":329,"children":331},{"className":330},[],[332],{"type":51,"value":15},{"type":51,"value":334}," | ",{"type":46,"tag":106,"props":336,"children":338},{"className":337},[],[339],{"type":51,"value":19},{"type":51,"value":334},{"type":46,"tag":106,"props":342,"children":344},{"className":343},[],[345],{"type":51,"value":346},"bestPractices",{"type":51,"value":285},{"type":46,"tag":54,"props":349,"children":350},{},[351,353,359,361,367],{"type":51,"value":352},"When a rule says \"scan lines\", split the file on ",{"type":46,"tag":106,"props":354,"children":356},{"className":355},[],[357],{"type":51,"value":358},"\\n",{"type":51,"value":360},", trim each line, ignore\nempty lines and lines starting with ",{"type":46,"tag":106,"props":362,"children":364},{"className":363},[],[365],{"type":51,"value":366},"#",{"type":51,"value":285},{"type":46,"tag":369,"props":370,"children":372},"h4",{"id":371},"security-rules-highest-priority",[373],{"type":51,"value":374},"Security rules (highest priority)",{"type":46,"tag":67,"props":376,"children":377},{},[378,404],{"type":46,"tag":71,"props":379,"children":380},{},[381],{"type":46,"tag":75,"props":382,"children":383},{},[384,389,394,399],{"type":46,"tag":79,"props":385,"children":386},{},[387],{"type":51,"value":388},"ruleId",{"type":46,"tag":79,"props":390,"children":391},{},[392],{"type":51,"value":393},"Pattern",{"type":46,"tag":79,"props":395,"children":396},{},[397],{"type":51,"value":398},"Severity",{"type":46,"tag":79,"props":400,"children":401},{},[402],{"type":51,"value":403},"Message",{"type":46,"tag":95,"props":405,"children":406},{},[407,444,508,574,625,664],{"type":46,"tag":75,"props":408,"children":409},{},[410,419,432,439],{"type":46,"tag":102,"props":411,"children":412},{},[413],{"type":46,"tag":106,"props":414,"children":416},{"className":415},[],[417],{"type":51,"value":418},"block-root-user",{"type":46,"tag":102,"props":420,"children":421},{},[422,424,430],{"type":51,"value":423},"Any line matches ",{"type":46,"tag":106,"props":425,"children":427},{"className":426},[],[428],{"type":51,"value":429},"^USER\\s+(root|0)\\s*$",{"type":51,"value":431}," (case-insensitive multiline)",{"type":46,"tag":102,"props":433,"children":434},{},[435],{"type":46,"tag":215,"props":436,"children":437},{},[438],{"type":51,"value":302},{"type":46,"tag":102,"props":440,"children":441},{},[442],{"type":51,"value":443},"Running as root is forbidden. Replace with a non-root user.",{"type":46,"tag":75,"props":445,"children":446},{},[447,456,489,496],{"type":46,"tag":102,"props":448,"children":449},{},[450],{"type":46,"tag":106,"props":451,"children":453},{"className":452},[],[454],{"type":51,"value":455},"no-root-user",{"type":46,"tag":102,"props":457,"children":458},{},[459,461,467,469,474,476,481,483],{"type":51,"value":460},"No ",{"type":46,"tag":106,"props":462,"children":464},{"className":463},[],[465],{"type":51,"value":466},"USER",{"type":51,"value":468}," line at all, OR final ",{"type":46,"tag":106,"props":470,"children":472},{"className":471},[],[473],{"type":51,"value":466},{"type":51,"value":475}," line argument is ",{"type":46,"tag":106,"props":477,"children":479},{"className":478},[],[480],{"type":51,"value":43},{"type":51,"value":482},"\u002F",{"type":46,"tag":106,"props":484,"children":486},{"className":485},[],[487],{"type":51,"value":488},"0",{"type":46,"tag":102,"props":490,"children":491},{},[492],{"type":46,"tag":215,"props":493,"children":494},{},[495],{"type":51,"value":302},{"type":46,"tag":102,"props":497,"children":498},{},[499,501,506],{"type":51,"value":500},"Container must declare a non-root ",{"type":46,"tag":106,"props":502,"children":504},{"className":503},[],[505],{"type":51,"value":466},{"type":51,"value":507}," instruction.",{"type":46,"tag":75,"props":509,"children":510},{},[511,520,549,556],{"type":46,"tag":102,"props":512,"children":513},{},[514],{"type":46,"tag":106,"props":515,"children":517},{"className":516},[],[518],{"type":51,"value":519},"block-secrets-in-env",{"type":46,"tag":102,"props":521,"children":522},{},[523,525,531,533,539,541,547],{"type":51,"value":524},"Any ",{"type":46,"tag":106,"props":526,"children":528},{"className":527},[],[529],{"type":51,"value":530},"ENV",{"type":51,"value":532}," or ",{"type":46,"tag":106,"props":534,"children":536},{"className":535},[],[537],{"type":51,"value":538},"ARG",{"type":51,"value":540}," line matches ",{"type":46,"tag":106,"props":542,"children":544},{"className":543},[],[545],{"type":51,"value":546},"(?i)(PASSWORD|PASSWD|SECRET|TOKEN|API[_-]?KEY|PRIVATE[_-]?KEY|ACCESS[_-]?KEY|CREDENTIAL|DATABASE_URL|CONNECTION_STRING|REDIS_URL|MONGODB?_URI|_DSN)\\b.*=\\s*\\S+",{"type":51,"value":548}," with a non-empty, non-placeholder value",{"type":46,"tag":102,"props":550,"children":551},{},[552],{"type":46,"tag":215,"props":553,"children":554},{},[555],{"type":51,"value":302},{"type":46,"tag":102,"props":557,"children":558},{},[559,561,566,567,572],{"type":51,"value":560},"Hardcoded secret in ",{"type":46,"tag":106,"props":562,"children":564},{"className":563},[],[565],{"type":51,"value":530},{"type":51,"value":482},{"type":46,"tag":106,"props":568,"children":570},{"className":569},[],[571],{"type":51,"value":538},{"type":51,"value":573},". Inject via runtime (Kubernetes Secret).",{"type":46,"tag":75,"props":575,"children":576},{},[577,586,607,614],{"type":46,"tag":102,"props":578,"children":579},{},[580],{"type":46,"tag":106,"props":581,"children":583},{"className":582},[],[584],{"type":51,"value":585},"no-secrets",{"type":46,"tag":102,"props":587,"children":588},{},[589,591,597,599,605],{"type":51,"value":590},"Same as above but covers ",{"type":46,"tag":106,"props":592,"children":594},{"className":593},[],[595],{"type":51,"value":596},"RUN export FOO=…",{"type":51,"value":598}," and ",{"type":46,"tag":106,"props":600,"children":602},{"className":601},[],[603],{"type":51,"value":604},"RUN echo \"FOO=…\"",{"type":51,"value":606}," shapes",{"type":46,"tag":102,"props":608,"children":609},{},[610],{"type":46,"tag":215,"props":611,"children":612},{},[613],{"type":51,"value":302},{"type":46,"tag":102,"props":615,"children":616},{},[617,618,624],{"type":51,"value":560},{"type":46,"tag":106,"props":619,"children":621},{"className":620},[],[622],{"type":51,"value":623},"RUN",{"type":51,"value":285},{"type":46,"tag":75,"props":626,"children":627},{},[628,637,647,651],{"type":46,"tag":102,"props":629,"children":630},{},[631],{"type":46,"tag":106,"props":632,"children":634},{"className":633},[],[635],{"type":51,"value":636},"avoid-sudo",{"type":46,"tag":102,"props":638,"children":639},{},[640,641],{"type":51,"value":423},{"type":46,"tag":106,"props":642,"children":644},{"className":643},[],[645],{"type":51,"value":646},"(?i)\\bsudo\\b",{"type":46,"tag":102,"props":648,"children":649},{},[650],{"type":51,"value":310},{"type":46,"tag":102,"props":652,"children":653},{},[654,656,662],{"type":51,"value":655},"Drop ",{"type":46,"tag":106,"props":657,"children":659},{"className":658},[],[660],{"type":51,"value":661},"sudo",{"type":51,"value":663},"; run the entire stage as the required user instead.",{"type":46,"tag":75,"props":665,"children":666},{},[667,676,686,690],{"type":46,"tag":102,"props":668,"children":669},{},[670],{"type":46,"tag":106,"props":671,"children":673},{"className":672},[],[674],{"type":51,"value":675},"avoid-apt-upgrade",{"type":46,"tag":102,"props":677,"children":678},{},[679,680],{"type":51,"value":423},{"type":46,"tag":106,"props":681,"children":683},{"className":682},[],[684],{"type":51,"value":685},"(?i)apt-get\\s+(upgrade|dist-upgrade)",{"type":46,"tag":102,"props":687,"children":688},{},[689],{"type":51,"value":310},{"type":46,"tag":102,"props":691,"children":692},{},[693,695,701],{"type":51,"value":694},"Avoid ",{"type":46,"tag":106,"props":696,"children":698},{"className":697},[],[699],{"type":51,"value":700},"apt-get upgrade",{"type":51,"value":702},"; pin package versions.",{"type":46,"tag":369,"props":704,"children":706},{"id":705},"performance-optimization-rules",[707],{"type":51,"value":708},"Performance \u002F optimization rules",{"type":46,"tag":67,"props":710,"children":711},{},[712,734],{"type":46,"tag":71,"props":713,"children":714},{},[715],{"type":46,"tag":75,"props":716,"children":717},{},[718,722,726,730],{"type":46,"tag":79,"props":719,"children":720},{},[721],{"type":51,"value":388},{"type":46,"tag":79,"props":723,"children":724},{},[725],{"type":51,"value":393},{"type":46,"tag":79,"props":727,"children":728},{},[729],{"type":51,"value":398},{"type":46,"tag":79,"props":731,"children":732},{},[733],{"type":51,"value":403},{"type":46,"tag":95,"props":735,"children":736},{},[737,795,846,891,939,1021],{"type":46,"tag":75,"props":738,"children":739},{},[740,749,780,784],{"type":46,"tag":102,"props":741,"children":742},{},[743],{"type":46,"tag":106,"props":744,"children":746},{"className":745},[],[747],{"type":51,"value":748},"optimize-package-install",{"type":46,"tag":102,"props":750,"children":751},{},[752,757,759,765,767,773,775],{"type":46,"tag":106,"props":753,"children":755},{"className":754},[],[756],{"type":51,"value":623},{"type":51,"value":758}," line with ",{"type":46,"tag":106,"props":760,"children":762},{"className":761},[],[763],{"type":51,"value":764},"apt-get install",{"type":51,"value":766}," but NO ",{"type":46,"tag":106,"props":768,"children":770},{"className":769},[],[771],{"type":51,"value":772},"rm -rf \u002Fvar\u002Flib\u002Fapt\u002Flists\u002F*",{"type":51,"value":774}," in the same ",{"type":46,"tag":106,"props":776,"children":778},{"className":777},[],[779],{"type":51,"value":623},{"type":46,"tag":102,"props":781,"children":782},{},[783],{"type":51,"value":310},{"type":46,"tag":102,"props":785,"children":786},{},[787,789,794],{"type":51,"value":788},"Combine update + install + cleanup in one ",{"type":46,"tag":106,"props":790,"children":792},{"className":791},[],[793],{"type":51,"value":623},{"type":51,"value":285},{"type":46,"tag":75,"props":796,"children":797},{},[798,807,824,828],{"type":46,"tag":102,"props":799,"children":800},{},[801],{"type":46,"tag":106,"props":802,"children":804},{"className":803},[],[805],{"type":51,"value":806},"apk-no-cache",{"type":46,"tag":102,"props":808,"children":809},{},[810,816,818],{"type":46,"tag":106,"props":811,"children":813},{"className":812},[],[814],{"type":51,"value":815},"apk add",{"type":51,"value":817}," without ",{"type":46,"tag":106,"props":819,"children":821},{"className":820},[],[822],{"type":51,"value":823},"--no-cache",{"type":46,"tag":102,"props":825,"children":826},{},[827],{"type":51,"value":318},{"type":46,"tag":102,"props":829,"children":830},{},[831,833,838,840,845],{"type":51,"value":832},"Add ",{"type":46,"tag":106,"props":834,"children":836},{"className":835},[],[837],{"type":51,"value":823},{"type":51,"value":839}," to ",{"type":46,"tag":106,"props":841,"children":843},{"className":842},[],[844],{"type":51,"value":815},{"type":51,"value":285},{"type":46,"tag":75,"props":847,"children":848},{},[849,858,874,878],{"type":46,"tag":102,"props":850,"children":851},{},[852],{"type":46,"tag":106,"props":853,"children":855},{"className":854},[],[856],{"type":51,"value":857},"recommend-npm-ci",{"type":46,"tag":102,"props":859,"children":860},{},[861,867,868],{"type":46,"tag":106,"props":862,"children":864},{"className":863},[],[865],{"type":51,"value":866},"npm install",{"type":51,"value":817},{"type":46,"tag":106,"props":869,"children":871},{"className":870},[],[872],{"type":51,"value":873},"-g",{"type":46,"tag":102,"props":875,"children":876},{},[877],{"type":51,"value":318},{"type":46,"tag":102,"props":879,"children":880},{},[881,883,889],{"type":51,"value":882},"Use ",{"type":46,"tag":106,"props":884,"children":886},{"className":885},[],[887],{"type":51,"value":888},"npm ci",{"type":51,"value":890}," for reproducible builds.",{"type":46,"tag":75,"props":892,"children":893},{},[894,903,915,919],{"type":46,"tag":102,"props":895,"children":896},{},[897],{"type":46,"tag":106,"props":898,"children":900},{"className":899},[],[901],{"type":51,"value":902},"excessive-run-commands",{"type":46,"tag":102,"props":904,"children":905},{},[906,908,913],{"type":51,"value":907},"Count of ",{"type":46,"tag":106,"props":909,"children":911},{"className":910},[],[912],{"type":51,"value":623},{"type":51,"value":914}," lines ≥ 6",{"type":46,"tag":102,"props":916,"children":917},{},[918],{"type":51,"value":318},{"type":46,"tag":102,"props":920,"children":921},{},[922,924,929,931,937],{"type":51,"value":923},"Combine ",{"type":46,"tag":106,"props":925,"children":927},{"className":926},[],[928],{"type":51,"value":623},{"type":51,"value":930}," instructions with ",{"type":46,"tag":106,"props":932,"children":934},{"className":933},[],[935],{"type":51,"value":936},"&&",{"type":51,"value":938}," to reduce layers.",{"type":46,"tag":75,"props":940,"children":941},{},[942,951,1012,1016],{"type":46,"tag":102,"props":943,"children":944},{},[945],{"type":46,"tag":106,"props":946,"children":948},{"className":947},[],[949],{"type":51,"value":950},"dependency-order",{"type":46,"tag":102,"props":952,"children":953},{},[954,960,962,968,970,975,977,983,985,991,992,998,999,1005,1006],{"type":46,"tag":106,"props":955,"children":957},{"className":956},[],[958],{"type":51,"value":959},"COPY . .",{"type":51,"value":961}," (or ",{"type":46,"tag":106,"props":963,"children":965},{"className":964},[],[966],{"type":51,"value":967},"COPY . \u002F\u003Cdir>",{"type":51,"value":969},") appears ",{"type":46,"tag":215,"props":971,"children":972},{},[973],{"type":51,"value":974},"before",{"type":51,"value":976}," any ",{"type":46,"tag":106,"props":978,"children":980},{"className":979},[],[981],{"type":51,"value":982},"COPY package*.json",{"type":51,"value":984}," \u002F ",{"type":46,"tag":106,"props":986,"children":988},{"className":987},[],[989],{"type":51,"value":990},"COPY pom.xml",{"type":51,"value":984},{"type":46,"tag":106,"props":993,"children":995},{"className":994},[],[996],{"type":51,"value":997},"COPY go.mod",{"type":51,"value":984},{"type":46,"tag":106,"props":1000,"children":1002},{"className":1001},[],[1003],{"type":51,"value":1004},"COPY requirements*.txt",{"type":51,"value":984},{"type":46,"tag":106,"props":1007,"children":1009},{"className":1008},[],[1010],{"type":51,"value":1011},"COPY Cargo.toml",{"type":46,"tag":102,"props":1013,"children":1014},{},[1015],{"type":51,"value":318},{"type":46,"tag":102,"props":1017,"children":1018},{},[1019],{"type":51,"value":1020},"Copy dependency manifests before source for better layer caching.",{"type":46,"tag":75,"props":1022,"children":1023},{},[1024,1033,1097,1101],{"type":46,"tag":102,"props":1025,"children":1026},{},[1027],{"type":46,"tag":106,"props":1028,"children":1030},{"className":1029},[],[1031],{"type":51,"value":1032},"recommend-multistage",{"type":46,"tag":102,"props":1034,"children":1035},{},[1036,1038,1044,1046,1052,1054,1060,1061,1067,1068,1074,1075,1081,1082,1088,1090,1095],{"type":51,"value":1037},"Single ",{"type":46,"tag":106,"props":1039,"children":1041},{"className":1040},[],[1042],{"type":51,"value":1043},"FROM",{"type":51,"value":1045}," AND any of ",{"type":46,"tag":106,"props":1047,"children":1049},{"className":1048},[],[1050],{"type":51,"value":1051},"mvn",{"type":51,"value":1053},", ",{"type":46,"tag":106,"props":1055,"children":1057},{"className":1056},[],[1058],{"type":51,"value":1059},"gradle",{"type":51,"value":1053},{"type":46,"tag":106,"props":1062,"children":1064},{"className":1063},[],[1065],{"type":51,"value":1066},"npm run build",{"type":51,"value":1053},{"type":46,"tag":106,"props":1069,"children":1071},{"className":1070},[],[1072],{"type":51,"value":1073},"go build",{"type":51,"value":1053},{"type":46,"tag":106,"props":1076,"children":1078},{"className":1077},[],[1079],{"type":51,"value":1080},"cargo build",{"type":51,"value":1053},{"type":46,"tag":106,"props":1083,"children":1085},{"className":1084},[],[1086],{"type":51,"value":1087},"dotnet publish",{"type":51,"value":1089}," appears in a ",{"type":46,"tag":106,"props":1091,"children":1093},{"className":1092},[],[1094],{"type":51,"value":623},{"type":51,"value":1096}," line",{"type":46,"tag":102,"props":1098,"children":1099},{},[1100],{"type":51,"value":318},{"type":46,"tag":102,"props":1102,"children":1103},{},[1104],{"type":51,"value":1105},"Use multi-stage build to drop build tools from the final image.",{"type":46,"tag":369,"props":1107,"children":1109},{"id":1108},"best-practice-quality-rules",[1110],{"type":51,"value":1111},"Best-practice \u002F quality rules",{"type":46,"tag":67,"props":1113,"children":1114},{},[1115,1137],{"type":46,"tag":71,"props":1116,"children":1117},{},[1118],{"type":46,"tag":75,"props":1119,"children":1120},{},[1121,1125,1129,1133],{"type":46,"tag":79,"props":1122,"children":1123},{},[1124],{"type":51,"value":388},{"type":46,"tag":79,"props":1126,"children":1127},{},[1128],{"type":51,"value":393},{"type":46,"tag":79,"props":1130,"children":1131},{},[1132],{"type":51,"value":398},{"type":46,"tag":79,"props":1134,"children":1135},{},[1136],{"type":51,"value":403},{"type":46,"tag":95,"props":1138,"children":1139},{},[1140,1195,1234,1288,1364],{"type":46,"tag":75,"props":1141,"children":1142},{},[1143,1152,1179,1183],{"type":46,"tag":102,"props":1144,"children":1145},{},[1146],{"type":46,"tag":106,"props":1147,"children":1149},{"className":1148},[],[1150],{"type":51,"value":1151},"specific-base-image",{"type":46,"tag":102,"props":1153,"children":1154},{},[1155,1156,1161,1163,1169,1171,1177],{"type":51,"value":524},{"type":46,"tag":106,"props":1157,"children":1159},{"className":1158},[],[1160],{"type":51,"value":1043},{"type":51,"value":1162}," whose tag is ",{"type":46,"tag":106,"props":1164,"children":1166},{"className":1165},[],[1167],{"type":51,"value":1168},"latest",{"type":51,"value":1170}," or missing (no ",{"type":46,"tag":106,"props":1172,"children":1174},{"className":1173},[],[1175],{"type":51,"value":1176},":",{"type":51,"value":1178},")",{"type":46,"tag":102,"props":1180,"children":1181},{},[1182],{"type":51,"value":310},{"type":46,"tag":102,"props":1184,"children":1185},{},[1186,1188,1194],{"type":51,"value":1187},"Pin a specific major version tag, never ",{"type":46,"tag":106,"props":1189,"children":1191},{"className":1190},[],[1192],{"type":51,"value":1193},":latest",{"type":51,"value":285},{"type":46,"tag":75,"props":1196,"children":1197},{},[1198,1207,1218,1222],{"type":46,"tag":102,"props":1199,"children":1200},{},[1201],{"type":46,"tag":106,"props":1202,"children":1204},{"className":1203},[],[1205],{"type":51,"value":1206},"require-healthcheck",{"type":46,"tag":102,"props":1208,"children":1209},{},[1210,1212],{"type":51,"value":1211},"No line starts with ",{"type":46,"tag":106,"props":1213,"children":1215},{"className":1214},[],[1216],{"type":51,"value":1217},"HEALTHCHECK ",{"type":46,"tag":102,"props":1219,"children":1220},{},[1221],{"type":51,"value":318},{"type":46,"tag":102,"props":1223,"children":1224},{},[1225,1226,1232],{"type":51,"value":832},{"type":46,"tag":106,"props":1227,"children":1229},{"className":1228},[],[1230],{"type":51,"value":1231},"HEALTHCHECK",{"type":51,"value":1233}," (or note why if image is distroless \u002F shell-less).",{"type":46,"tag":75,"props":1235,"children":1236},{},[1237,1246,1266,1270],{"type":46,"tag":102,"props":1238,"children":1239},{},[1240],{"type":46,"tag":106,"props":1241,"children":1243},{"className":1242},[],[1244],{"type":51,"value":1245},"require-workdir",{"type":46,"tag":102,"props":1247,"children":1248},{},[1249,1250,1256,1258,1264],{"type":51,"value":460},{"type":46,"tag":106,"props":1251,"children":1253},{"className":1252},[],[1254],{"type":51,"value":1255},"WORKDIR",{"type":51,"value":1257}," line, OR any ",{"type":46,"tag":106,"props":1259,"children":1261},{"className":1260},[],[1262],{"type":51,"value":1263},"RUN cd \u002F",{"type":51,"value":1265}," pattern",{"type":46,"tag":102,"props":1267,"children":1268},{},[1269],{"type":51,"value":318},{"type":46,"tag":102,"props":1271,"children":1272},{},[1273,1274,1279,1281,1287],{"type":51,"value":882},{"type":46,"tag":106,"props":1275,"children":1277},{"className":1276},[],[1278],{"type":51,"value":1255},{"type":51,"value":1280}," instead of ",{"type":46,"tag":106,"props":1282,"children":1284},{"className":1283},[],[1285],{"type":51,"value":1286},"cd",{"type":51,"value":285},{"type":46,"tag":75,"props":1289,"children":1290},{},[1291,1300,1348,1352],{"type":46,"tag":102,"props":1292,"children":1293},{},[1294],{"type":46,"tag":106,"props":1295,"children":1297},{"className":1296},[],[1298],{"type":51,"value":1299},"recommend-expose",{"type":46,"tag":102,"props":1301,"children":1302},{},[1303,1305,1311,1312,1318,1319,1325,1326,1332,1333,1339,1341,1347],{"type":51,"value":1304},"Application code references a port (",{"type":46,"tag":106,"props":1306,"children":1308},{"className":1307},[],[1309],{"type":51,"value":1310},"PORT=",{"type":51,"value":1053},{"type":46,"tag":106,"props":1313,"children":1315},{"className":1314},[],[1316],{"type":51,"value":1317},"LISTEN",{"type":51,"value":1053},{"type":46,"tag":106,"props":1320,"children":1322},{"className":1321},[],[1323],{"type":51,"value":1324},":8080",{"type":51,"value":1053},{"type":46,"tag":106,"props":1327,"children":1329},{"className":1328},[],[1330],{"type":51,"value":1331},":3000",{"type":51,"value":1053},{"type":46,"tag":106,"props":1334,"children":1336},{"className":1335},[],[1337],{"type":51,"value":1338},":5000",{"type":51,"value":1340},") but no ",{"type":46,"tag":106,"props":1342,"children":1344},{"className":1343},[],[1345],{"type":51,"value":1346},"EXPOSE",{"type":51,"value":1096},{"type":46,"tag":102,"props":1349,"children":1350},{},[1351],{"type":51,"value":318},{"type":46,"tag":102,"props":1353,"children":1354},{},[1355,1356,1362],{"type":51,"value":832},{"type":46,"tag":106,"props":1357,"children":1359},{"className":1358},[],[1360],{"type":51,"value":1361},"EXPOSE \u003Cport>",{"type":51,"value":1363}," to document the listener.",{"type":46,"tag":75,"props":1365,"children":1366},{},[1367,1376,1386,1390],{"type":46,"tag":102,"props":1368,"children":1369},{},[1370],{"type":46,"tag":106,"props":1371,"children":1373},{"className":1372},[],[1374],{"type":51,"value":1375},"missing-attribution-labels",{"type":46,"tag":102,"props":1377,"children":1378},{},[1379,1380],{"type":51,"value":460},{"type":46,"tag":106,"props":1381,"children":1383},{"className":1382},[],[1384],{"type":51,"value":1385},"LABEL com.azure.containerizationassist.createdby",{"type":46,"tag":102,"props":1387,"children":1388},{},[1389],{"type":51,"value":318},{"type":46,"tag":102,"props":1391,"children":1392},{},[1393,1395,1401,1403,1409],{"type":51,"value":1394},"Add the attribution ",{"type":46,"tag":106,"props":1396,"children":1398},{"className":1397},[],[1399],{"type":51,"value":1400},"createdby",{"type":51,"value":1402}," label (and ",{"type":46,"tag":106,"props":1404,"children":1406},{"className":1405},[],[1407],{"type":51,"value":1408},"version",{"type":51,"value":1410}," if a version is available) for traceability.",{"type":46,"tag":234,"props":1412,"children":1414},{"id":1413},"step-3-score",[1415],{"type":51,"value":1416},"Step 3 — Score",{"type":46,"tag":54,"props":1418,"children":1419},{},[1420,1422,1427,1429,1434],{"type":51,"value":1421},"Start at ",{"type":46,"tag":215,"props":1423,"children":1424},{},[1425],{"type":51,"value":1426},"100",{"type":51,"value":1428},". Subtract ",{"type":46,"tag":215,"props":1430,"children":1431},{},[1432],{"type":51,"value":1433},"10",{"type":51,"value":1435}," per issue (any severity). Floor at 0.",{"type":46,"tag":54,"props":1437,"children":1438},{},[1439],{"type":51,"value":1440},"Grade band:",{"type":46,"tag":67,"props":1442,"children":1443},{},[1444,1460],{"type":46,"tag":71,"props":1445,"children":1446},{},[1447],{"type":46,"tag":75,"props":1448,"children":1449},{},[1450,1455],{"type":46,"tag":79,"props":1451,"children":1452},{},[1453],{"type":51,"value":1454},"Score",{"type":46,"tag":79,"props":1456,"children":1457},{},[1458],{"type":51,"value":1459},"Grade",{"type":46,"tag":95,"props":1461,"children":1462},{},[1463,1476,1489,1502,1515],{"type":46,"tag":75,"props":1464,"children":1465},{},[1466,1471],{"type":46,"tag":102,"props":1467,"children":1468},{},[1469],{"type":51,"value":1470},"90–100",{"type":46,"tag":102,"props":1472,"children":1473},{},[1474],{"type":51,"value":1475},"A",{"type":46,"tag":75,"props":1477,"children":1478},{},[1479,1484],{"type":46,"tag":102,"props":1480,"children":1481},{},[1482],{"type":51,"value":1483},"75–89",{"type":46,"tag":102,"props":1485,"children":1486},{},[1487],{"type":51,"value":1488},"B",{"type":46,"tag":75,"props":1490,"children":1491},{},[1492,1497],{"type":46,"tag":102,"props":1493,"children":1494},{},[1495],{"type":51,"value":1496},"60–74",{"type":46,"tag":102,"props":1498,"children":1499},{},[1500],{"type":51,"value":1501},"C",{"type":46,"tag":75,"props":1503,"children":1504},{},[1505,1510],{"type":46,"tag":102,"props":1506,"children":1507},{},[1508],{"type":51,"value":1509},"40–59",{"type":46,"tag":102,"props":1511,"children":1512},{},[1513],{"type":51,"value":1514},"D",{"type":46,"tag":75,"props":1516,"children":1517},{},[1518,1523],{"type":46,"tag":102,"props":1519,"children":1520},{},[1521],{"type":51,"value":1522},"0–39",{"type":46,"tag":102,"props":1524,"children":1525},{},[1526],{"type":51,"value":1527},"F",{"type":46,"tag":234,"props":1529,"children":1531},{"id":1530},"step-4-compute-overall-priority",[1532],{"type":51,"value":1533},"Step 4 — Compute overall priority",{"type":46,"tag":1535,"props":1536,"children":1537},"ul",{},[1538,1557,1568],{"type":46,"tag":1539,"props":1540,"children":1541},"li",{},[1542,1548,1550,1555],{"type":46,"tag":106,"props":1543,"children":1545},{"className":1544},[],[1546],{"type":51,"value":1547},"high",{"type":51,"value":1549}," if any security issue has severity ",{"type":46,"tag":106,"props":1551,"children":1553},{"className":1552},[],[1554],{"type":51,"value":302},{"type":51,"value":1556},", OR ≥ 3 security issues total.",{"type":46,"tag":1539,"props":1558,"children":1559},{},[1560,1566],{"type":46,"tag":106,"props":1561,"children":1563},{"className":1562},[],[1564],{"type":51,"value":1565},"medium",{"type":51,"value":1567}," if any security\u002Fperformance\u002Fbest-practice issue exists.",{"type":46,"tag":1539,"props":1569,"children":1570},{},[1571,1577],{"type":46,"tag":106,"props":1572,"children":1574},{"className":1573},[],[1575],{"type":51,"value":1576},"low",{"type":51,"value":1578}," if no issues found.",{"type":46,"tag":234,"props":1580,"children":1582},{"id":1581},"step-5-decide-remediation-strategy",[1583],{"type":51,"value":1584},"Step 5 — Decide remediation strategy",{"type":46,"tag":67,"props":1586,"children":1587},{},[1588,1604],{"type":46,"tag":71,"props":1589,"children":1590},{},[1591],{"type":46,"tag":75,"props":1592,"children":1593},{},[1594,1599],{"type":46,"tag":79,"props":1595,"children":1596},{},[1597],{"type":51,"value":1598},"Conditions",{"type":46,"tag":79,"props":1600,"children":1601},{},[1602],{"type":51,"value":1603},"Strategy",{"type":46,"tag":95,"props":1605,"children":1606},{},[1607,1633,1652],{"type":46,"tag":75,"props":1608,"children":1609},{},[1610,1622],{"type":46,"tag":102,"props":1611,"children":1612},{},[1613,1615,1620],{"type":51,"value":1614},"Grade = F OR ≥ 1 ",{"type":46,"tag":106,"props":1616,"children":1618},{"className":1617},[],[1619],{"type":51,"value":302},{"type":51,"value":1621}," severity issue",{"type":46,"tag":102,"props":1623,"children":1624},{},[1625,1631],{"type":46,"tag":106,"props":1626,"children":1628},{"className":1627},[],[1629],{"type":51,"value":1630},"rewrite",{"type":51,"value":1632}," — emit a fully restructured Dockerfile.",{"type":46,"tag":75,"props":1634,"children":1635},{},[1636,1641],{"type":46,"tag":102,"props":1637,"children":1638},{},[1639],{"type":51,"value":1640},"Grade ∈ {C, D}",{"type":46,"tag":102,"props":1642,"children":1643},{},[1644,1650],{"type":46,"tag":106,"props":1645,"children":1647},{"className":1646},[],[1648],{"type":51,"value":1649},"refactor",{"type":51,"value":1651}," — emit the file with targeted edits per issue.",{"type":46,"tag":75,"props":1653,"children":1654},{},[1655,1660],{"type":46,"tag":102,"props":1656,"children":1657},{},[1658],{"type":51,"value":1659},"Grade ∈ {A, B}",{"type":46,"tag":102,"props":1661,"children":1662},{},[1663,1669],{"type":46,"tag":106,"props":1664,"children":1666},{"className":1665},[],[1667],{"type":51,"value":1668},"tweak",{"type":51,"value":1670}," — emit the file with minimal edits; if no issues, return unchanged.",{"type":46,"tag":234,"props":1672,"children":1674},{"id":1673},"step-6-produce-and-apply-the-fixed-dockerfile",[1675,1677,1682],{"type":51,"value":1676},"Step 6 — Produce ",{"type":46,"tag":215,"props":1678,"children":1679},{},[1680],{"type":51,"value":1681},"and apply",{"type":51,"value":1683}," the fixed Dockerfile",{"type":46,"tag":54,"props":1685,"children":1686},{},[1687],{"type":51,"value":1688},"Walk every recorded issue and apply the corresponding fix. The fix table:",{"type":46,"tag":67,"props":1690,"children":1691},{},[1692,1707],{"type":46,"tag":71,"props":1693,"children":1694},{},[1695],{"type":46,"tag":75,"props":1696,"children":1697},{},[1698,1702],{"type":46,"tag":79,"props":1699,"children":1700},{},[1701],{"type":51,"value":388},{"type":46,"tag":79,"props":1703,"children":1704},{},[1705],{"type":51,"value":1706},"Fix",{"type":46,"tag":95,"props":1708,"children":1709},{},[1710,1771,1819,1849,1872,1895,1917,1946,1975,2006,2044,2074,2112,2156,2178],{"type":46,"tag":75,"props":1711,"children":1712},{},[1713,1727],{"type":46,"tag":102,"props":1714,"children":1715},{},[1716,1721,1722],{"type":46,"tag":106,"props":1717,"children":1719},{"className":1718},[],[1720],{"type":51,"value":418},{"type":51,"value":984},{"type":46,"tag":106,"props":1723,"children":1725},{"className":1724},[],[1726],{"type":51,"value":455},{"type":46,"tag":102,"props":1728,"children":1729},{},[1730,1732,1738,1739,1745,1747,1753,1755,1761,1763,1769],{"type":51,"value":1731},"Append (or replace existing) before final ",{"type":46,"tag":106,"props":1733,"children":1735},{"className":1734},[],[1736],{"type":51,"value":1737},"CMD",{"type":51,"value":482},{"type":46,"tag":106,"props":1740,"children":1742},{"className":1741},[],[1743],{"type":51,"value":1744},"ENTRYPOINT",{"type":51,"value":1746},": ",{"type":46,"tag":106,"props":1748,"children":1750},{"className":1749},[],[1751],{"type":51,"value":1752},"RUN adduser -D -u 10001 appuser",{"type":51,"value":1754}," (Alpine) or ",{"type":46,"tag":106,"props":1756,"children":1758},{"className":1757},[],[1759],{"type":51,"value":1760},"RUN useradd -m -u 10001 appuser",{"type":51,"value":1762}," (Debian\u002FAzure Linux), then ",{"type":46,"tag":106,"props":1764,"children":1766},{"className":1765},[],[1767],{"type":51,"value":1768},"USER appuser",{"type":51,"value":1770},". Choose flavor from base image.",{"type":46,"tag":75,"props":1772,"children":1773},{},[1774,1788],{"type":46,"tag":102,"props":1775,"children":1776},{},[1777,1782,1783],{"type":46,"tag":106,"props":1778,"children":1780},{"className":1779},[],[1781],{"type":51,"value":519},{"type":51,"value":984},{"type":46,"tag":106,"props":1784,"children":1786},{"className":1785},[],[1787],{"type":51,"value":585},{"type":46,"tag":102,"props":1789,"children":1790},{},[1791,1793,1798,1799,1804,1805,1810,1812,1818],{"type":51,"value":1792},"Delete the offending ",{"type":46,"tag":106,"props":1794,"children":1796},{"className":1795},[],[1797],{"type":51,"value":530},{"type":51,"value":482},{"type":46,"tag":106,"props":1800,"children":1802},{"className":1801},[],[1803],{"type":51,"value":538},{"type":51,"value":482},{"type":46,"tag":106,"props":1806,"children":1808},{"className":1807},[],[1809],{"type":51,"value":623},{"type":51,"value":1811}," line. Add a comment ",{"type":46,"tag":106,"props":1813,"children":1815},{"className":1814},[],[1816],{"type":51,"value":1817},"# SECRET: \u003CNAME> — inject via Kubernetes Secret at runtime",{"type":51,"value":285},{"type":46,"tag":75,"props":1820,"children":1821},{},[1822,1830],{"type":46,"tag":102,"props":1823,"children":1824},{},[1825],{"type":46,"tag":106,"props":1826,"children":1828},{"className":1827},[],[1829],{"type":51,"value":636},{"type":46,"tag":102,"props":1831,"children":1832},{},[1833,1834,1840,1842,1847],{"type":51,"value":655},{"type":46,"tag":106,"props":1835,"children":1837},{"className":1836},[],[1838],{"type":51,"value":1839},"sudo ",{"type":51,"value":1841}," prefix. If the action requires root, move it before the final ",{"type":46,"tag":106,"props":1843,"children":1845},{"className":1844},[],[1846],{"type":51,"value":466},{"type":51,"value":1848}," directive.",{"type":46,"tag":75,"props":1850,"children":1851},{},[1852,1860],{"type":46,"tag":102,"props":1853,"children":1854},{},[1855],{"type":46,"tag":106,"props":1856,"children":1858},{"className":1857},[],[1859],{"type":51,"value":675},{"type":46,"tag":102,"props":1861,"children":1862},{},[1863,1865,1871],{"type":51,"value":1864},"Replace with ",{"type":46,"tag":106,"props":1866,"children":1868},{"className":1867},[],[1869],{"type":51,"value":1870},"apt-get install -y --no-install-recommends \u003Cexplicit packages>",{"type":51,"value":285},{"type":46,"tag":75,"props":1873,"children":1874},{},[1875,1883],{"type":46,"tag":102,"props":1876,"children":1877},{},[1878],{"type":46,"tag":106,"props":1879,"children":1881},{"className":1880},[],[1882],{"type":51,"value":748},{"type":46,"tag":102,"props":1884,"children":1885},{},[1886,1888,1894],{"type":51,"value":1887},"Combine into: ",{"type":46,"tag":106,"props":1889,"children":1891},{"className":1890},[],[1892],{"type":51,"value":1893},"RUN apt-get update && apt-get install -y --no-install-recommends \u003Cpkgs> && rm -rf \u002Fvar\u002Flib\u002Fapt\u002Flists\u002F*",{"type":51,"value":285},{"type":46,"tag":75,"props":1896,"children":1897},{},[1898,1906],{"type":46,"tag":102,"props":1899,"children":1900},{},[1901],{"type":46,"tag":106,"props":1902,"children":1904},{"className":1903},[],[1905],{"type":51,"value":806},{"type":46,"tag":102,"props":1907,"children":1908},{},[1909,1910,1915],{"type":51,"value":832},{"type":46,"tag":106,"props":1911,"children":1913},{"className":1912},[],[1914],{"type":51,"value":823},{"type":51,"value":1916}," flag.",{"type":46,"tag":75,"props":1918,"children":1919},{},[1920,1928],{"type":46,"tag":102,"props":1921,"children":1922},{},[1923],{"type":46,"tag":106,"props":1924,"children":1926},{"className":1925},[],[1927],{"type":51,"value":857},{"type":46,"tag":102,"props":1929,"children":1930},{},[1931,1933,1938,1940,1945],{"type":51,"value":1932},"Replace ",{"type":46,"tag":106,"props":1934,"children":1936},{"className":1935},[],[1937],{"type":51,"value":866},{"type":51,"value":1939}," with ",{"type":46,"tag":106,"props":1941,"children":1943},{"className":1942},[],[1944],{"type":51,"value":888},{"type":51,"value":285},{"type":46,"tag":75,"props":1947,"children":1948},{},[1949,1957],{"type":46,"tag":102,"props":1950,"children":1951},{},[1952],{"type":46,"tag":106,"props":1953,"children":1955},{"className":1954},[],[1956],{"type":51,"value":902},{"type":46,"tag":102,"props":1958,"children":1959},{},[1960,1962,1967,1969,1974],{"type":51,"value":1961},"Chain consecutive ",{"type":46,"tag":106,"props":1963,"children":1965},{"className":1964},[],[1966],{"type":51,"value":623},{"type":51,"value":1968}," lines with ",{"type":46,"tag":106,"props":1970,"children":1972},{"className":1971},[],[1973],{"type":51,"value":936},{"type":51,"value":285},{"type":46,"tag":75,"props":1976,"children":1977},{},[1978,1986],{"type":46,"tag":102,"props":1979,"children":1980},{},[1981],{"type":46,"tag":106,"props":1982,"children":1984},{"className":1983},[],[1985],{"type":51,"value":950},{"type":46,"tag":102,"props":1987,"children":1988},{},[1989,1991,1997,1999,2004],{"type":51,"value":1990},"Move the manifest ",{"type":46,"tag":106,"props":1992,"children":1994},{"className":1993},[],[1995],{"type":51,"value":1996},"COPY",{"type":51,"value":1998}," lines above ",{"type":46,"tag":106,"props":2000,"children":2002},{"className":2001},[],[2003],{"type":51,"value":959},{"type":51,"value":2005}," and add the dependency install step between them.",{"type":46,"tag":75,"props":2007,"children":2008},{},[2009,2017],{"type":46,"tag":102,"props":2010,"children":2011},{},[2012],{"type":46,"tag":106,"props":2013,"children":2015},{"className":2014},[],[2016],{"type":51,"value":1032},{"type":46,"tag":102,"props":2018,"children":2019},{},[2020,2022,2028,2030,2036,2037,2043],{"type":51,"value":2021},"Restructure into two stages: ",{"type":46,"tag":106,"props":2023,"children":2025},{"className":2024},[],[2026],{"type":51,"value":2027},"FROM \u003Cbuild-image> AS build",{"type":51,"value":2029}," … ",{"type":46,"tag":106,"props":2031,"children":2033},{"className":2032},[],[2034],{"type":51,"value":2035},"FROM \u003Cruntime-image>",{"type":51,"value":2029},{"type":46,"tag":106,"props":2038,"children":2040},{"className":2039},[],[2041],{"type":51,"value":2042},"COPY --from=build …",{"type":51,"value":285},{"type":46,"tag":75,"props":2045,"children":2046},{},[2047,2055],{"type":46,"tag":102,"props":2048,"children":2049},{},[2050],{"type":46,"tag":106,"props":2051,"children":2053},{"className":2052},[],[2054],{"type":51,"value":1151},{"type":46,"tag":102,"props":2056,"children":2057},{},[2058,2059,2064,2066,2072],{"type":51,"value":1932},{"type":46,"tag":106,"props":2060,"children":2062},{"className":2061},[],[2063],{"type":51,"value":1193},{"type":51,"value":2065}," (or no tag) with a pinned major version from the curated table in ",{"type":46,"tag":106,"props":2067,"children":2069},{"className":2068},[],[2070],{"type":51,"value":2071},"generate-dockerfile",{"type":51,"value":2073}," skill, matching detected language.",{"type":46,"tag":75,"props":2075,"children":2076},{},[2077,2085],{"type":46,"tag":102,"props":2078,"children":2079},{},[2080],{"type":46,"tag":106,"props":2081,"children":2083},{"className":2082},[],[2084],{"type":51,"value":1206},{"type":46,"tag":102,"props":2086,"children":2087},{},[2088,2090,2096,2098,2104,2106],{"type":51,"value":2089},"Add a HEALTHCHECK matching the base image's available tools: ",{"type":46,"tag":106,"props":2091,"children":2093},{"className":2092},[],[2094],{"type":51,"value":2095},"curl -fsS http:\u002F\u002Flocalhost:\u003Cport>\u002Fhealth || exit 1",{"type":51,"value":2097}," if curl is present; ",{"type":46,"tag":106,"props":2099,"children":2101},{"className":2100},[],[2102],{"type":51,"value":2103},"wget --spider -q http:\u002F\u002Flocalhost:\u003Cport>\u002Fhealth || exit 1",{"type":51,"value":2105}," on Alpine\u002Fbusybox; for distroless add a comment ",{"type":46,"tag":106,"props":2107,"children":2109},{"className":2108},[],[2110],{"type":51,"value":2111},"# HEALTHCHECK: skipped — distroless image has no shell. Use Kubernetes liveness\u002Freadiness probe.",{"type":46,"tag":75,"props":2113,"children":2114},{},[2115,2123],{"type":46,"tag":102,"props":2116,"children":2117},{},[2118],{"type":46,"tag":106,"props":2119,"children":2121},{"className":2120},[],[2122],{"type":51,"value":1245},{"type":46,"tag":102,"props":2124,"children":2125},{},[2126,2127,2133,2135,2140,2142,2148,2149,2155],{"type":51,"value":832},{"type":46,"tag":106,"props":2128,"children":2130},{"className":2129},[],[2131],{"type":51,"value":2132},"WORKDIR \u002Fapp",{"type":51,"value":2134}," after ",{"type":46,"tag":106,"props":2136,"children":2138},{"className":2137},[],[2139],{"type":51,"value":1043},{"type":51,"value":2141},". Replace any ",{"type":46,"tag":106,"props":2143,"children":2145},{"className":2144},[],[2146],{"type":51,"value":2147},"RUN cd \u002F\u003Cdir>",{"type":51,"value":1939},{"type":46,"tag":106,"props":2150,"children":2152},{"className":2151},[],[2153],{"type":51,"value":2154},"WORKDIR \u002F\u003Cdir>",{"type":51,"value":285},{"type":46,"tag":75,"props":2157,"children":2158},{},[2159,2167],{"type":46,"tag":102,"props":2160,"children":2161},{},[2162],{"type":46,"tag":106,"props":2163,"children":2165},{"className":2164},[],[2166],{"type":51,"value":1299},{"type":46,"tag":102,"props":2168,"children":2169},{},[2170,2171,2176],{"type":51,"value":832},{"type":46,"tag":106,"props":2172,"children":2174},{"className":2173},[],[2175],{"type":51,"value":1361},{"type":51,"value":2177}," near the bottom. Infer port from the code reference.",{"type":46,"tag":75,"props":2179,"children":2180},{},[2181,2189],{"type":46,"tag":102,"props":2182,"children":2183},{},[2184],{"type":46,"tag":106,"props":2185,"children":2187},{"className":2186},[],[2188],{"type":51,"value":1375},{"type":46,"tag":102,"props":2190,"children":2191},{},[2192,2193,2199,2201,2207,2209,2215,2217,2223],{"type":51,"value":832},{"type":46,"tag":106,"props":2194,"children":2196},{"className":2195},[],[2197],{"type":51,"value":2198},"LABEL com.azure.containerizationassist.createdby=\"containerization-assist\"",{"type":51,"value":2200},". If you can read the current ",{"type":46,"tag":106,"props":2202,"children":2204},{"className":2203},[],[2205],{"type":51,"value":2206},"containerization-assist",{"type":51,"value":2208}," package version from the environment, also add ",{"type":46,"tag":106,"props":2210,"children":2212},{"className":2211},[],[2213],{"type":51,"value":2214},"LABEL com.azure.containerizationassist.version=\"\u003Cversion>\"",{"type":51,"value":2216},"; otherwise omit the version label — never hard-code a stale version string. Do NOT use ",{"type":46,"tag":106,"props":2218,"children":2220},{"className":2219},[],[2221],{"type":51,"value":2222},"org.opencontainers.image.*",{"type":51,"value":2224}," keys.",{"type":46,"tag":54,"props":2226,"children":2227},{},[2228,2230,2235,2237,2242],{"type":51,"value":2229},"After applying all fixes, run ",{"type":46,"tag":215,"props":2231,"children":2232},{},[2233],{"type":51,"value":2234},"Step 2 again",{"type":51,"value":2236}," as a self-check on the new\ncontent. If any rule still triggers, fix it before writing. Never write a\nDockerfile that still violates a security ",{"type":46,"tag":106,"props":2238,"children":2240},{"className":2239},[],[2241],{"type":51,"value":302},{"type":51,"value":2243}," rule.",{"type":46,"tag":234,"props":2245,"children":2247},{"id":2246},"step-7-apply-the-change",[2248],{"type":51,"value":2249},"Step 7 — Apply the change",{"type":46,"tag":1535,"props":2251,"children":2252},{},[2253,2278,2294,2313],{"type":46,"tag":1539,"props":2254,"children":2255},{},[2256,2257,2262,2264,2269,2271,2276],{"type":51,"value":244},{"type":46,"tag":106,"props":2258,"children":2260},{"className":2259},[],[2261],{"type":51,"value":126},{"type":51,"value":2263}," was provided ",{"type":46,"tag":215,"props":2265,"children":2266},{},[2267],{"type":51,"value":2268},"and",{"type":51,"value":2270}," the file scored below A (any issues found):\n",{"type":46,"tag":215,"props":2272,"children":2273},{},[2274],{"type":51,"value":2275},"write the remediated content to that file immediately",{"type":51,"value":2277},", using whatever\nfile-editing capability the environment exposes. Do NOT ask the user to\ncopy-paste. Do NOT defer this to a “Next steps” list.",{"type":46,"tag":1539,"props":2279,"children":2280},{},[2281,2282,2287,2288,2292],{"type":51,"value":244},{"type":46,"tag":106,"props":2283,"children":2285},{"className":2284},[],[2286],{"type":51,"value":126},{"type":51,"value":2263},{"type":46,"tag":215,"props":2289,"children":2290},{},[2291],{"type":51,"value":2268},{"type":51,"value":2293}," the file already scored A with 0 issues:\ndo nothing — the file is fine as-is.",{"type":46,"tag":1539,"props":2295,"children":2296},{},[2297,2299,2304,2306,2311],{"type":51,"value":2298},"If only inline ",{"type":46,"tag":106,"props":2300,"children":2302},{"className":2301},[],[2303],{"type":51,"value":111},{"type":51,"value":2305}," content was provided (no ",{"type":46,"tag":106,"props":2307,"children":2309},{"className":2308},[],[2310],{"type":51,"value":126},{"type":51,"value":2312},"): you cannot\nwrite to disk — say so and include the fixed content inline.",{"type":46,"tag":1539,"props":2314,"children":2315},{},[2316,2318,2323],{"type":51,"value":2317},"If the user explicitly asks to see the fixed content (“show me the file”,\n“print the Dockerfile”, etc.), include it under an extra ",{"type":46,"tag":215,"props":2319,"children":2320},{},[2321],{"type":51,"value":2322},"Fixed\nDockerfile",{"type":51,"value":2324}," section. Otherwise omit it — the file on disk is the\nartifact, not the chat output.",{"type":46,"tag":60,"props":2326,"children":2328},{"id":2327},"output-format",[2329],{"type":51,"value":2330},"Output format",{"type":46,"tag":54,"props":2332,"children":2333},{},[2334],{"type":51,"value":2335},"Use these exact sections in order:",{"type":46,"tag":2337,"props":2338,"children":2343},"pre",{"className":2339,"code":2340,"language":2341,"meta":2342,"style":2342},"language-md shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","**Dockerfile validation** — `\u003Cpath or \"(inline)\">`\n\n### Score\n- **Grade:** \u003CA|B|C|D|F> (\u003Cscore>\u002F100)\n- **Priority:** \u003Chigh|medium|low>\n- **Strategy:** \u003Crewrite|refactor|tweak>\n\n### Issues (\u003CN>)\n\n#### Security (\u003Ccount>)\n- *\u003Cseverity>* `\u003CruleId>` (line \u003Cline>) — \u003Cmessage>\n- ...\n\n#### Performance (\u003Ccount>)\n- *\u003Cseverity>* `\u003CruleId>` (line \u003Cline>) — \u003Cmessage>\n- ...\n\n#### Best practices (\u003Ccount>)\n- *\u003Cseverity>* `\u003CruleId>` (line \u003Cline>) — \u003Cmessage>\n- ...\n\n> If a category has 0 issues, write `- none`.\n\n### Result\n✅ Wrote remediated Dockerfile to `\u003Cpath>`. \u003CN> issue(s) fixed.\n\n> Replace this with `✅ Dockerfile already meets the baseline. No changes\n> required.` if the input scored A with 0 issues, OR with `⚠️ Inline\n> content — no path provided. Fixed content below.` when only inline\n> content was supplied.\n\n### Diff summary\n- **Added:** \u003Cbullet list of new instructions>\n- **Removed:** \u003Cbullet list of dropped\u002Freplaced instructions>\n- **Modified:** \u003Cbullet list of in-place edits>\n\n> Omit this section entirely if no changes were applied.\n\n### Fixed Dockerfile *(only when no path was given, or when the user asked to see it)*\n\n```dockerfile\n\u003Cfull remediated Dockerfile content>\n```\n\n### Next steps\n1. Rebuild: `docker buildx build --platform=\u003CtargetPlatform> -t \u003Cname>:dev \u003Cbuild-context>`.\n2. Re-run **fix-dockerfile** to confirm score is **A** (90+).\n3. Once clean, proceed to `generate-k8s-manifests`.\n","md","",[2344],{"type":46,"tag":106,"props":2345,"children":2346},{"__ignoreMap":2342},[2347,2392,2402,2417,2480,2515,2549,2557,2588,2596,2627,2700,2713,2721,2750,2814,2825,2833,2862,2926,2938,2946,2979,2987,3000,3044,3052,3065,3096,3109,3122,3130,3143,3198,3254,3305,3313,3326,3334,3362,3370,3384,3393,3402,3410,3423,3454,3502],{"type":46,"tag":2348,"props":2349,"children":2352},"span",{"class":2350,"line":2351},"line",1,[2353,2359,2365,2369,2375,2381,2387],{"type":46,"tag":2348,"props":2354,"children":2356},{"style":2355},"--shiki-light:#39ADB5;--shiki-light-font-weight:bold;--shiki-default:#89DDFF;--shiki-default-font-weight:bold;--shiki-dark:#89DDFF;--shiki-dark-font-weight:bold",[2357],{"type":51,"value":2358},"**",{"type":46,"tag":2348,"props":2360,"children":2362},{"style":2361},"--shiki-light:#E53935;--shiki-light-font-weight:bold;--shiki-default:#F07178;--shiki-default-font-weight:bold;--shiki-dark:#F07178;--shiki-dark-font-weight:bold",[2363],{"type":51,"value":2364},"Dockerfile validation",{"type":46,"tag":2348,"props":2366,"children":2367},{"style":2355},[2368],{"type":51,"value":2358},{"type":46,"tag":2348,"props":2370,"children":2372},{"style":2371},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[2373],{"type":51,"value":2374}," — ",{"type":46,"tag":2348,"props":2376,"children":2378},{"style":2377},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[2379],{"type":51,"value":2380},"`",{"type":46,"tag":2348,"props":2382,"children":2384},{"style":2383},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[2385],{"type":51,"value":2386},"\u003Cpath or \"(inline)\">",{"type":46,"tag":2348,"props":2388,"children":2389},{"style":2377},[2390],{"type":51,"value":2391},"`\n",{"type":46,"tag":2348,"props":2393,"children":2395},{"class":2350,"line":2394},2,[2396],{"type":46,"tag":2348,"props":2397,"children":2399},{"emptyLinePlaceholder":2398},true,[2400],{"type":51,"value":2401},"\n",{"type":46,"tag":2348,"props":2403,"children":2405},{"class":2350,"line":2404},3,[2406,2411],{"type":46,"tag":2348,"props":2407,"children":2408},{"style":2377},[2409],{"type":51,"value":2410},"### ",{"type":46,"tag":2348,"props":2412,"children":2414},{"style":2413},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[2415],{"type":51,"value":2416},"Score\n",{"type":46,"tag":2348,"props":2418,"children":2420},{"class":2350,"line":2419},4,[2421,2426,2431,2436,2440,2445,2451,2456,2461,2466,2471,2475],{"type":46,"tag":2348,"props":2422,"children":2423},{"style":2377},[2424],{"type":51,"value":2425},"-",{"type":46,"tag":2348,"props":2427,"children":2428},{"style":2355},[2429],{"type":51,"value":2430}," **",{"type":46,"tag":2348,"props":2432,"children":2433},{"style":2361},[2434],{"type":51,"value":2435},"Grade:",{"type":46,"tag":2348,"props":2437,"children":2438},{"style":2355},[2439],{"type":51,"value":2358},{"type":46,"tag":2348,"props":2441,"children":2442},{"style":2377},[2443],{"type":51,"value":2444}," \u003C",{"type":46,"tag":2348,"props":2446,"children":2448},{"style":2447},"--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178",[2449],{"type":51,"value":2450},"A|B|C|D|F",{"type":46,"tag":2348,"props":2452,"children":2453},{"style":2377},[2454],{"type":51,"value":2455},">",{"type":46,"tag":2348,"props":2457,"children":2458},{"style":2371},[2459],{"type":51,"value":2460}," (",{"type":46,"tag":2348,"props":2462,"children":2463},{"style":2377},[2464],{"type":51,"value":2465},"\u003C",{"type":46,"tag":2348,"props":2467,"children":2468},{"style":2447},[2469],{"type":51,"value":2470},"score",{"type":46,"tag":2348,"props":2472,"children":2473},{"style":2377},[2474],{"type":51,"value":2455},{"type":46,"tag":2348,"props":2476,"children":2477},{"style":2371},[2478],{"type":51,"value":2479},"\u002F100)\n",{"type":46,"tag":2348,"props":2481,"children":2483},{"class":2350,"line":2482},5,[2484,2488,2492,2497,2501,2505,2510],{"type":46,"tag":2348,"props":2485,"children":2486},{"style":2377},[2487],{"type":51,"value":2425},{"type":46,"tag":2348,"props":2489,"children":2490},{"style":2355},[2491],{"type":51,"value":2430},{"type":46,"tag":2348,"props":2493,"children":2494},{"style":2361},[2495],{"type":51,"value":2496},"Priority:",{"type":46,"tag":2348,"props":2498,"children":2499},{"style":2355},[2500],{"type":51,"value":2358},{"type":46,"tag":2348,"props":2502,"children":2503},{"style":2377},[2504],{"type":51,"value":2444},{"type":46,"tag":2348,"props":2506,"children":2507},{"style":2447},[2508],{"type":51,"value":2509},"high|medium|low",{"type":46,"tag":2348,"props":2511,"children":2512},{"style":2377},[2513],{"type":51,"value":2514},">\n",{"type":46,"tag":2348,"props":2516,"children":2518},{"class":2350,"line":2517},6,[2519,2523,2527,2532,2536,2540,2545],{"type":46,"tag":2348,"props":2520,"children":2521},{"style":2377},[2522],{"type":51,"value":2425},{"type":46,"tag":2348,"props":2524,"children":2525},{"style":2355},[2526],{"type":51,"value":2430},{"type":46,"tag":2348,"props":2528,"children":2529},{"style":2361},[2530],{"type":51,"value":2531},"Strategy:",{"type":46,"tag":2348,"props":2533,"children":2534},{"style":2355},[2535],{"type":51,"value":2358},{"type":46,"tag":2348,"props":2537,"children":2538},{"style":2377},[2539],{"type":51,"value":2444},{"type":46,"tag":2348,"props":2541,"children":2542},{"style":2447},[2543],{"type":51,"value":2544},"rewrite|refactor|tweak",{"type":46,"tag":2348,"props":2546,"children":2547},{"style":2377},[2548],{"type":51,"value":2514},{"type":46,"tag":2348,"props":2550,"children":2552},{"class":2350,"line":2551},7,[2553],{"type":46,"tag":2348,"props":2554,"children":2555},{"emptyLinePlaceholder":2398},[2556],{"type":51,"value":2401},{"type":46,"tag":2348,"props":2558,"children":2560},{"class":2350,"line":2559},8,[2561,2565,2570,2574,2579,2583],{"type":46,"tag":2348,"props":2562,"children":2563},{"style":2377},[2564],{"type":51,"value":2410},{"type":46,"tag":2348,"props":2566,"children":2567},{"style":2413},[2568],{"type":51,"value":2569},"Issues (",{"type":46,"tag":2348,"props":2571,"children":2572},{"style":2377},[2573],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2575,"children":2576},{"style":2447},[2577],{"type":51,"value":2578},"N",{"type":46,"tag":2348,"props":2580,"children":2581},{"style":2377},[2582],{"type":51,"value":2455},{"type":46,"tag":2348,"props":2584,"children":2585},{"style":2413},[2586],{"type":51,"value":2587},")\n",{"type":46,"tag":2348,"props":2589,"children":2591},{"class":2350,"line":2590},9,[2592],{"type":46,"tag":2348,"props":2593,"children":2594},{"emptyLinePlaceholder":2398},[2595],{"type":51,"value":2401},{"type":46,"tag":2348,"props":2597,"children":2599},{"class":2350,"line":2598},10,[2600,2605,2610,2614,2619,2623],{"type":46,"tag":2348,"props":2601,"children":2602},{"style":2377},[2603],{"type":51,"value":2604},"#### ",{"type":46,"tag":2348,"props":2606,"children":2607},{"style":2413},[2608],{"type":51,"value":2609},"Security (",{"type":46,"tag":2348,"props":2611,"children":2612},{"style":2377},[2613],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2615,"children":2616},{"style":2447},[2617],{"type":51,"value":2618},"count",{"type":46,"tag":2348,"props":2620,"children":2621},{"style":2377},[2622],{"type":51,"value":2455},{"type":46,"tag":2348,"props":2624,"children":2625},{"style":2413},[2626],{"type":51,"value":2587},{"type":46,"tag":2348,"props":2628,"children":2630},{"class":2350,"line":2629},11,[2631,2635,2641,2646,2651,2656,2661,2665,2670,2674,2678,2682,2687,2691,2696],{"type":46,"tag":2348,"props":2632,"children":2633},{"style":2377},[2634],{"type":51,"value":2425},{"type":46,"tag":2348,"props":2636,"children":2638},{"style":2637},"--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic",[2639],{"type":51,"value":2640}," *\u003C",{"type":46,"tag":2348,"props":2642,"children":2644},{"style":2643},"--shiki-light:#E53935;--shiki-light-font-style:italic;--shiki-default:#F07178;--shiki-default-font-style:italic;--shiki-dark:#F07178;--shiki-dark-font-style:italic",[2645],{"type":51,"value":294},{"type":46,"tag":2348,"props":2647,"children":2648},{"style":2637},[2649],{"type":51,"value":2650},">*",{"type":46,"tag":2348,"props":2652,"children":2653},{"style":2377},[2654],{"type":51,"value":2655}," `",{"type":46,"tag":2348,"props":2657,"children":2658},{"style":2383},[2659],{"type":51,"value":2660},"\u003CruleId>",{"type":46,"tag":2348,"props":2662,"children":2663},{"style":2377},[2664],{"type":51,"value":2380},{"type":46,"tag":2348,"props":2666,"children":2667},{"style":2371},[2668],{"type":51,"value":2669}," (line ",{"type":46,"tag":2348,"props":2671,"children":2672},{"style":2377},[2673],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2675,"children":2676},{"style":2447},[2677],{"type":51,"value":2350},{"type":46,"tag":2348,"props":2679,"children":2680},{"style":2377},[2681],{"type":51,"value":2455},{"type":46,"tag":2348,"props":2683,"children":2684},{"style":2371},[2685],{"type":51,"value":2686},") — ",{"type":46,"tag":2348,"props":2688,"children":2689},{"style":2377},[2690],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2692,"children":2693},{"style":2447},[2694],{"type":51,"value":2695},"message",{"type":46,"tag":2348,"props":2697,"children":2698},{"style":2377},[2699],{"type":51,"value":2514},{"type":46,"tag":2348,"props":2701,"children":2703},{"class":2350,"line":2702},12,[2704,2708],{"type":46,"tag":2348,"props":2705,"children":2706},{"style":2377},[2707],{"type":51,"value":2425},{"type":46,"tag":2348,"props":2709,"children":2710},{"style":2371},[2711],{"type":51,"value":2712}," ...\n",{"type":46,"tag":2348,"props":2714,"children":2716},{"class":2350,"line":2715},13,[2717],{"type":46,"tag":2348,"props":2718,"children":2719},{"emptyLinePlaceholder":2398},[2720],{"type":51,"value":2401},{"type":46,"tag":2348,"props":2722,"children":2724},{"class":2350,"line":2723},14,[2725,2729,2734,2738,2742,2746],{"type":46,"tag":2348,"props":2726,"children":2727},{"style":2377},[2728],{"type":51,"value":2604},{"type":46,"tag":2348,"props":2730,"children":2731},{"style":2413},[2732],{"type":51,"value":2733},"Performance (",{"type":46,"tag":2348,"props":2735,"children":2736},{"style":2377},[2737],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2739,"children":2740},{"style":2447},[2741],{"type":51,"value":2618},{"type":46,"tag":2348,"props":2743,"children":2744},{"style":2377},[2745],{"type":51,"value":2455},{"type":46,"tag":2348,"props":2747,"children":2748},{"style":2413},[2749],{"type":51,"value":2587},{"type":46,"tag":2348,"props":2751,"children":2753},{"class":2350,"line":2752},15,[2754,2758,2762,2766,2770,2774,2778,2782,2786,2790,2794,2798,2802,2806,2810],{"type":46,"tag":2348,"props":2755,"children":2756},{"style":2377},[2757],{"type":51,"value":2425},{"type":46,"tag":2348,"props":2759,"children":2760},{"style":2637},[2761],{"type":51,"value":2640},{"type":46,"tag":2348,"props":2763,"children":2764},{"style":2643},[2765],{"type":51,"value":294},{"type":46,"tag":2348,"props":2767,"children":2768},{"style":2637},[2769],{"type":51,"value":2650},{"type":46,"tag":2348,"props":2771,"children":2772},{"style":2377},[2773],{"type":51,"value":2655},{"type":46,"tag":2348,"props":2775,"children":2776},{"style":2383},[2777],{"type":51,"value":2660},{"type":46,"tag":2348,"props":2779,"children":2780},{"style":2377},[2781],{"type":51,"value":2380},{"type":46,"tag":2348,"props":2783,"children":2784},{"style":2371},[2785],{"type":51,"value":2669},{"type":46,"tag":2348,"props":2787,"children":2788},{"style":2377},[2789],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2791,"children":2792},{"style":2447},[2793],{"type":51,"value":2350},{"type":46,"tag":2348,"props":2795,"children":2796},{"style":2377},[2797],{"type":51,"value":2455},{"type":46,"tag":2348,"props":2799,"children":2800},{"style":2371},[2801],{"type":51,"value":2686},{"type":46,"tag":2348,"props":2803,"children":2804},{"style":2377},[2805],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2807,"children":2808},{"style":2447},[2809],{"type":51,"value":2695},{"type":46,"tag":2348,"props":2811,"children":2812},{"style":2377},[2813],{"type":51,"value":2514},{"type":46,"tag":2348,"props":2815,"children":2816},{"class":2350,"line":33},[2817,2821],{"type":46,"tag":2348,"props":2818,"children":2819},{"style":2377},[2820],{"type":51,"value":2425},{"type":46,"tag":2348,"props":2822,"children":2823},{"style":2371},[2824],{"type":51,"value":2712},{"type":46,"tag":2348,"props":2826,"children":2828},{"class":2350,"line":2827},17,[2829],{"type":46,"tag":2348,"props":2830,"children":2831},{"emptyLinePlaceholder":2398},[2832],{"type":51,"value":2401},{"type":46,"tag":2348,"props":2834,"children":2836},{"class":2350,"line":2835},18,[2837,2841,2846,2850,2854,2858],{"type":46,"tag":2348,"props":2838,"children":2839},{"style":2377},[2840],{"type":51,"value":2604},{"type":46,"tag":2348,"props":2842,"children":2843},{"style":2413},[2844],{"type":51,"value":2845},"Best practices (",{"type":46,"tag":2348,"props":2847,"children":2848},{"style":2377},[2849],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2851,"children":2852},{"style":2447},[2853],{"type":51,"value":2618},{"type":46,"tag":2348,"props":2855,"children":2856},{"style":2377},[2857],{"type":51,"value":2455},{"type":46,"tag":2348,"props":2859,"children":2860},{"style":2413},[2861],{"type":51,"value":2587},{"type":46,"tag":2348,"props":2863,"children":2865},{"class":2350,"line":2864},19,[2866,2870,2874,2878,2882,2886,2890,2894,2898,2902,2906,2910,2914,2918,2922],{"type":46,"tag":2348,"props":2867,"children":2868},{"style":2377},[2869],{"type":51,"value":2425},{"type":46,"tag":2348,"props":2871,"children":2872},{"style":2637},[2873],{"type":51,"value":2640},{"type":46,"tag":2348,"props":2875,"children":2876},{"style":2643},[2877],{"type":51,"value":294},{"type":46,"tag":2348,"props":2879,"children":2880},{"style":2637},[2881],{"type":51,"value":2650},{"type":46,"tag":2348,"props":2883,"children":2884},{"style":2377},[2885],{"type":51,"value":2655},{"type":46,"tag":2348,"props":2887,"children":2888},{"style":2383},[2889],{"type":51,"value":2660},{"type":46,"tag":2348,"props":2891,"children":2892},{"style":2377},[2893],{"type":51,"value":2380},{"type":46,"tag":2348,"props":2895,"children":2896},{"style":2371},[2897],{"type":51,"value":2669},{"type":46,"tag":2348,"props":2899,"children":2900},{"style":2377},[2901],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2903,"children":2904},{"style":2447},[2905],{"type":51,"value":2350},{"type":46,"tag":2348,"props":2907,"children":2908},{"style":2377},[2909],{"type":51,"value":2455},{"type":46,"tag":2348,"props":2911,"children":2912},{"style":2371},[2913],{"type":51,"value":2686},{"type":46,"tag":2348,"props":2915,"children":2916},{"style":2377},[2917],{"type":51,"value":2465},{"type":46,"tag":2348,"props":2919,"children":2920},{"style":2447},[2921],{"type":51,"value":2695},{"type":46,"tag":2348,"props":2923,"children":2924},{"style":2377},[2925],{"type":51,"value":2514},{"type":46,"tag":2348,"props":2927,"children":2929},{"class":2350,"line":2928},20,[2930,2934],{"type":46,"tag":2348,"props":2931,"children":2932},{"style":2377},[2933],{"type":51,"value":2425},{"type":46,"tag":2348,"props":2935,"children":2936},{"style":2371},[2937],{"type":51,"value":2712},{"type":46,"tag":2348,"props":2939,"children":2941},{"class":2350,"line":2940},21,[2942],{"type":46,"tag":2348,"props":2943,"children":2944},{"emptyLinePlaceholder":2398},[2945],{"type":51,"value":2401},{"type":46,"tag":2348,"props":2947,"children":2949},{"class":2350,"line":2948},22,[2950,2955,2960,2964,2970,2974],{"type":46,"tag":2348,"props":2951,"children":2953},{"style":2952},"--shiki-light:#FF5370;--shiki-light-font-style:italic;--shiki-default:#FF9CAC;--shiki-default-font-style:italic;--shiki-dark:#FF9CAC;--shiki-dark-font-style:italic",[2954],{"type":51,"value":2455},{"type":46,"tag":2348,"props":2956,"children":2957},{"style":2637},[2958],{"type":51,"value":2959}," If a category has 0 issues, write ",{"type":46,"tag":2348,"props":2961,"children":2962},{"style":2637},[2963],{"type":51,"value":2380},{"type":46,"tag":2348,"props":2965,"children":2967},{"style":2966},"--shiki-light:#91B859;--shiki-light-font-style:italic;--shiki-default:#C3E88D;--shiki-default-font-style:italic;--shiki-dark:#C3E88D;--shiki-dark-font-style:italic",[2968],{"type":51,"value":2969},"- none",{"type":46,"tag":2348,"props":2971,"children":2972},{"style":2637},[2973],{"type":51,"value":2380},{"type":46,"tag":2348,"props":2975,"children":2976},{"style":2637},[2977],{"type":51,"value":2978},".\n",{"type":46,"tag":2348,"props":2980,"children":2982},{"class":2350,"line":2981},23,[2983],{"type":46,"tag":2348,"props":2984,"children":2985},{"emptyLinePlaceholder":2398},[2986],{"type":51,"value":2401},{"type":46,"tag":2348,"props":2988,"children":2990},{"class":2350,"line":2989},24,[2991,2995],{"type":46,"tag":2348,"props":2992,"children":2993},{"style":2377},[2994],{"type":51,"value":2410},{"type":46,"tag":2348,"props":2996,"children":2997},{"style":2413},[2998],{"type":51,"value":2999},"Result\n",{"type":46,"tag":2348,"props":3001,"children":3003},{"class":2350,"line":3002},25,[3004,3009,3013,3018,3022,3027,3031,3035,3039],{"type":46,"tag":2348,"props":3005,"children":3006},{"style":2371},[3007],{"type":51,"value":3008},"✅ Wrote remediated Dockerfile to ",{"type":46,"tag":2348,"props":3010,"children":3011},{"style":2377},[3012],{"type":51,"value":2380},{"type":46,"tag":2348,"props":3014,"children":3015},{"style":2383},[3016],{"type":51,"value":3017},"\u003Cpath>",{"type":46,"tag":2348,"props":3019,"children":3020},{"style":2377},[3021],{"type":51,"value":2380},{"type":46,"tag":2348,"props":3023,"children":3024},{"style":2371},[3025],{"type":51,"value":3026},". ",{"type":46,"tag":2348,"props":3028,"children":3029},{"style":2377},[3030],{"type":51,"value":2465},{"type":46,"tag":2348,"props":3032,"children":3033},{"style":2447},[3034],{"type":51,"value":2578},{"type":46,"tag":2348,"props":3036,"children":3037},{"style":2377},[3038],{"type":51,"value":2455},{"type":46,"tag":2348,"props":3040,"children":3041},{"style":2371},[3042],{"type":51,"value":3043}," issue(s) fixed.\n",{"type":46,"tag":2348,"props":3045,"children":3047},{"class":2350,"line":3046},26,[3048],{"type":46,"tag":2348,"props":3049,"children":3050},{"emptyLinePlaceholder":2398},[3051],{"type":51,"value":2401},{"type":46,"tag":2348,"props":3053,"children":3055},{"class":2350,"line":3054},27,[3056,3060],{"type":46,"tag":2348,"props":3057,"children":3058},{"style":2952},[3059],{"type":51,"value":2455},{"type":46,"tag":2348,"props":3061,"children":3062},{"style":2637},[3063],{"type":51,"value":3064}," Replace this with `✅ Dockerfile already meets the baseline. No changes\n",{"type":46,"tag":2348,"props":3066,"children":3068},{"class":2350,"line":3067},28,[3069,3073,3078,3082,3087,3091],{"type":46,"tag":2348,"props":3070,"children":3071},{"style":2952},[3072],{"type":51,"value":2455},{"type":46,"tag":2348,"props":3074,"children":3075},{"style":2637},[3076],{"type":51,"value":3077}," required.",{"type":46,"tag":2348,"props":3079,"children":3080},{"style":2637},[3081],{"type":51,"value":2380},{"type":46,"tag":2348,"props":3083,"children":3084},{"style":2966},[3085],{"type":51,"value":3086}," if the input scored A with 0 issues, OR with ",{"type":46,"tag":2348,"props":3088,"children":3089},{"style":2637},[3090],{"type":51,"value":2380},{"type":46,"tag":2348,"props":3092,"children":3093},{"style":2637},[3094],{"type":51,"value":3095},"⚠️ Inline\n",{"type":46,"tag":2348,"props":3097,"children":3099},{"class":2350,"line":3098},29,[3100,3104],{"type":46,"tag":2348,"props":3101,"children":3102},{"style":2952},[3103],{"type":51,"value":2455},{"type":46,"tag":2348,"props":3105,"children":3106},{"style":2637},[3107],{"type":51,"value":3108}," content — no path provided. Fixed content below.` when only inline\n",{"type":46,"tag":2348,"props":3110,"children":3112},{"class":2350,"line":3111},30,[3113,3117],{"type":46,"tag":2348,"props":3114,"children":3115},{"style":2952},[3116],{"type":51,"value":2455},{"type":46,"tag":2348,"props":3118,"children":3119},{"style":2637},[3120],{"type":51,"value":3121}," content was supplied.\n",{"type":46,"tag":2348,"props":3123,"children":3125},{"class":2350,"line":3124},31,[3126],{"type":46,"tag":2348,"props":3127,"children":3128},{"emptyLinePlaceholder":2398},[3129],{"type":51,"value":2401},{"type":46,"tag":2348,"props":3131,"children":3133},{"class":2350,"line":3132},32,[3134,3138],{"type":46,"tag":2348,"props":3135,"children":3136},{"style":2377},[3137],{"type":51,"value":2410},{"type":46,"tag":2348,"props":3139,"children":3140},{"style":2413},[3141],{"type":51,"value":3142},"Diff summary\n",{"type":46,"tag":2348,"props":3144,"children":3146},{"class":2350,"line":3145},33,[3147,3151,3155,3160,3164,3168,3173,3179,3184,3189,3194],{"type":46,"tag":2348,"props":3148,"children":3149},{"style":2377},[3150],{"type":51,"value":2425},{"type":46,"tag":2348,"props":3152,"children":3153},{"style":2355},[3154],{"type":51,"value":2430},{"type":46,"tag":2348,"props":3156,"children":3157},{"style":2361},[3158],{"type":51,"value":3159},"Added:",{"type":46,"tag":2348,"props":3161,"children":3162},{"style":2355},[3163],{"type":51,"value":2358},{"type":46,"tag":2348,"props":3165,"children":3166},{"style":2377},[3167],{"type":51,"value":2444},{"type":46,"tag":2348,"props":3169,"children":3170},{"style":2447},[3171],{"type":51,"value":3172},"bullet",{"type":46,"tag":2348,"props":3174,"children":3176},{"style":3175},"--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA",[3177],{"type":51,"value":3178}," list",{"type":46,"tag":2348,"props":3180,"children":3181},{"style":3175},[3182],{"type":51,"value":3183}," of",{"type":46,"tag":2348,"props":3185,"children":3186},{"style":3175},[3187],{"type":51,"value":3188}," new",{"type":46,"tag":2348,"props":3190,"children":3191},{"style":3175},[3192],{"type":51,"value":3193}," instructions",{"type":46,"tag":2348,"props":3195,"children":3196},{"style":2377},[3197],{"type":51,"value":2514},{"type":46,"tag":2348,"props":3199,"children":3201},{"class":2350,"line":3200},34,[3202,3206,3210,3215,3219,3223,3227,3231,3235,3240,3245,3250],{"type":46,"tag":2348,"props":3203,"children":3204},{"style":2377},[3205],{"type":51,"value":2425},{"type":46,"tag":2348,"props":3207,"children":3208},{"style":2355},[3209],{"type":51,"value":2430},{"type":46,"tag":2348,"props":3211,"children":3212},{"style":2361},[3213],{"type":51,"value":3214},"Removed:",{"type":46,"tag":2348,"props":3216,"children":3217},{"style":2355},[3218],{"type":51,"value":2358},{"type":46,"tag":2348,"props":3220,"children":3221},{"style":2377},[3222],{"type":51,"value":2444},{"type":46,"tag":2348,"props":3224,"children":3225},{"style":2447},[3226],{"type":51,"value":3172},{"type":46,"tag":2348,"props":3228,"children":3229},{"style":3175},[3230],{"type":51,"value":3178},{"type":46,"tag":2348,"props":3232,"children":3233},{"style":3175},[3234],{"type":51,"value":3183},{"type":46,"tag":2348,"props":3236,"children":3237},{"style":3175},[3238],{"type":51,"value":3239}," dropped",{"type":46,"tag":2348,"props":3241,"children":3242},{"style":2377},[3243],{"type":51,"value":3244},"\u002Freplaced ",{"type":46,"tag":2348,"props":3246,"children":3247},{"style":3175},[3248],{"type":51,"value":3249},"instructions",{"type":46,"tag":2348,"props":3251,"children":3252},{"style":2377},[3253],{"type":51,"value":2514},{"type":46,"tag":2348,"props":3255,"children":3257},{"class":2350,"line":3256},35,[3258,3262,3266,3271,3275,3279,3283,3287,3291,3296,3301],{"type":46,"tag":2348,"props":3259,"children":3260},{"style":2377},[3261],{"type":51,"value":2425},{"type":46,"tag":2348,"props":3263,"children":3264},{"style":2355},[3265],{"type":51,"value":2430},{"type":46,"tag":2348,"props":3267,"children":3268},{"style":2361},[3269],{"type":51,"value":3270},"Modified:",{"type":46,"tag":2348,"props":3272,"children":3273},{"style":2355},[3274],{"type":51,"value":2358},{"type":46,"tag":2348,"props":3276,"children":3277},{"style":2377},[3278],{"type":51,"value":2444},{"type":46,"tag":2348,"props":3280,"children":3281},{"style":2447},[3282],{"type":51,"value":3172},{"type":46,"tag":2348,"props":3284,"children":3285},{"style":3175},[3286],{"type":51,"value":3178},{"type":46,"tag":2348,"props":3288,"children":3289},{"style":3175},[3290],{"type":51,"value":3183},{"type":46,"tag":2348,"props":3292,"children":3293},{"style":3175},[3294],{"type":51,"value":3295}," in-place",{"type":46,"tag":2348,"props":3297,"children":3298},{"style":3175},[3299],{"type":51,"value":3300}," edits",{"type":46,"tag":2348,"props":3302,"children":3303},{"style":2377},[3304],{"type":51,"value":2514},{"type":46,"tag":2348,"props":3306,"children":3308},{"class":2350,"line":3307},36,[3309],{"type":46,"tag":2348,"props":3310,"children":3311},{"emptyLinePlaceholder":2398},[3312],{"type":51,"value":2401},{"type":46,"tag":2348,"props":3314,"children":3316},{"class":2350,"line":3315},37,[3317,3321],{"type":46,"tag":2348,"props":3318,"children":3319},{"style":2952},[3320],{"type":51,"value":2455},{"type":46,"tag":2348,"props":3322,"children":3323},{"style":2637},[3324],{"type":51,"value":3325}," Omit this section entirely if no changes were applied.\n",{"type":46,"tag":2348,"props":3327,"children":3329},{"class":2350,"line":3328},38,[3330],{"type":46,"tag":2348,"props":3331,"children":3332},{"emptyLinePlaceholder":2398},[3333],{"type":51,"value":2401},{"type":46,"tag":2348,"props":3335,"children":3337},{"class":2350,"line":3336},39,[3338,3342,3347,3352,3357],{"type":46,"tag":2348,"props":3339,"children":3340},{"style":2377},[3341],{"type":51,"value":2410},{"type":46,"tag":2348,"props":3343,"children":3344},{"style":2413},[3345],{"type":51,"value":3346},"Fixed Dockerfile ",{"type":46,"tag":2348,"props":3348,"children":3349},{"style":2637},[3350],{"type":51,"value":3351},"*",{"type":46,"tag":2348,"props":3353,"children":3354},{"style":2643},[3355],{"type":51,"value":3356},"(only when no path was given, or when the user asked to see it)",{"type":46,"tag":2348,"props":3358,"children":3359},{"style":2637},[3360],{"type":51,"value":3361},"*\n",{"type":46,"tag":2348,"props":3363,"children":3365},{"class":2350,"line":3364},40,[3366],{"type":46,"tag":2348,"props":3367,"children":3368},{"emptyLinePlaceholder":2398},[3369],{"type":51,"value":2401},{"type":46,"tag":2348,"props":3371,"children":3372},{"class":2350,"line":29},[3373,3378],{"type":46,"tag":2348,"props":3374,"children":3375},{"style":2383},[3376],{"type":51,"value":3377},"```",{"type":46,"tag":2348,"props":3379,"children":3381},{"style":3380},"--shiki-light:#90A4AE90;--shiki-default:#EEFFFF90;--shiki-dark:#BABED890",[3382],{"type":51,"value":3383},"dockerfile\n",{"type":46,"tag":2348,"props":3385,"children":3387},{"class":2350,"line":3386},42,[3388],{"type":46,"tag":2348,"props":3389,"children":3390},{"style":3380},[3391],{"type":51,"value":3392},"\u003Cfull remediated Dockerfile content>\n",{"type":46,"tag":2348,"props":3394,"children":3396},{"class":2350,"line":3395},43,[3397],{"type":46,"tag":2348,"props":3398,"children":3399},{"style":2383},[3400],{"type":51,"value":3401},"```\n",{"type":46,"tag":2348,"props":3403,"children":3405},{"class":2350,"line":3404},44,[3406],{"type":46,"tag":2348,"props":3407,"children":3408},{"emptyLinePlaceholder":2398},[3409],{"type":51,"value":2401},{"type":46,"tag":2348,"props":3411,"children":3413},{"class":2350,"line":3412},45,[3414,3418],{"type":46,"tag":2348,"props":3415,"children":3416},{"style":2377},[3417],{"type":51,"value":2410},{"type":46,"tag":2348,"props":3419,"children":3420},{"style":2413},[3421],{"type":51,"value":3422},"Next steps\n",{"type":46,"tag":2348,"props":3424,"children":3426},{"class":2350,"line":3425},46,[3427,3432,3437,3441,3446,3450],{"type":46,"tag":2348,"props":3428,"children":3429},{"style":2377},[3430],{"type":51,"value":3431},"1.",{"type":46,"tag":2348,"props":3433,"children":3434},{"style":2371},[3435],{"type":51,"value":3436}," Rebuild: ",{"type":46,"tag":2348,"props":3438,"children":3439},{"style":2377},[3440],{"type":51,"value":2380},{"type":46,"tag":2348,"props":3442,"children":3443},{"style":2383},[3444],{"type":51,"value":3445},"docker buildx build --platform=\u003CtargetPlatform> -t \u003Cname>:dev \u003Cbuild-context>",{"type":46,"tag":2348,"props":3447,"children":3448},{"style":2377},[3449],{"type":51,"value":2380},{"type":46,"tag":2348,"props":3451,"children":3452},{"style":2371},[3453],{"type":51,"value":2978},{"type":46,"tag":2348,"props":3455,"children":3457},{"class":2350,"line":3456},47,[3458,3463,3468,3472,3476,3480,3485,3489,3493,3497],{"type":46,"tag":2348,"props":3459,"children":3460},{"style":2377},[3461],{"type":51,"value":3462},"2.",{"type":46,"tag":2348,"props":3464,"children":3465},{"style":2371},[3466],{"type":51,"value":3467}," Re-run ",{"type":46,"tag":2348,"props":3469,"children":3470},{"style":2355},[3471],{"type":51,"value":2358},{"type":46,"tag":2348,"props":3473,"children":3474},{"style":2361},[3475],{"type":51,"value":4},{"type":46,"tag":2348,"props":3477,"children":3478},{"style":2355},[3479],{"type":51,"value":2358},{"type":46,"tag":2348,"props":3481,"children":3482},{"style":2371},[3483],{"type":51,"value":3484}," to confirm score is ",{"type":46,"tag":2348,"props":3486,"children":3487},{"style":2355},[3488],{"type":51,"value":2358},{"type":46,"tag":2348,"props":3490,"children":3491},{"style":2361},[3492],{"type":51,"value":1475},{"type":46,"tag":2348,"props":3494,"children":3495},{"style":2355},[3496],{"type":51,"value":2358},{"type":46,"tag":2348,"props":3498,"children":3499},{"style":2371},[3500],{"type":51,"value":3501}," (90+).\n",{"type":46,"tag":2348,"props":3503,"children":3505},{"class":2350,"line":3504},48,[3506,3511,3516,3520,3525,3529],{"type":46,"tag":2348,"props":3507,"children":3508},{"style":2377},[3509],{"type":51,"value":3510},"3.",{"type":46,"tag":2348,"props":3512,"children":3513},{"style":2371},[3514],{"type":51,"value":3515}," Once clean, proceed to ",{"type":46,"tag":2348,"props":3517,"children":3518},{"style":2377},[3519],{"type":51,"value":2380},{"type":46,"tag":2348,"props":3521,"children":3522},{"style":2383},[3523],{"type":51,"value":3524},"generate-k8s-manifests",{"type":46,"tag":2348,"props":3526,"children":3527},{"style":2377},[3528],{"type":51,"value":2380},{"type":46,"tag":2348,"props":3530,"children":3531},{"style":2371},[3532],{"type":51,"value":2978},{"type":46,"tag":54,"props":3534,"children":3535},{},[3536,3538,3543,3545,3549,3551,3556,3558,3563],{"type":51,"value":3537},"If the input scores ",{"type":46,"tag":215,"props":3539,"children":3540},{},[3541],{"type":51,"value":3542},"A with 0 issues",{"type":51,"value":3544},", the output collapses to: the\n",{"type":46,"tag":215,"props":3546,"children":3547},{},[3548],{"type":51,"value":1454},{"type":51,"value":3550}," section, the ",{"type":46,"tag":215,"props":3552,"children":3553},{},[3554],{"type":51,"value":3555},"Issues",{"type":51,"value":3557}," section (all “none”), and the ",{"type":46,"tag":215,"props":3559,"children":3560},{},[3561],{"type":51,"value":3562},"Result",{"type":51,"value":3564},"\nblock — nothing else.",{"type":46,"tag":60,"props":3566,"children":3568},{"id":3567},"constraints",[3569],{"type":51,"value":3570},"Constraints",{"type":46,"tag":1535,"props":3572,"children":3573},{},[3574,3593,3605,3617,3622,3634,3654,3689],{"type":46,"tag":1539,"props":3575,"children":3576},{},[3577,3579,3584,3586,3591],{"type":51,"value":3578},"The artifact is the ",{"type":46,"tag":215,"props":3580,"children":3581},{},[3582],{"type":51,"value":3583},"file on disk",{"type":51,"value":3585},", not the chat output. Always write\nthe remediated content to ",{"type":46,"tag":106,"props":3587,"children":3589},{"className":3588},[],[3590],{"type":51,"value":126},{"type":51,"value":3592}," immediately after Step 6 when changes\nare needed.",{"type":46,"tag":1539,"props":3594,"children":3595},{},[3596,3598,3603],{"type":51,"value":3597},"NEVER write a Dockerfile that still has any ",{"type":46,"tag":106,"props":3599,"children":3601},{"className":3600},[],[3602],{"type":51,"value":302},{"type":51,"value":3604},"-severity issue.",{"type":46,"tag":1539,"props":3606,"children":3607},{},[3608,3610,3615],{"type":51,"value":3609},"NEVER print the full Dockerfile in chat unless (a) no ",{"type":46,"tag":106,"props":3611,"children":3613},{"className":3612},[],[3614],{"type":51,"value":126},{"type":51,"value":3616}," was given,\nor (b) the user explicitly asks to see it.",{"type":46,"tag":1539,"props":3618,"children":3619},{},[3620],{"type":51,"value":3621},"NEVER keep a value next to any secret-pattern env var name. Even if the\nuser wrote it themselves, surface the violation and remove it.",{"type":46,"tag":1539,"props":3623,"children":3624},{},[3625,3627,3632],{"type":51,"value":3626},"NEVER replace ",{"type":46,"tag":106,"props":3628,"children":3630},{"className":3629},[],[3631],{"type":51,"value":1193},{"type":51,"value":3633}," with another floating tag; always a specific major\nversion.",{"type":46,"tag":1539,"props":3635,"children":3636},{},[3637,3639,3644,3646,3652],{"type":51,"value":3638},"NEVER add a ",{"type":46,"tag":106,"props":3640,"children":3642},{"className":3641},[],[3643],{"type":51,"value":1231},{"type":51,"value":3645}," that uses tools not present in the base image\n(e.g. ",{"type":46,"tag":106,"props":3647,"children":3649},{"className":3648},[],[3650],{"type":51,"value":3651},"curl",{"type":51,"value":3653}," on distroless). Use the distroless fallback comment.",{"type":46,"tag":1539,"props":3655,"children":3656},{},[3657,3659,3664,3666,3672,3674,3680,3682,3687],{"type":51,"value":3658},"Preserve the user's choice of base image ",{"type":46,"tag":215,"props":3660,"children":3661},{},[3662],{"type":51,"value":3663},"family",{"type":51,"value":3665}," (don't switch\n",{"type":46,"tag":106,"props":3667,"children":3669},{"className":3668},[],[3670],{"type":51,"value":3671},"node:20-alpine",{"type":51,"value":3673}," → ",{"type":46,"tag":106,"props":3675,"children":3677},{"className":3676},[],[3678],{"type":51,"value":3679},"mcr.microsoft.com\u002F...",{"type":51,"value":3681}," unless ",{"type":46,"tag":106,"props":3683,"children":3685},{"className":3684},[],[3686],{"type":51,"value":1193},{"type":51,"value":3688}," forced a\nretag).",{"type":46,"tag":1539,"props":3690,"children":3691},{},[3692,3694,3699],{"type":51,"value":3693},"Line numbers in the issue list must reference the ",{"type":46,"tag":215,"props":3695,"children":3696},{},[3697],{"type":51,"value":3698},"original",{"type":51,"value":3700}," file.",{"type":46,"tag":60,"props":3702,"children":3704},{"id":3703},"failure-modes",[3705],{"type":51,"value":3706},"Failure modes",{"type":46,"tag":67,"props":3708,"children":3709},{},[3710,3726],{"type":46,"tag":71,"props":3711,"children":3712},{},[3713],{"type":46,"tag":75,"props":3714,"children":3715},{},[3716,3721],{"type":46,"tag":79,"props":3717,"children":3718},{},[3719],{"type":51,"value":3720},"Symptom",{"type":46,"tag":79,"props":3722,"children":3723},{},[3724],{"type":51,"value":3725},"Action",{"type":46,"tag":95,"props":3727,"children":3728},{},[3729,3756,3788,3821,3855],{"type":46,"tag":75,"props":3730,"children":3731},{},[3732,3751],{"type":46,"tag":102,"props":3733,"children":3734},{},[3735,3737,3742,3744,3749],{"type":51,"value":3736},"Neither ",{"type":46,"tag":106,"props":3738,"children":3740},{"className":3739},[],[3741],{"type":51,"value":111},{"type":51,"value":3743}," nor ",{"type":46,"tag":106,"props":3745,"children":3747},{"className":3746},[],[3748],{"type":51,"value":126},{"type":51,"value":3750}," provided",{"type":46,"tag":102,"props":3752,"children":3753},{},[3754],{"type":51,"value":3755},"Ask for one. STOP.",{"type":46,"tag":75,"props":3757,"children":3758},{},[3759,3769],{"type":46,"tag":102,"props":3760,"children":3761},{},[3762,3767],{"type":46,"tag":106,"props":3763,"children":3765},{"className":3764},[],[3766],{"type":51,"value":126},{"type":51,"value":3768}," doesn't exist or isn't readable",{"type":46,"tag":102,"props":3770,"children":3771},{},[3772,3774,3779,3781,3786],{"type":51,"value":3773},"Echo path, ask user to verify. STOP. ",{"type":46,"tag":215,"props":3775,"children":3776},{},[3777],{"type":51,"value":3778},"Do NOT generate a new Dockerfile",{"type":51,"value":3780}," — if the user wants one created, point them at the ",{"type":46,"tag":106,"props":3782,"children":3784},{"className":3783},[],[3785],{"type":51,"value":2071},{"type":51,"value":3787}," skill.",{"type":46,"tag":75,"props":3789,"children":3790},{},[3791,3802],{"type":46,"tag":102,"props":3792,"children":3793},{},[3794,3796,3801],{"type":51,"value":3795},"File has no ",{"type":46,"tag":106,"props":3797,"children":3799},{"className":3798},[],[3800],{"type":51,"value":257},{"type":51,"value":1096},{"type":46,"tag":102,"props":3803,"children":3804},{},[3805,3807,3812,3814,3819],{"type":51,"value":3806},"Reject: \"This doesn't look like a Dockerfile.\" STOP. ",{"type":46,"tag":215,"props":3808,"children":3809},{},[3810],{"type":51,"value":3811},"Do NOT generate one from scratch",{"type":51,"value":3813}," — use ",{"type":46,"tag":106,"props":3815,"children":3817},{"className":3816},[],[3818],{"type":51,"value":2071},{"type":51,"value":3820}," for that.",{"type":46,"tag":75,"props":3822,"children":3823},{},[3824,3829],{"type":46,"tag":102,"props":3825,"children":3826},{},[3827],{"type":51,"value":3828},"Parse failure (unbalanced quotes, etc.)",{"type":46,"tag":102,"props":3830,"children":3831},{},[3832,3834,3840,3842,3847,3849,3854],{"type":51,"value":3833},"Surface a single ",{"type":46,"tag":106,"props":3835,"children":3837},{"className":3836},[],[3838],{"type":51,"value":3839},"parse-error",{"type":51,"value":3841}," issue (severity ",{"type":46,"tag":106,"props":3843,"children":3845},{"className":3844},[],[3846],{"type":51,"value":302},{"type":51,"value":3848},"), skip remaining rules, set Grade = F, Strategy = ",{"type":46,"tag":106,"props":3850,"children":3852},{"className":3851},[],[3853],{"type":51,"value":1630},{"type":51,"value":285},{"type":46,"tag":75,"props":3856,"children":3857},{},[3858,3868],{"type":46,"tag":102,"props":3859,"children":3860},{},[3861,3863],{"type":51,"value":3862},"User insists on keeping a secret in ",{"type":46,"tag":106,"props":3864,"children":3866},{"className":3865},[],[3867],{"type":51,"value":530},{"type":46,"tag":102,"props":3869,"children":3870},{},[3871],{"type":51,"value":3872},"Refuse. Explain that K8s Secrets are the only acceptable path.",{"type":46,"tag":3874,"props":3875,"children":3876},"style",{},[3877],{"type":51,"value":3878},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3880,"total":4055},[3881,3900,3917,3936,3951,3966,3979,3994,4005,4017,4030,4043],{"slug":3882,"name":3882,"fn":3883,"description":3884,"org":3885,"tags":3886,"stars":3897,"repoUrl":3898,"updatedAt":3899},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3887,3888,3891,3894],{"name":11,"slug":8,"type":16},{"name":3889,"slug":3890,"type":16},"Compliance","compliance",{"name":3892,"slug":3893,"type":16},"Governance","governance",{"name":3895,"slug":3896,"type":16},"Policy","policy",1686,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":3901,"name":3901,"fn":3902,"description":3903,"org":3904,"tags":3905,"stars":3914,"repoUrl":3915,"updatedAt":3916},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3906,3907,3908,3911],{"name":11,"slug":8,"type":16},{"name":21,"slug":22,"type":16},{"name":3909,"slug":3910,"type":16},"Infrastructure as Code","infrastructure-as-code",{"name":3912,"slug":3913,"type":16},"Migration","migration",260,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-07-12T08:17:49.646405",{"slug":3918,"name":3918,"fn":3919,"description":3920,"org":3921,"tags":3922,"stars":3933,"repoUrl":3934,"updatedAt":3935},"apiview-feedback-resolution","resolve APIView feedback on Azure SDKs","Analyze and resolve APIView review feedback on Azure SDK PRs. **UTILITY SKILL**. USE FOR: APIView comments, API review feedback, SDK API surface changes. DO NOT USE FOR: general code review, non-APIView feedback. INVOKES: azure-sdk-mcp:azsdk_apiview_get_comments, azure-sdk-mcp:azsdk_typespec_customized_code_update.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3923,3926,3927,3930],{"name":3924,"slug":3925,"type":16},"API Development","api-development",{"name":11,"slug":8,"type":16},{"name":3928,"slug":3929,"type":16},"Code Review","code-review",{"name":3931,"slug":3932,"type":16},"Documentation","documentation",133,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-sdk-tools","2026-07-12T08:17:43.350876",{"slug":3937,"name":3937,"fn":3938,"description":3939,"org":3940,"tags":3941,"stars":3933,"repoUrl":3934,"updatedAt":3950},"azsdk-common-live-and-recorded-tests","deploy resources and run Azure SDK tests","Deploy test resources and run Azure SDK tests in live, record, or playback mode. WHEN: \"run live tests\", \"run recorded tests\", \"deploy test resources\", \"record tests\", \"run tests in record mode\", \"clean up test resources\", \"run tests against live resources\". DO NOT USE FOR: writing new tests, authoring Bicep templates, playback-only test runs without resource deployment. INVOKES: azure-sdk-mcp:azsdk_package_run_tests.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3942,3943,3944,3947],{"name":11,"slug":8,"type":16},{"name":21,"slug":22,"type":16},{"name":3945,"slug":3946,"type":16},"SDK","sdk",{"name":3948,"slug":3949,"type":16},"Testing","testing","2026-07-12T08:17:44.718943",{"slug":3952,"name":3952,"fn":3953,"description":3954,"org":3955,"tags":3956,"stars":3933,"repoUrl":3934,"updatedAt":3965},"azsdk-common-prepare-release-plan","manage Azure SDK release plan work items","Create, get, update, abandon, and link SDK PRs to release plan work items for Azure SDK releases. **UTILITY SKILL**. USE FOR: \"create release plan\", \"get release plan\", \"update release plan\", \"update API spec in release plan\", \"update SDK details in release plan\", \"abandon release plan\", \"link SDK PR to plan\", \"namespace approval\", \"check release plan status\". DO NOT USE FOR: SDK code generation, pipeline troubleshooting, API review feedback. INVOKES: azure-sdk-mcp:azsdk_create_release_plan, azure-sdk-mcp:azsdk_get_release_plan, azure-sdk-mcp:azsdk_get_release_plan_for_spec_pr, azure-sdk-mcp:azsdk_update_release_plan, azure-sdk-mcp:azsdk_update_api_spec_pull_request_in_release_plan, azure-sdk-mcp:azsdk_update_sdk_details_in_release_plan, azure-sdk-mcp:azsdk_abandon_release_plan, azure-sdk-mcp:azsdk_link_sdk_pull_request_to_release_plan, azure-sdk-mcp:azsdk_link_namespace_approval_issue.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3957,3958,3961,3964],{"name":11,"slug":8,"type":16},{"name":3959,"slug":3960,"type":16},"GitHub","github",{"name":3962,"slug":3963,"type":16},"Project Management","project-management",{"name":3945,"slug":3946,"type":16},"2026-07-12T08:17:38.345387",{"slug":3967,"name":3967,"fn":3968,"description":3969,"org":3970,"tags":3971,"stars":3933,"repoUrl":3934,"updatedAt":3978},"azsdk-common-sdk-release","release Azure SDK packages","Check release readiness and trigger the release pipeline for Azure SDK packages. **UTILITY SKILL**. USE FOR: \"release SDK\", \"trigger release\", \"check release readiness\", \"release pipeline\", \"publish package\", \"ship SDK\". DO NOT USE FOR: SDK development, code generation, pipeline debugging, release plan creation. INVOKES: azure-sdk-mcp:azsdk_release_sdk.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3972,3973,3976,3977],{"name":11,"slug":8,"type":16},{"name":3974,"slug":3975,"type":16},"CI\u002FCD","ci-cd",{"name":21,"slug":22,"type":16},{"name":3945,"slug":3946,"type":16},"2026-07-12T08:17:34.27607",{"slug":3980,"name":3980,"fn":3981,"description":3982,"org":3983,"tags":3984,"stars":3933,"repoUrl":3934,"updatedAt":3993},"azure-typespec-author","author and modify Azure TypeSpec API specifications","Authors and modifies Azure TypeSpec (.tsp) API specifications. USE FOR: any TypeSpec\u002Ftsp change — api versions (add, bump, preview, stable, promote), resources, operations, models, properties, decorators, visibility, constraints, breaking changes, LRO, suppressions, operationId, spread model. Covers ARM resource-manager and data-plane services. DO NOT USE FOR: SDK generation, releasing SDK packages, or single MCP tool calls. INVOKES: azure-sdk-mcp:azsdk_typespec_generate_authoring_plan, azure-sdk-mcp:azsdk_run_typespec_validation.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3985,3986,3987,3990],{"name":3924,"slug":3925,"type":16},{"name":11,"slug":8,"type":16},{"name":3988,"slug":3989,"type":16},"OpenAPI","openapi",{"name":3991,"slug":3992,"type":16},"Technical Writing","technical-writing","2026-07-12T08:17:39.603232",{"slug":3995,"name":3995,"fn":3996,"description":3997,"org":3998,"tags":3999,"stars":3933,"repoUrl":3934,"updatedAt":4004},"generate-sdk-locally","generate and test Azure SDKs locally","Generate, build, and test Azure SDKs locally from TypeSpec with automatic customization. WHEN: \"generate SDK locally\", \"build SDK\", \"run SDK tests\", \"run CI checks\", \"validate package\", \"run checks\", \"update changelog\", \"fix SDK build errors\", \"fix breaking changes\", \"resolve SDK generation errors\", \"customize TypeSpec\", \"rename SDK client\", \"rename SDK model\", \"hide operation from SDK\", \"fix analyzer errors\", \"resolve customization drift\", \"create subclient\", \"update metadata\", \"update version\". DO NOT USE FOR: publishing to package registries, CI pipeline configuration, API design review. INVOKES: azsdk_verify_setup, azsdk_package_generate_code, azsdk_package_build_code, azsdk_package_run_check, azsdk_package_run_tests, azsdk_customized_code_update, azsdk_package_update_changelog_content, azsdk_package_update_metadata, azsdk_package_update_version.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4000,4001,4002,4003],{"name":11,"slug":8,"type":16},{"name":3974,"slug":3975,"type":16},{"name":3945,"slug":3946,"type":16},{"name":3948,"slug":3949,"type":16},"2026-07-12T08:17:37.08523",{"slug":4006,"name":4006,"fn":4007,"description":4008,"org":4009,"tags":4010,"stars":3933,"repoUrl":3934,"updatedAt":4016},"markdown-token-optimizer","optimize markdown files for token efficiency","Analyze markdown files for token efficiency and reduce context-window bloat. **UTILITY SKILL**. DO NOT USE FOR: code optimization, general file editing, non-markdown files. TRIGGERS: optimize markdown, reduce tokens, token count, token bloat, too many tokens, make concise, shrink file, file too large, optimize for AI, token efficiency, verbose markdown, reduce file size. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4011,4014,4015],{"name":4012,"slug":4013,"type":16},"LLM","llm",{"name":18,"slug":19,"type":16},{"name":3991,"slug":3992,"type":16},"2026-07-12T08:17:42.080413",{"slug":4018,"name":4018,"fn":4019,"description":4020,"org":4021,"tags":4022,"stars":3933,"repoUrl":3934,"updatedAt":4029},"pipeline-troubleshooting","troubleshoot Azure SDK CI pipelines","Diagnose and resolve failures in Azure SDK CI and generation pipelines. **UTILITY SKILL**. USE FOR: \"pipeline failed\", \"build failure\", \"CI check failing\", \"SDK generation error\", \"reproduce pipeline locally\", \"debug SDK pipeline\". DO NOT USE FOR: local build issues without pipeline context, API design review, SDK publishing. INVOKES: azure-sdk-mcp:azsdk_analyze_pipeline, azure-sdk-mcp:azsdk_package_build_code, azure-sdk-mcp:azsdk_package_run_check.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4023,4024,4025,4028],{"name":11,"slug":8,"type":16},{"name":3974,"slug":3975,"type":16},{"name":4026,"slug":4027,"type":16},"Debugging","debugging",{"name":3945,"slug":3946,"type":16},"2026-07-12T08:17:40.821512",{"slug":4031,"name":4031,"fn":4032,"description":4033,"org":4034,"tags":4035,"stars":3933,"repoUrl":3934,"updatedAt":4042},"sensei","improve skill frontmatter compliance","**WORKFLOW SKILL** — Iteratively improve skill frontmatter compliance using the Ralph loop pattern. WHEN: \"run sensei\", \"sensei help\", \"improve skill\", \"fix frontmatter\", \"skill compliance\", \"frontmatter audit\", \"score skill\", \"check skill tokens\". INVOKES: token counting tools, test runners, git commands. FOR SINGLE OPERATIONS: use token CLI directly for counts\u002Fchecks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4036,4037,4038,4041],{"name":11,"slug":8,"type":16},{"name":3889,"slug":3890,"type":16},{"name":4039,"slug":4040,"type":16},"Process Optimization","process-optimization",{"name":3991,"slug":3992,"type":16},"2026-07-12T08:17:32.970921",{"slug":4044,"name":4044,"fn":4045,"description":4046,"org":4047,"tags":4048,"stars":3933,"repoUrl":3934,"updatedAt":4054},"skill-authoring","author agent skills for agentskills.io","Write Agent Skills that comply with the agentskills.io specification. WHEN: \"create a skill\", \"new skill\", \"write a skill\", \"skill template\", \"skill structure\", \"review skill\", \"skill PR\", \"skill compliance\", \"SKILL.md format\", \"skill frontmatter\", \"skill best practices\". DO NOT USE FOR: improving existing skills (use sensei), general documentation. INVOKES: waza CLI.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4049,4050,4053],{"name":3931,"slug":3932,"type":16},{"name":4051,"slug":4052,"type":16},"Plugin Development","plugin-development",{"name":3991,"slug":3992,"type":16},"2026-07-12T08:17:35.873862",109,{"items":4057,"total":2404},[4058,4066,4078],{"slug":4,"name":4,"fn":5,"description":6,"org":4059,"tags":4060,"stars":29,"repoUrl":30,"updatedAt":31},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4061,4062,4063,4064,4065],{"name":21,"slug":22,"type":16},{"name":27,"slug":28,"type":16},{"name":24,"slug":25,"type":16},{"name":18,"slug":19,"type":16},{"name":14,"slug":15,"type":16},{"slug":2071,"name":2071,"fn":4067,"description":4068,"org":4069,"tags":4070,"stars":29,"repoUrl":30,"updatedAt":4077},"generate and optimize Dockerfiles","Generate or enhance a Dockerfile for a containerized application using curated base-image recommendations and security best practices. Use AFTER analyze-repo (or after the user has told you the language\u002Fframework). Triggers include \"generate a Dockerfile\", \"containerize this\", \"write Dockerfile for X\", or when running aks-loop and no Dockerfile yet exists. If a Dockerfile already exists, this skill enhances it in place.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4071,4072,4075,4076],{"name":11,"slug":8,"type":16},{"name":4073,"slug":4074,"type":16},"Containers","containers",{"name":27,"slug":28,"type":16},{"name":14,"slug":15,"type":16},"2026-07-19T05:40:02.706462",{"slug":3524,"name":3524,"fn":4079,"description":4080,"org":4081,"tags":4082,"stars":29,"repoUrl":30,"updatedAt":4089},"generate production Kubernetes manifests","Generate production-ready Kubernetes manifests (Deployment, Service, ConfigMap, Secret, ServiceAccount, optional HPA) for a containerized application. Use AFTER a Dockerfile exists and has been validated by fix-dockerfile. Triggers include \"generate kubernetes manifests\", \"deploy this to k8s\", \"write k8s yaml\", \"create deployment yaml\", or when running aks-loop and image is built. Writes manifests directly to the target directory.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[4083,4084,4085,4086],{"name":11,"slug":8,"type":16},{"name":4073,"slug":4074,"type":16},{"name":21,"slug":22,"type":16},{"name":4087,"slug":4088,"type":16},"Kubernetes","kubernetes","2026-07-12T08:18:26.554131"]