--- id: dockerfile-compose-security track: coding version: 0.2.0 label: blocks keyword: block where: write turn-end sha256: e6d6df672b3f5da12772cf62609c4383f2bea60126951d50fb874d8cfecc9060 source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/dockerfile-compose-security catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f --- # Dockerfile and Compose Security dockerfile-compose-security · version 0.2.0 Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. In a git repo: at commit (Chock refuses the commit, locally and in CI.) ## What it does Blocks (some rules ask) when a change to a Dockerfile, Containerfile or compose file adds: a base image with no tag, latest, an unresolvable ARG or no digest (stage-aware: FROM or COPY --from a stage is not an image); a final stage running as root; TLS or package-signature checks off; secret-named ENV/ARG/environment literals; COPY of key or .env files; remote ADD without checksum; fetch piped to a shell; RUN --security=insecure; chmod 777 or setuid; sudo, sshd, chpasswd; unpinned git clone; ONBUILD RUN; compose privileged, broad cap_add, unconfined profiles, devices, host namespaces, runtime socket or host-root mounts, database ports on every interface, untagged images. A one-line form is left to block-fetch-exec-in-files, block-unpinned-agent-components or agentic-code-security only where that gate is installed and reads the file; scan-secrets lines always. Misses: build args overriding defaults, commands in variables, aliases or $'' quoting, bake and k8s files. Friction, not a boundary. ## Its label on each agent - Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=dockerfile-compose-security - Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=dockerfile-compose-security - Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=dockerfile-compose-security - GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=dockerfile-compose-security - Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=dockerfile-compose-security - Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=dockerfile-compose-security - goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=dockerfile-compose-security - Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=dockerfile-compose-security - OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=dockerfile-compose-security - Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=dockerfile-compose-security - Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=dockerfile-compose-security ## What it misses Build args overriding defaults, commands in variables, aliases or $'' quoting, bake and k8s files. ## Examples - Refused: A commit adds a Dockerfile whose only stage is built FROM an untagged image. - Allowed: A commit adds a Dockerfile pinned by digest, built FROM an earlier stage, running as a non-root user. ## Latest change 0.2.0 · 2026-10-25 — Hardening (SR-2d2d; findings F24, F26, F33; eval cases tc-035 to tc-037; tests in test_dockerfile_compose_sr2d2.py). Behaviour change: a sibling gate (block-fetch-exec-in-files, block-unpinned-agent-components, agentic-code-security) counts as installed only when a readable regular \`gate.json\` (not a symlink, at most 1 MiB) under its compiled folder, directly or one folder down, has \`action: block\`; a bare folder, such as one a plain \`mkdir\` leaves, an unreadable file or a gate that only warns no longer hides this bundle's deny findings. Behaviour change: the fetch-exec and remote-ADD deferral applies the installed sibling's own \`content_pattern\` from its compiled gate to the physical line, and defers nothing when the pattern is missing or does not compile; the HP03 regex copies are gone, so forms the sibling's pattern reads (a quoted \`'curl'\`, a pipe into \`python3 -\`) are now left to it and a line it does not read (a space-preceded \`#\` in quotes before the fetch) is reported here. Behaviour change: a secret-named literal is left to scan-secrets only when scan-secrets' pattern matches a span of one raw physical line that holds the literal, not a \`name: value\` string rebuilt from the parsed value, so an alias, anchor, tag, block or wrapped scalar, or a Dockerfile value split by a continuation, is reported here. Known limits: the copied scan-secrets pattern is still the 0.0.9 one (it reads fewer quoted-colon forms than the shipped 0.1.2, which only means a double report); the pins and node-tls deferrals still use this bundle's own line patterns, gated by the same block-action check. protect-agent-config's \`mkdir\` of compiled folders is not changed here. ## Provenance - Tested by 37 of 37 cases run automatically - SHA-256: `e6d6df672b3f5da12772cf62609c4383f2bea60126951d50fb874d8cfecc9060` - Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f - Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/dockerfile-compose-security (catalog path `base/dockerfile-compose-security`) - Presets: Cloud and containers - JSON: `/api/coding/policies/dockerfile-compose-security.json` - Report a problem: https://chock.sh/report/?policy=dockerfile-compose-security&version=0.2.0&page=%2Fcoding%2Fpolicies%2Fdockerfile-compose-security%2F