[
  {
    "id": "container-root-user",
    "category": "security",
    "pattern": "USER root",
    "recommendation": "Avoid running containers as root user - create and use a dedicated non-root user",
    "example": "RUN groupadd -r appuser && useradd -r -g appuser appuser\nWORKDIR /home/appuser\nUSER appuser",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "privilege",
      "root",
      "scan-image",
      "security",
      "user"
    ],
    "description": "Running as root increases attack surface if container is compromised"
  },
  {
    "id": "secrets-in-dockerfile",
    "category": "security",
    "pattern": "(PASSWORD|SECRET|API_KEY|TOKEN)\\s*=",
    "recommendation": "Never hardcode secrets in Dockerfile - use environment variables or secret management",
    "example": "# Bad: ENV API_KEY=secret123\n# Good: ENV API_KEY_FILE=/run/secrets/api_key",
    "severity": "high",
    "tags": [
      "aws",
      "fix-dockerfile",
      "hardcoded",
      "scan-image",
      "secrets",
      "security"
    ],
    "description": "Hardcoded secrets are exposed in image layers and version control"
  },
  {
    "id": "image-version-pinning",
    "category": "security",
    "pattern": ":latest",
    "recommendation": "Pin specific image versions instead of using 'latest' tag for reproducible and secure builds",
    "example": "FROM node:18.17.1-alpine\n# Instead of: FROM node:latest",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "reproducible",
      "scan-image",
      "security",
      "versions"
    ],
    "description": "Latest tags can introduce unexpected changes and security vulnerabilities"
  },
  {
    "id": "package-manager-cleanup",
    "category": "security",
    "pattern": "(apt-get|yum|apk).*install",
    "recommendation": "Clean package manager caches after installation to reduce attack surface",
    "example": "RUN apt-get update && apt-get install -y package && rm -rf /var/lib/apt/lists/*",
    "severity": "medium",
    "tags": [
      "attack-surface",
      "cleanup",
      "fix-dockerfile",
      "scan-image",
      "security"
    ],
    "description": "Package caches can contain vulnerable or unnecessary files"
  },
  {
    "id": "minimal-base-images",
    "category": "security",
    "pattern": "FROM (ubuntu|centos|debian)(?!.*slim)",
    "recommendation": "Use minimal base images like Alpine, slim, or distroless to reduce attack surface",
    "example": "FROM node:18-alpine\n# Or: FROM gcr.io/distroless/nodejs18",
    "severity": "medium",
    "tags": [
      "attack-surface",
      "fix-dockerfile",
      "google",
      "minimal",
      "scan-image",
      "security"
    ],
    "description": "Minimal images contain fewer packages and potential vulnerabilities"
  },
  {
    "id": "file-permissions",
    "category": "security",
    "pattern": "chmod 777",
    "recommendation": "Avoid overly permissive file permissions - use least privilege principle",
    "example": "RUN chmod 755 /app/script.sh\n# Instead of: chmod 777 /app/script.sh",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "least-privilege",
      "permissions",
      "scan-image",
      "security"
    ],
    "description": "Overly permissive permissions increase security risks"
  },
  {
    "id": "vulnerability-scanning",
    "category": "security",
    "pattern": "FROM.*:",
    "recommendation": "Regularly scan container images for vulnerabilities using tools like Trivy, Snyk, or Clair",
    "example": "# Add to CI/CD: docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image myapp:latest",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "scan-image",
      "scanning",
      "security",
      "vulnerabilities"
    ],
    "description": "Regular vulnerability scanning identifies known security issues"
  },
  {
    "id": "network-exposure",
    "category": "security",
    "pattern": "EXPOSE.*0\\.0\\.0\\.0",
    "recommendation": "Bind services to specific interfaces, avoid binding to 0.0.0.0 when possible",
    "example": "EXPOSE 8080\n# In app: bind to 127.0.0.1 or specific interface",
    "severity": "medium",
    "tags": [
      "binding",
      "fix-dockerfile",
      "network",
      "scan-image",
      "security"
    ],
    "description": "Binding to all interfaces increases attack surface"
  },
  {
    "id": "docker-socket-mount",
    "category": "security",
    "pattern": "/var/run/docker.sock",
    "recommendation": "Avoid mounting Docker socket unless absolutely necessary - consider alternatives",
    "example": "# Avoid: -v /var/run/docker.sock:/var/run/docker.sock\n# Consider: Docker-in-Docker or Kaniko for builds",
    "severity": "high",
    "tags": [
      "docker-socket",
      "fix-dockerfile",
      "privilege-escalation",
      "scan-image",
      "security"
    ],
    "description": "Docker socket access provides root-equivalent access to host"
  },
  {
    "id": "copy-vs-add",
    "category": "security",
    "pattern": "ADD.*\\.(tar|zip|gz)",
    "recommendation": "Use COPY instead of ADD unless you need automatic extraction features",
    "example": "COPY app.jar /app/\n# Instead of: ADD app.jar /app/",
    "severity": "low",
    "tags": [
      "commands",
      "dockerfile",
      "fix-dockerfile",
      "security"
    ],
    "description": "ADD has additional features that can introduce security risks"
  },
  {
    "id": "health-check-security",
    "category": "security",
    "pattern": "HEALTHCHECK.*CMD",
    "recommendation": "Ensure health check endpoints don't expose sensitive information",
    "example": "HEALTHCHECK CMD curl -f http://localhost:8080/health || exit 1\n# Health endpoint should return minimal status only",
    "severity": "low",
    "tags": [
      "fix-dockerfile",
      "health-checks",
      "information-disclosure",
      "security"
    ],
    "description": "Health checks should not leak sensitive application information"
  },
  {
    "id": "build-args-secrets",
    "category": "security",
    "pattern": "ARG.*(PASSWORD|SECRET|KEY|TOKEN)",
    "recommendation": "Don't pass secrets as build arguments - they're visible in image history",
    "example": "# Bad: ARG SECRET_KEY=mysecret\n# Good: Use multi-stage builds and secret mounts",
    "severity": "high",
    "tags": [
      "aws",
      "build-args",
      "fix-dockerfile",
      "scan-image",
      "secrets",
      "security"
    ],
    "description": "Build arguments are stored in image layers and visible in history"
  },
  {
    "id": "dependency-security",
    "category": "security",
    "pattern": "(npm install|pip install|go get)",
    "recommendation": "Audit and pin dependency versions to avoid supply chain attacks",
    "example": "RUN npm audit --audit-level high\nCOPY package-lock.json ./\nRUN npm ci --only=production",
    "severity": "high",
    "tags": [
      "dependencies",
      "fix-dockerfile",
      "npm-ci",
      "scan-image",
      "security",
      "supply-chain"
    ],
    "description": "Unpinned dependencies can introduce vulnerabilities over time"
  },
  {
    "id": "privileged-containers",
    "category": "security",
    "pattern": "privileged.*true",
    "recommendation": "Avoid running privileged containers - use specific capabilities instead",
    "example": "# In K8s: securityContext.privileged: false\n# Add only needed capabilities",
    "severity": "high",
    "tags": [
      "capabilities",
      "fix-dockerfile",
      "privileged",
      "scan-image",
      "security"
    ],
    "description": "Privileged containers have root access to host system"
  },
  {
    "id": "readonly-filesystem",
    "category": "security",
    "pattern": "readOnlyRootFilesystem",
    "recommendation": "Use read-only root filesystem when possible to prevent runtime modifications",
    "example": "securityContext:\n  readOnlyRootFilesystem: true\nvolumeMounts:\n- name: tmp\n  mountPath: /tmp",
    "severity": "medium",
    "tags": [
      "filesystem",
      "fix-dockerfile",
      "immutable",
      "scan-image",
      "security"
    ],
    "description": "Read-only filesystem prevents runtime file system modifications"
  },
  {
    "id": "resource-limits-security",
    "category": "security",
    "pattern": "resources:",
    "recommendation": "Set resource limits to prevent DoS attacks and resource exhaustion",
    "example": "resources:\n  limits:\n    memory: \"512Mi\"\n    cpu: \"500m\"\n  requests:\n    memory: \"256Mi\"\n    cpu: \"250m\"",
    "severity": "medium",
    "tags": [
      "dos",
      "fix-dockerfile",
      "resources",
      "scan-image",
      "security"
    ],
    "description": "Resource limits prevent containers from consuming excessive resources"
  },
  {
    "id": "network-policies",
    "category": "security",
    "pattern": "kind: NetworkPolicy",
    "recommendation": "Implement network policies to control pod-to-pod communication",
    "example": "apiVersion: networking.k8s.io/v1\nkind: NetworkPolicy\nmetadata:\n  name: deny-all-ingress\nspec:\n  podSelector: {}\n  policyTypes:\n  - Ingress",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "microsegmentation",
      "network",
      "scan-image",
      "security"
    ],
    "description": "Network policies provide micro-segmentation for container communication"
  },
  {
    "id": "pod-security-standards",
    "category": "security",
    "pattern": "securityContext:",
    "recommendation": "Implement Pod Security Standards for comprehensive security controls",
    "example": "securityContext:\n  runAsNonRoot: true\n  runAsUser: 1001\n  allowPrivilegeEscalation: false\n  capabilities:\n    drop:\n    - ALL",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "pod-security",
      "scan-image",
      "security",
      "standards"
    ],
    "description": "Pod Security Standards provide baseline security configurations"
  },
  {
    "id": "image-signing",
    "category": "security",
    "pattern": "FROM.*@sha256:",
    "recommendation": "Use content-based image digests and consider image signing for supply chain security",
    "example": "FROM node:18-alpine@sha256:abc123...\n# Consider: cosign for image signing",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "scan-image",
      "security",
      "signing",
      "supply-chain"
    ],
    "description": "Image digests and signing ensure image integrity and authenticity"
  },
  {
    "id": "secrets-rotation",
    "category": "security",
    "pattern": "kind: Secret",
    "recommendation": "Implement secret rotation and use external secret management systems",
    "example": "# Use External Secrets Operator or similar\n# Implement automatic secret rotation",
    "severity": "medium",
    "tags": [
      "aws",
      "fix-dockerfile",
      "rotation",
      "scan-image",
      "secrets",
      "security"
    ],
    "description": "Regular secret rotation reduces impact of credential compromise"
  },
  {
    "id": "sbom-generation",
    "category": "security",
    "pattern": "FROM.*:",
    "recommendation": "Generate Software Bill of Materials (SBOM) for supply chain transparency",
    "example": "# Generate SBOM during build\nRUN syft packages -o spdx-json > /sbom.json\n# Or use: docker sbom myimage:tag",
    "severity": "medium",
    "tags": [
      "compliance",
      "fix-dockerfile",
      "sbom",
      "scan-image",
      "security",
      "supply-chain"
    ],
    "description": "SBOM provides transparency into container contents and dependencies"
  },
  {
    "id": "image-provenance",
    "category": "security",
    "pattern": "FROM.*:",
    "recommendation": "Use image signing and provenance attestation for supply chain security",
    "example": "# Sign with cosign\ncosign sign --key cosign.key myimage:tag\n# Verify: cosign verify --key cosign.pub myimage:tag",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "provenance",
      "scan-image",
      "security",
      "signing",
      "supply-chain"
    ],
    "description": "Image signing ensures authenticity and prevents tampering"
  },
  {
    "id": "base-image-verification",
    "category": "security",
    "pattern": "FROM",
    "recommendation": "Verify base image signatures and use trusted registries",
    "example": "# Use official images with digest\nFROM docker.io/library/node:20-alpine@sha256:abc123...\n# Enable Docker Content Trust: export DOCKER_CONTENT_TRUST=1",
    "severity": "high",
    "tags": [
      "base-image",
      "fix-dockerfile",
      "scan-image",
      "security",
      "trust",
      "verification"
    ],
    "description": "Verified base images prevent supply chain attacks"
  },
  {
    "id": "dependency-pinning",
    "category": "security",
    "pattern": "(npm install|pip install|go get|cargo build)",
    "recommendation": "Pin all dependency versions including transitive dependencies",
    "example": "# Use lock files: package-lock.json, Pipfile.lock, go.sum, Cargo.lock\n# Verify checksums during installation",
    "severity": "high",
    "tags": [
      "dependencies",
      "fix-dockerfile",
      "pinning",
      "reproducible",
      "scan-image",
      "security"
    ],
    "description": "Pinned dependencies prevent unexpected malicious updates"
  },
  {
    "id": "build-attestation",
    "category": "security",
    "pattern": "docker build",
    "recommendation": "Generate build attestations for transparency and compliance",
    "example": "docker build --provenance=true --sbom=true -t myimage:tag .\n# Generates attestations for build provenance and SBOM",
    "severity": "medium",
    "tags": [
      "attestation",
      "compliance",
      "fix-dockerfile",
      "provenance",
      "scan-image",
      "security"
    ],
    "description": "Build attestations provide verifiable build metadata"
  },
  {
    "id": "registry-scanning",
    "category": "security",
    "pattern": "docker push",
    "recommendation": "Enable automatic vulnerability scanning in container registries",
    "example": "# Configure registry scanning\n# AWS ECR: automatic scanning on push\n# Harbor: integrated Trivy scanning\n# GCR: Container Analysis API",
    "severity": "high",
    "tags": [
      "aws",
      "fix-dockerfile",
      "registry",
      "scan-image",
      "scanning",
      "security",
      "vulnerabilities"
    ],
    "description": "Registry scanning identifies vulnerabilities before deployment"
  },
  {
    "id": "admission-control",
    "category": "security",
    "pattern": "kind: Deployment",
    "recommendation": "Use admission controllers to enforce security policies",
    "example": "# Use OPA Gatekeeper or Kyverno for policy enforcement\n# Example: require image signatures, resource limits, non-root users",
    "severity": "high",
    "tags": [
      "admission-control",
      "fix-dockerfile",
      "kubernetes",
      "policy",
      "scan-image",
      "security"
    ],
    "description": "Admission controllers enforce security policies at deployment time"
  },
  {
    "id": "runtime-protection",
    "category": "security",
    "pattern": "securityContext:",
    "recommendation": "Implement runtime protection with security profiles",
    "example": "securityContext:\n  seccompProfile:\n    type: RuntimeDefault\n  appArmorProfile:\n    type: runtime/default\n  seLinuxOptions:\n    level: s0:c123,c456",
    "severity": "high",
    "tags": [
      "apparmor",
      "fix-dockerfile",
      "runtime",
      "scan-image",
      "seccomp",
      "security"
    ],
    "description": "Runtime security profiles restrict container capabilities"
  },
  {
    "id": "falco-rules",
    "category": "security",
    "pattern": "kind: Deployment",
    "recommendation": "Deploy Falco for runtime threat detection",
    "example": "# Deploy Falco DaemonSet for runtime security monitoring\n# Configure custom rules for application-specific threats",
    "severity": "medium",
    "tags": [
      "detection",
      "falco",
      "fix-dockerfile",
      "runtime",
      "scan-image",
      "security"
    ],
    "description": "Falco provides runtime security monitoring and alerting"
  },
  {
    "id": "compliance-scanning",
    "category": "security",
    "pattern": "FROM.*:",
    "recommendation": "Implement compliance scanning for regulatory requirements",
    "example": "# CIS Benchmark scanning\ndocker run --rm -v /var/run/docker.sock:/var/run/docker.sock \\\n  aquasec/docker-bench-security\n# NIST, PCI-DSS, HIPAA compliance checks",
    "severity": "high",
    "tags": [
      "cis",
      "compliance",
      "fix-dockerfile",
      "scan-image",
      "scanning",
      "security"
    ],
    "description": "Compliance scanning ensures regulatory requirement adherence"
  },
  {
    "id": "drift-detection",
    "category": "security",
    "pattern": "kind: Deployment",
    "recommendation": "Implement configuration drift detection",
    "example": "# Use tools like Kubescape or Datree\n# Monitor for unauthorized changes\n# Alert on configuration drift from baseline",
    "severity": "medium",
    "tags": [
      "configuration",
      "drift",
      "fix-dockerfile",
      "monitoring",
      "scan-image",
      "security"
    ],
    "description": "Drift detection identifies unauthorized configuration changes"
  },
  {
    "id": "supply-chain-levels",
    "category": "security",
    "pattern": "FROM.*:",
    "recommendation": "Implement SLSA (Supply chain Levels for Software Artifacts) framework",
    "example": "# SLSA Level 3 requirements:\n# - Hardened build platform\n# - Non-falsifiable provenance\n# - Isolated builds",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "framework",
      "scan-image",
      "security",
      "slsa",
      "supply-chain"
    ],
    "description": "SLSA framework provides supply chain security maturity levels"
  },
  {
    "id": "vulnerability-database",
    "category": "security",
    "pattern": "FROM.*:",
    "recommendation": "Maintain internal vulnerability database and exemptions",
    "example": "# Track accepted risks\n# Document false positives\n# Maintain vulnerability remediation SLAs",
    "severity": "medium",
    "tags": [
      "database",
      "fix-dockerfile",
      "scan-image",
      "security",
      "tracking",
      "vulnerabilities"
    ],
    "description": "Vulnerability tracking enables risk management and compliance"
  },
  {
    "id": "zero-trust-networking",
    "category": "security",
    "pattern": "kind: NetworkPolicy",
    "recommendation": "Implement zero-trust networking with service mesh",
    "example": "# Istio/Linkerd for mTLS\n# Explicit allow policies only\n# Encrypt all pod-to-pod communication",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "networking",
      "scan-image",
      "security",
      "service-mesh",
      "zero-trust"
    ],
    "description": "Zero-trust networking assumes no implicit trust between services"
  }
]