[
  {
    "id": "python-requirements-cache",
    "category": "dockerfile",
    "pattern": "COPY requirements\\.txt",
    "recommendation": "Copy requirements.txt first and install dependencies for better Docker layer caching",
    "example": "COPY requirements.txt .\nRUN pip install --no-cache-dir -r requirements.txt\nCOPY . .",
    "severity": "medium",
    "tags": [
      "caching",
      "fix-dockerfile",
      "generate-dockerfile",
      "optimization",
      "pip",
      "pip-install",
      "python"
    ],
    "description": "Separate dependency installation improves build performance"
  },
  {
    "id": "python-pip-no-cache",
    "category": "dockerfile",
    "pattern": "pip install",
    "recommendation": "Use --no-cache-dir flag with pip to reduce image size",
    "example": "RUN pip install --no-cache-dir -r requirements.txt",
    "severity": "medium",
    "tags": [
      "cleanup",
      "fix-dockerfile",
      "generate-dockerfile",
      "pip",
      "pip-install",
      "python",
      "size"
    ],
    "description": "pip cache can add significant size to container images"
  },
  {
    "id": "python-slim-base",
    "category": "dockerfile",
    "pattern": "FROM python:(?!.*slim|.*alpine)",
    "recommendation": "Use python:slim images for production to reduce size and attack surface",
    "example": "FROM python:3.11-slim",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "production",
      "python",
      "security",
      "slim"
    ],
    "description": "Slim images exclude unnecessary packages while maintaining compatibility"
  },
  {
    "id": "python-compile-bytecode",
    "category": "dockerfile",
    "pattern": "FROM python:",
    "recommendation": "Set PYTHONUNBUFFERED and compile bytecode for better performance",
    "example": "ENV PYTHONUNBUFFERED=1 PYTHONDONTWRITEBYTECODE=1\nRUN python -m compileall .",
    "severity": "low",
    "tags": [
      "bytecode",
      "fix-dockerfile",
      "generate-dockerfile",
      "performance",
      "python"
    ],
    "description": "Environment variables optimize Python runtime in containers"
  },
  {
    "id": "django-collectstatic",
    "category": "dockerfile",
    "pattern": "django",
    "recommendation": "Run Django collectstatic during build for static files serving",
    "example": "RUN python manage.py collectstatic --noinput",
    "severity": "medium",
    "tags": [
      "build",
      "build-tool",
      "django",
      "fix-dockerfile",
      "generate-dockerfile",
      "static"
    ],
    "description": "Collecting static files during build improves runtime performance"
  },
  {
    "id": "python-wheel-packages",
    "category": "dockerfile",
    "pattern": "pip install.*requirements",
    "recommendation": "Install wheel package for faster pip installations",
    "example": "RUN pip install --no-cache-dir wheel && pip install --no-cache-dir -r requirements.txt",
    "severity": "low",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "performance",
      "pip",
      "pip-install",
      "python",
      "wheel"
    ],
    "description": "wheel enables faster installation of Python packages"
  },
  {
    "id": "python-multi-stage-build",
    "category": "dockerfile",
    "pattern": "pip install.*build",
    "recommendation": "Use multi-stage builds to separate build dependencies from runtime",
    "example": "FROM python:3.11-slim as build\nRUN pip install build-tools\nFROM python:3.11-slim as runtime\nCOPY --from=build /app .",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "multistage",
      "optimization",
      "pip-install",
      "python",
      "runtime-stage"
    ],
    "description": "Exclude build tools and dev dependencies from final image"
  },
  {
    "id": "python-virtual-env",
    "category": "dockerfile",
    "pattern": "pip install",
    "recommendation": "Consider using virtual environments even in containers for dependency isolation",
    "example": "RUN python -m venv /opt/venv\nENV PATH=\"/opt/venv/bin:$PATH\"\nRUN pip install -r requirements.txt",
    "severity": "low",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "isolation",
      "pip-install",
      "python",
      "venv"
    ],
    "description": "Virtual environments provide additional dependency isolation"
  },
  {
    "id": "python-health-check",
    "category": "dockerfile",
    "pattern": "EXPOSE (8000|5000)",
    "recommendation": "Add health check for Python web applications",
    "example": "HEALTHCHECK --interval=30s --timeout=10s --start-period=5s --retries=3 \\\n  CMD curl -f http://localhost:8000/health || exit 1",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "health",
      "monitoring",
      "python"
    ],
    "description": "Health checks enable better container orchestration"
  },
  {
    "id": "python-gunicorn-workers",
    "category": "dockerfile",
    "pattern": "gunicorn",
    "recommendation": "Configure Gunicorn workers based on CPU cores for optimal performance",
    "example": "CMD [\"gunicorn\", \"--workers=4\", \"--bind=0.0.0.0:8000\", \"app:app\"]",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "gunicorn",
      "performance",
      "python"
    ],
    "description": "Worker count should match available CPU cores"
  },
  {
    "id": "flask-production-server",
    "category": "dockerfile",
    "pattern": "flask run",
    "recommendation": "Use production WSGI server like Gunicorn instead of Flask development server",
    "example": "RUN pip install gunicorn\nCMD [\"gunicorn\", \"--bind=0.0.0.0:5000\", \"app:app\"]",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "flask",
      "generate-dockerfile",
      "gunicorn",
      "pip-install",
      "production"
    ],
    "description": "Flask development server is not suitable for production use"
  },
  {
    "id": "python-security-user",
    "category": "security",
    "pattern": "FROM python:",
    "recommendation": "Create and use a non-root user for Python applications",
    "example": "RUN groupadd -r python && useradd -r -g python python\nUSER python",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "python",
      "scan-image",
      "security",
      "user"
    ],
    "description": "Running as non-root reduces security attack surface"
  },
  {
    "id": "python-pip-security",
    "category": "security",
    "pattern": "pip install",
    "recommendation": "Use pip-audit or safety to check for vulnerable dependencies",
    "example": "RUN pip install pip-audit && pip-audit",
    "severity": "medium",
    "tags": [
      "dependencies",
      "fix-dockerfile",
      "pip-install",
      "python",
      "scan-image",
      "security"
    ],
    "description": "Regularly audit dependencies for known security vulnerabilities"
  },
  {
    "id": "python-fastapi-docs",
    "category": "dockerfile",
    "pattern": "fastapi",
    "recommendation": "Disable automatic docs in production FastAPI applications",
    "example": "# In app code: app = FastAPI(docs_url=None, redoc_url=None)",
    "severity": "low",
    "tags": [
      "fastapi",
      "fix-dockerfile",
      "generate-dockerfile",
      "production",
      "security"
    ],
    "description": "Automatic docs can expose API structure in production"
  },
  {
    "id": "python-poetry-install",
    "category": "dockerfile",
    "pattern": "poetry install",
    "recommendation": "Use poetry install --no-dev for production builds",
    "example": "COPY pyproject.toml poetry.lock ./\nRUN poetry install --no-dev --no-interaction",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "poetry",
      "production",
      "python"
    ],
    "description": "Exclude development dependencies in production containers"
  },
  {
    "id": "python-pandas-memory",
    "category": "dockerfile",
    "pattern": "pandas|numpy",
    "recommendation": "Consider using pandas with appropriate memory settings for data processing",
    "example": "ENV PANDAS_COPY_ON_WRITE=1",
    "severity": "low",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "memory",
      "pandas",
      "python"
    ],
    "description": "Pandas memory optimizations can improve container performance"
  },
  {
    "id": "python-logging-config",
    "category": "dockerfile",
    "pattern": "FROM python:",
    "recommendation": "Configure Python logging to use JSON format for structured logging",
    "example": "ENV PYTHONUNBUFFERED=1\n# Configure JSON logging in application",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "logging",
      "python",
      "structured"
    ],
    "description": "Structured logging improves observability in container environments"
  },
  {
    "id": "python-timezone-handling",
    "category": "dockerfile",
    "pattern": "FROM python:",
    "recommendation": "Set explicit timezone for consistent datetime handling",
    "example": "ENV TZ=UTC\nRUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime",
    "severity": "low",
    "tags": [
      "datetime",
      "fix-dockerfile",
      "generate-dockerfile",
      "python",
      "timezone"
    ],
    "description": "Explicit timezone prevents datetime-related bugs"
  },
  {
    "id": "celery-worker-config",
    "category": "dockerfile",
    "pattern": "celery",
    "recommendation": "Configure Celery workers with appropriate concurrency and memory limits",
    "example": "CMD [\"celery\", \"worker\", \"-A\", \"app\", \"--concurrency=4\", \"--max-memory-per-child=200000\"]",
    "severity": "medium",
    "tags": [
      "celery",
      "fix-dockerfile",
      "generate-dockerfile",
      "performance",
      "workers"
    ],
    "description": "Proper Celery configuration prevents memory leaks and improves performance"
  },
  {
    "id": "python-requirements-pin",
    "category": "security",
    "pattern": "requirements\\.txt",
    "recommendation": "Pin exact versions in requirements.txt for reproducible builds",
    "example": "# Use pip freeze > requirements.txt or pip-tools",
    "severity": "medium",
    "tags": [
      "dependencies",
      "fix-dockerfile",
      "python",
      "reproducible",
      "scan-image"
    ],
    "description": "Pinned versions ensure consistent builds across environments"
  },
  {
    "id": "fastapi-async-optimization",
    "category": "dockerfile",
    "pattern": "fastapi.*async",
    "recommendation": "Optimize FastAPI for async workloads with proper ASGI server configuration",
    "example": "RUN pip install uvicorn[standard] gunicorn\nCMD [\"gunicorn\", \"-w\", \"4\", \"-k\", \"uvicorn.workers.UvicornWorker\", \"--bind\", \"0.0.0.0:8000\", \"main:app\"]",
    "severity": "high",
    "tags": [
      "async",
      "fastapi",
      "fix-dockerfile",
      "generate-dockerfile",
      "performance",
      "pip-install",
      "uvicorn"
    ],
    "description": "Proper ASGI configuration maximizes async FastAPI performance"
  },
  {
    "id": "aiohttp-async-patterns",
    "category": "dockerfile",
    "pattern": "aiohttp",
    "recommendation": "Configure aiohttp with proper connector limits and session management",
    "example": "# In app code: set connector limits for production\n# aiohttp.ClientSession(connector=aiohttp.TCPConnector(limit=100))\nCMD [\"python\", \"-m\", \"aiohttp.web\", \"-H\", \"0.0.0.0\", \"-P\", \"8080\", \"app:init_app\"]",
    "severity": "medium",
    "tags": [
      "aiohttp",
      "async",
      "connectors",
      "fix-dockerfile",
      "generate-dockerfile",
      "performance"
    ],
    "description": "Proper aiohttp configuration prevents connection pool exhaustion"
  },
  {
    "id": "poetry-docker-optimization",
    "category": "dockerfile",
    "pattern": "poetry",
    "recommendation": "Use Poetry with Docker-optimized caching and virtual environment management",
    "example": "ENV POETRY_HOME=\"/opt/poetry\" POETRY_CACHE_DIR=/opt/poetry/cache\nRUN pip install poetry\nCOPY pyproject.toml poetry.lock ./\nRUN poetry config virtualenvs.create false && poetry install --no-dev --no-interaction\nCOPY . .",
    "severity": "high",
    "tags": [
      "caching",
      "fix-dockerfile",
      "generate-dockerfile",
      "optimization",
      "pip-install",
      "poetry",
      "virtualenv"
    ],
    "description": "Poetry configuration optimizes dependency management in containers"
  },
  {
    "id": "python-security-scanning-comprehensive",
    "category": "security",
    "pattern": "pip install|poetry install",
    "recommendation": "Implement comprehensive Python security scanning with multiple tools",
    "example": "# Install security tools\nRUN pip install pip-audit bandit safety\n# Run security scans\nRUN pip-audit --fix --dry-run\nRUN bandit -r . -x tests/\nRUN safety check --json",
    "severity": "high",
    "tags": [
      "bandit",
      "fix-dockerfile",
      "pip-audit",
      "pip-install",
      "safety",
      "scan-image",
      "scanning",
      "security"
    ],
    "description": "Multi-tool security scanning provides comprehensive vulnerability detection"
  },
  {
    "id": "uv-package-manager",
    "category": "dockerfile",
    "pattern": "uv pip|uv install",
    "recommendation": "Use uv for faster Python package installation and management",
    "example": "# Install uv\nRUN pip install uv\n# Use uv for faster installs\nCOPY requirements.txt .\nRUN uv pip install --no-cache -r requirements.txt\n# Or with sync\nRUN uv pip sync requirements.txt",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "package-manager",
      "performance",
      "pip-install",
      "rust",
      "uv"
    ],
    "description": "uv provides significantly faster Python package installation"
  },
  {
    "id": "pyo3-maturin-rust-extensions",
    "category": "dockerfile",
    "pattern": "maturin|pyo3",
    "recommendation": "Optimize PyO3/Maturin Rust extensions build in multi-stage containers",
    "example": "FROM rust:alpine AS rust-builder\nRUN apk add --no-cache musl-dev\nCOPY Cargo.toml pyproject.toml ./\nRUN maturin build --release\n\nFROM python:alpine\nCOPY --from=rust-builder /app/target/wheels/*.whl .\nRUN pip install *.whl",
    "severity": "medium",
    "tags": [
      "extensions",
      "fix-dockerfile",
      "generate-dockerfile",
      "maturin",
      "performance",
      "pip-install",
      "pyo3",
      "rust"
    ],
    "description": "Rust extensions provide significant performance improvements for Python"
  },
  {
    "id": "mypy-type-checking-ci",
    "category": "dockerfile",
    "pattern": "mypy",
    "recommendation": "Integrate mypy type checking in CI/CD pipeline for type safety",
    "example": "RUN pip install mypy\n# Type check during build\nRUN mypy src/ --ignore-missing-imports --strict\n# Or as separate validation step\nRUN python -m mypy --config-file mypy.ini src/",
    "severity": "medium",
    "tags": [
      "ci",
      "fix-dockerfile",
      "generate-dockerfile",
      "mypy",
      "pip-install",
      "type-checking",
      "validation"
    ],
    "description": "mypy type checking catches type errors before runtime"
  },
  {
    "id": "asyncio-event-loop-optimization",
    "category": "dockerfile",
    "pattern": "asyncio|uvloop",
    "recommendation": "Use uvloop for better asyncio performance in production",
    "example": "RUN pip install uvloop\n# In application code:\n# import uvloop\n# uvloop.install()\nENV PYTHONPATH=/app",
    "severity": "medium",
    "tags": [
      "asyncio",
      "event-loop",
      "fix-dockerfile",
      "generate-dockerfile",
      "performance",
      "pip-install",
      "uvloop"
    ],
    "description": "uvloop provides 2x+ better performance for asyncio applications"
  },
  {
    "id": "python-distroless-security",
    "category": "security",
    "pattern": "FROM.*python",
    "recommendation": "Consider Google Distroless Python images for enhanced security",
    "example": "# Multi-stage with distroless\nFROM python:3.11-slim AS builder\nRUN pip install --user -r requirements.txt\n\nFROM gcr.io/distroless/python3-debian11\nCOPY --from=builder /root/.local /root/.local\nCOPY . .\nCMD [\"main.py\"]",
    "severity": "medium",
    "tags": [
      "attack-surface",
      "distroless",
      "fix-dockerfile",
      "google",
      "minimal",
      "pip-install",
      "scan-image",
      "security"
    ],
    "description": "Distroless images provide minimal attack surface with no shell or package manager"
  },
  {
    "id": "python-multiprocessing-optimization",
    "category": "dockerfile",
    "pattern": "multiprocessing|concurrent",
    "recommendation": "Configure Python multiprocessing for containerized environments",
    "example": "# Set shared memory size if needed\n# In docker run: --shm-size=2g\nENV PYTHONUNBUFFERED=1\n# Configure multiprocessing start method\nENV MP_START_METHOD=spawn",
    "severity": "medium",
    "tags": [
      "concurrency",
      "configuration",
      "fix-dockerfile",
      "generate-dockerfile",
      "multiprocessing",
      "performance"
    ],
    "description": "Proper multiprocessing configuration prevents issues in containers"
  },
  {
    "id": "python-profile-guided-optimization",
    "category": "dockerfile",
    "pattern": "FROM python:.*optimize",
    "recommendation": "Use Python PGO (Profile Guided Optimization) builds for performance-critical applications",
    "example": "FROM python:3.11-slim\n# For PGO Python builds:\n# FROM python:3.11-slim-bullseye\nENV PYTHONOPTIMIZE=2\nRUN python -O -m py_compile /app/*.py",
    "severity": "low",
    "tags": [
      "compilation",
      "fix-dockerfile",
      "generate-dockerfile",
      "optimization",
      "performance",
      "pgo"
    ],
    "description": "PGO builds can provide 10-20% performance improvements"
  },
  {
    "id": "django-async-views",
    "category": "dockerfile",
    "pattern": "django.*async",
    "recommendation": "Configure Django for async views with proper ASGI deployment",
    "example": "RUN pip install uvicorn gunicorn\n# Use ASGI for async Django\nCMD [\"gunicorn\", \"myproject.asgi:application\", \"-w\", \"4\", \"-k\", \"uvicorn.workers.UvicornWorker\", \"--bind\", \"0.0.0.0:8000\"]",
    "severity": "medium",
    "tags": [
      "asgi",
      "async",
      "django",
      "fix-dockerfile",
      "generate-dockerfile",
      "performance",
      "pip-install"
    ],
    "description": "ASGI deployment enables async Django views and better performance"
  },
  {
    "id": "python-memory-profiling",
    "category": "dockerfile",
    "pattern": "memory|profile",
    "recommendation": "Include memory profiling tools for production debugging",
    "example": "# Install profiling tools\nRUN pip install memory-profiler pympler\n# Set environment for profiling\nENV PYTHONTRACEMALLOC=1\n# Optional: Install tracemalloc utilities",
    "severity": "low",
    "tags": [
      "debugging",
      "fix-dockerfile",
      "generate-dockerfile",
      "memory",
      "monitoring",
      "pip-install",
      "profiling"
    ],
    "description": "Memory profiling tools help identify memory leaks and optimization opportunities"
  },
  {
    "id": "python-dependency-vulnerability-scanning",
    "category": "security",
    "pattern": "requirements.*txt|pyproject.toml",
    "recommendation": "Implement continuous dependency vulnerability monitoring",
    "example": "# During build\nRUN pip-audit --requirement requirements.txt --format=json --output=audit-results.json\n# Runtime monitoring\nCOPY audit-results.json /app/\n# Consider tools like snyk, sonatype, or dependabot",
    "severity": "high",
    "tags": [
      "dependencies",
      "fix-dockerfile",
      "monitoring",
      "scan-image",
      "security",
      "vulnerability"
    ],
    "description": "Continuous vulnerability monitoring ensures ongoing security"
  }
]