Policies
Dockerfile and Compose Security
Dockerfile and Compose Security: what it does, its label on each agent, what it misses, and examples.
Catalog policy dockerfile-compose-security, version 0.2.0, labelled blocks on Claude Code.
What it does
Blocks (some rules ask) when a change to a Dockerfile, Containerfile or compose file adds: a base image with no tag, latest, an unresolvable ARG or no digest (stage-aware: FROM or COPY --from a stage is not an image); a final stage running as root; TLS or package-signature checks off; secret-named ENV/ARG/environment literals; COPY of key or .env files; remote ADD without checksum; fetch piped to a shell; RUN --security=insecure; chmod 777 or setuid; sudo, sshd, chpasswd; unpinned git clone; ONBUILD RUN; compose privileged, broad cap_add, unconfined profiles, devices, host namespaces, runtime socket or host-root mounts, database ports on every interface, untagged images. A one-line form is left to block-fetch-exec-in-files, block-unpinned-agent-components or agentic-code-security only where that gate is installed and reads the file; scan-secrets lines always. Misses: build args overriding defaults, commands in variables, aliases or $'' quoting, bake and k8s files. Friction, not a boundary.
On each agent
| Agent | Label | What it does there |
|---|---|---|
| Claude Code | Blocks | Blocks on an agent's file writes and at turn end |
| Cursor | Blocks | Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point |
| Codex | Blocks | Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| GitHub Copilot | Blocks | Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| Devin | Blocks | Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed) |
| Grok | Not graded | Not graded yet for Grok |
| goose | Not graded | Not graded yet for goose |
| Antigravity | Not graded | Not graded yet for Antigravity |
| OpenHands | Not graded | Not graded yet for OpenHands |
| Kimi Code | Not graded | Not graded yet for Kimi Code |
| Factory Droid | Not graded | Not graded yet for Factory Droid |
What it misses
Build args overriding defaults, commands in variables, aliases or $'' quoting, bake and k8s files.
Examples from its eval suite
Refused: A commit adds a Dockerfile whose only stage is built FROM an untagged image.
Allowed: A commit adds a Dockerfile pinned by digest, built FROM an earlier stage, running as a non-root user.
More
Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.