[
  {
    "id": "dockerfile-header-comment",
    "category": "dockerfile",
    "pattern": "FROM",
    "recommendation": "Always start Dockerfiles with a header comment indicating AI generation. Specify that the Dockerfile was generated by Containerization Assist using AI.",
    "example": "# ------------------------------------------------------------------------------\n# This Dockerfile was generated by Containerization Assist using AI.\n# Review carefully for accuracy, security, and compliance before deploying.\n# ------------------------------------------------------------------------------\n\nFROM node:20-alpine",
    "severity": "required",
    "tags": [
      "ai-generated",
      "documentation",
      "fix-dockerfile",
      "generate-dockerfile",
      "header"
    ],
    "description": "Header comment provides transparency about AI generation and reminds users to review"
  },
  {
    "id": "k8s-header-comment",
    "category": "kubernetes",
    "pattern": "apiVersion:",
    "recommendation": "Always start Kubernetes manifests with a header comment indicating AI generation. Specify that the manifest was generated by Containerization Assist using AI.",
    "example": "# ------------------------------------------------------------------------------\n# This manifest was generated by Containerization Assist using AI.\n# Review carefully for accuracy, security, and compliance before deploying.\n# ------------------------------------------------------------------------------\n\napiVersion: apps/v1\nkind: Deployment",
    "severity": "required",
    "tags": [
      "documentation",
      "header",
      "ai-generated",
      "generate-k8s-manifests"
    ],
    "description": "Header comment provides transparency about AI generation and reminds users to review"
  },
  {
    "id": "node-alpine-prod",
    "category": "dockerfile",
    "pattern": "node:(?!.*alpine)",
    "recommendation": "Use node:lts-alpine for production to reduce image size by ~80%",
    "example": "FROM node:20-alpine AS build\nWORKDIR /app\nCOPY package*.json ./\nRUN npm ci --only=production",
    "severity": "high",
    "tags": [
      "alpine",
      "fix-dockerfile",
      "generate-dockerfile",
      "node",
      "npm-ci",
      "production"
    ],
    "description": "Alpine-based Node.js images are significantly smaller and more secure"
  },
  {
    "id": "python-slim-prod",
    "category": "dockerfile",
    "pattern": "python:(?!.*slim|.*alpine)",
    "recommendation": "Use python:3.11-slim for production to reduce image size and attack surface",
    "example": "FROM python:3.11-slim\nRUN apt-get update && apt-get install -y --no-install-recommends gcc && rm -rf /var/lib/apt/lists/*",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "production",
      "python",
      "slim"
    ],
    "description": "Slim Python images exclude unnecessary packages while maintaining compatibility"
  },
  {
    "id": "multistage-build",
    "category": "dockerfile",
    "pattern": "FROM.*AS.*build",
    "recommendation": "Excellent use of multi-stage builds to minimize final image size",
    "example": "FROM node:20-alpine AS build\n# build steps\nFROM node:20-alpine AS runtime\nCOPY --from=build /app/dist ./dist",
    "severity": "medium",
    "tags": [
      "build-stage",
      "fix-dockerfile",
      "generate-dockerfile",
      "multistage",
      "optimization",
      "runtime-stage",
      "size"
    ],
    "description": "Multi-stage builds separate build dependencies from runtime"
  },
  {
    "id": "dockerfile-user-root",
    "category": "security",
    "pattern": "USER\\s+(root|0)\\s*$",
    "recommendation": "Avoid running containers as root user - create and use a dedicated user",
    "example": "RUN groupadd -r appuser && useradd -r -g appuser appuser\nUSER appuser",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "root",
      "scan-image",
      "security",
      "user"
    ],
    "description": "Running as root increases security risk if container is compromised"
  },
  {
    "id": "dockerfile-no-user",
    "category": "security",
    "pattern": "^(?!.*USER)",
    "recommendation": "Add USER instruction to run container as non-root user",
    "example": "RUN addgroup -g 1001 -S nodejs && adduser -S nodejs -u 1001\nUSER nodejs",
    "severity": "high",
    "tags": [
      "fix-dockerfile",
      "scan-image",
      "security",
      "user"
    ],
    "description": "Containers without USER instruction run as root by default"
  },
  {
    "id": "dockerfile-healthcheck",
    "category": "dockerfile",
    "pattern": "^(?!.*HEALTHCHECK)",
    "recommendation": "Add HEALTHCHECK instruction for better container monitoring",
    "example": "HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \\\n  CMD curl -f http://localhost:3000/health || exit 1",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "healthcheck",
      "monitoring"
    ],
    "description": "Health checks enable automatic container restart and load balancer integration"
  },
  {
    "id": "copy-package-json-first",
    "category": "dockerfile",
    "pattern": "COPY\\s+\\.\\s+",
    "recommendation": "Copy package.json first, then run npm install, then copy source code for better layer caching",
    "example": "COPY package*.json ./\nRUN npm ci --only=production\nCOPY . .",
    "severity": "medium",
    "tags": [
      "caching",
      "fix-dockerfile",
      "generate-dockerfile",
      "node",
      "npm-ci",
      "optimization"
    ],
    "description": "Copying package.json first improves Docker layer caching efficiency"
  },
  {
    "id": "apt-cleanup",
    "category": "dockerfile",
    "pattern": "apt-get\\s+install.*(?!rm\\s+-rf\\s+/var/lib/apt/lists/)",
    "recommendation": "Clean apt cache after installation to reduce image size",
    "example": "RUN apt-get update && apt-get install -y package-name && rm -rf /var/lib/apt/lists/*",
    "severity": "medium",
    "tags": [
      "apt",
      "fix-dockerfile",
      "generate-dockerfile",
      "optimization",
      "size"
    ],
    "description": "Apt cache can add hundreds of MB to image size"
  },
  {
    "id": "java-alpine",
    "category": "dockerfile",
    "pattern": "openjdk:(?!.*alpine)",
    "recommendation": "Use openjdk:17-alpine for smaller Java images",
    "example": "FROM openjdk:17-alpine\nRUN apk add --no-cache bash",
    "severity": "medium",
    "tags": [
      "alpine",
      "fix-dockerfile",
      "generate-dockerfile",
      "java",
      "openjdk"
    ],
    "description": "Alpine-based Java images are significantly smaller than standard images"
  },
  {
    "id": "workdir-best-practice",
    "category": "dockerfile",
    "pattern": "WORKDIR\\s+/(?!app|usr/src/app)",
    "recommendation": "Use conventional working directories like /app or /usr/src/app",
    "example": "WORKDIR /app",
    "severity": "low",
    "tags": [
      "convention",
      "fix-dockerfile",
      "generate-dockerfile",
      "workdir"
    ],
    "description": "Standard working directories improve maintainability"
  },
  {
    "id": "k8s-resources",
    "category": "kubernetes",
    "pattern": "kind:\\s*Deployment",
    "recommendation": "Always set resource requests and limits for predictable performance",
    "example": "resources:\n  requests:\n    memory: \"256Mi\"\n    cpu: \"250m\"\n  limits:\n    memory: \"512Mi\"\n    cpu: \"500m\"",
    "severity": "high",
    "tags": [
      "generate-k8s-manifests",
      "limits",
      "requests",
      "resources"
    ],
    "description": "Resource limits prevent containers from consuming excessive resources"
  },
  {
    "id": "k8s-probes",
    "category": "kubernetes",
    "pattern": "containers:",
    "recommendation": "Add liveness and readiness probes for better health monitoring",
    "example": "livenessProbe:\n  httpGet:\n    path: /health\n    port: 3000\n  initialDelaySeconds: 30\nreadinessProbe:\n  httpGet:\n    path: /ready\n    port: 3000",
    "severity": "high",
    "tags": [
      "generate-k8s-manifests",
      "health",
      "monitoring",
      "probes",
      "verify-deploy"
    ],
    "description": "Probes enable automatic restart and traffic routing decisions"
  },
  {
    "id": "k8s-labels",
    "category": "kubernetes",
    "pattern": "metadata:",
    "recommendation": "Add consistent labels for better resource management",
    "example": "labels:\n  app: myapp\n  version: v1.0.0\n  environment: production\n  component: backend",
    "severity": "medium",
    "tags": [
      "generate-k8s-manifests",
      "labels",
      "metadata"
    ],
    "description": "Consistent labeling improves observability and resource selection"
  },
  {
    "id": "k8s-namespace",
    "category": "kubernetes",
    "pattern": "^(?!.*namespace:)",
    "recommendation": "Specify namespace for better resource organization",
    "example": "metadata:\n  name: my-app\n  namespace: production",
    "severity": "medium",
    "tags": [
      "generate-k8s-manifests",
      "namespace",
      "organization",
      "prepare-cluster"
    ],
    "description": "Namespaces provide logical separation and resource quotas"
  },
  {
    "id": "k8s-security-context",
    "category": "security",
    "pattern": "containers:",
    "recommendation": "Add security context to run containers as non-root",
    "example": "securityContext:\n  runAsNonRoot: true\n  runAsUser: 1001\n  readOnlyRootFilesystem: true",
    "severity": "high",
    "tags": [
      "context",
      "fix-dockerfile",
      "nonroot",
      "scan-image",
      "security"
    ],
    "description": "Security contexts enforce security policies at the pod level"
  },
  {
    "id": "expose-port",
    "category": "dockerfile",
    "pattern": "EXPOSE",
    "recommendation": "Good practice to document exposed ports",
    "example": "EXPOSE 3000",
    "severity": "low",
    "tags": [
      "documentation",
      "fix-dockerfile",
      "generate-dockerfile",
      "ports"
    ],
    "description": "EXPOSE documents which ports the container listens on"
  },
  {
    "id": "env-vars-security",
    "category": "security",
    "pattern": "ENV.*(?:PASSWORD|SECRET|KEY|TOKEN)",
    "recommendation": "Don't hardcode secrets in ENV instructions - use Kubernetes secrets instead",
    "example": "# Use K8s secrets instead of:\n# ENV DB_PASSWORD=secret123",
    "severity": "high",
    "tags": [
      "aws",
      "environment",
      "fix-dockerfile",
      "scan-image",
      "secrets",
      "security"
    ],
    "description": "Hardcoded secrets in images are a major security risk"
  },
  {
    "id": "docker-ignore",
    "category": "dockerfile",
    "pattern": "COPY\\s+\\.",
    "recommendation": "Create .dockerignore file to exclude unnecessary files from build context",
    "example": "# .dockerignore\nnode_modules\n.git\n*.log\nDockerfile*",
    "severity": "medium",
    "tags": [
      "dockerignore",
      "fix-dockerfile",
      "generate-dockerfile",
      "optimization"
    ],
    "description": ".dockerignore reduces build context size and improves build speed"
  },
  {
    "id": "k8s-image-pull-policy",
    "category": "kubernetes",
    "pattern": "image:",
    "recommendation": "Set appropriate imagePullPolicy (Always for :latest, IfNotPresent for specific tags)",
    "example": "image: myapp:v1.2.3\nimagePullPolicy: IfNotPresent",
    "severity": "medium",
    "tags": [
      "generate-k8s-manifests",
      "images",
      "pull-policy"
    ],
    "description": "Proper pull policy prevents unexpected image updates and improves startup time"
  },
  {
    "id": "node-production-env",
    "category": "dockerfile",
    "pattern": "node:",
    "recommendation": "Set NODE_ENV=production for Node.js applications",
    "example": "ENV NODE_ENV=production",
    "severity": "medium",
    "tags": [
      "environment",
      "fix-dockerfile",
      "generate-dockerfile",
      "node",
      "production"
    ],
    "description": "NODE_ENV=production optimizes Node.js runtime performance"
  },
  {
    "id": "run-combine-commands",
    "category": "dockerfile",
    "pattern": "RUN.*\\n.*RUN",
    "recommendation": "Combine RUN commands to reduce image layers",
    "example": "RUN apt-get update && apt-get install -y package1 package2 && rm -rf /var/lib/apt/lists/*",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "layers",
      "optimization"
    ],
    "description": "Each RUN instruction creates a new layer, increasing image size"
  },
  {
    "id": "k8s-service-type",
    "category": "kubernetes",
    "pattern": "kind:\\s*Service",
    "recommendation": "Choose appropriate service type (ClusterIP for internal, LoadBalancer for external)",
    "example": "spec:\n  type: ClusterIP  # or LoadBalancer for external access\n  ports:\n  - port: 80\n    targetPort: 3000",
    "severity": "medium",
    "tags": [
      "generate-k8s-manifests",
      "networking",
      "prepare-cluster",
      "service"
    ],
    "description": "Service type determines how the service is exposed"
  },
  {
    "id": "go-multistage",
    "category": "dockerfile",
    "pattern": "golang:",
    "recommendation": "Use multi-stage builds for Go applications to reduce final image size dramatically",
    "example": "FROM golang:1.21-alpine AS builder\nWORKDIR /app\nCOPY . .\nRUN go build -o main .\n\nFROM alpine:latest\nRUN apk add --no-cache ca-certificates\nCOPY --from=builder /app/main /main\nENTRYPOINT [\"/main\"]",
    "severity": "high",
    "tags": [
      "build-stage",
      "fix-dockerfile",
      "generate-dockerfile",
      "golang",
      "multistage",
      "optimization"
    ],
    "description": "Go binaries are self-contained and don't need the full Go toolchain at runtime"
  },
  {
    "id": "k8s-deployment-strategy",
    "category": "kubernetes",
    "pattern": "kind:\\s*Deployment",
    "recommendation": "Configure rolling update strategy for zero-downtime deployments",
    "example": "spec:\n  strategy:\n    type: RollingUpdate\n    rollingUpdate:\n      maxUnavailable: 1\n      maxSurge: 1",
    "severity": "medium",
    "tags": [
      "deploy",
      "deployment",
      "generate-k8s-manifests",
      "rolling-update",
      "strategy"
    ],
    "description": "Rolling updates ensure service availability during deployments"
  },
  {
    "id": "distroless-prod",
    "category": "dockerfile",
    "pattern": "FROM.*scratch",
    "recommendation": "Consider using Google's distroless images instead of scratch for better security and debugging",
    "example": "FROM gcr.io/distroless/java:11\nCOPY app.jar /app.jar\nENTRYPOINT [\"java\", \"-jar\", \"/app.jar\"]",
    "severity": "medium",
    "tags": [
      "distroless",
      "fix-dockerfile",
      "generate-dockerfile",
      "google",
      "minimal",
      "security"
    ],
    "description": "Distroless images provide minimal runtime with better debugging capabilities than scratch"
  },
  {
    "id": "k8s-pod-disruption-budget",
    "category": "kubernetes",
    "pattern": "kind:\\s*Deployment",
    "recommendation": "Add PodDisruptionBudget for high-availability applications",
    "example": "apiVersion: policy/v1\nkind: PodDisruptionBudget\nmetadata:\n  name: myapp-pdb\nspec:\n  minAvailable: 2\n  selector:\n    matchLabels:\n      app: myapp",
    "severity": "medium",
    "tags": [
      "availability",
      "disruption",
      "generate-k8s-manifests",
      "pdb"
    ],
    "description": "PDB ensures minimum number of replicas during voluntary disruptions"
  },
  {
    "id": "dockerfile-arg-cache",
    "category": "dockerfile",
    "pattern": "ARG",
    "recommendation": "Place ARG instructions that change frequently towards the end to improve cache efficiency",
    "example": "# Place stable instructions first\nFROM node:alpine\nWORKDIR /app\nCOPY package.json .\nRUN npm install\n# Place changing ARGs later\nARG BUILD_VERSION\nLABEL version=$BUILD_VERSION",
    "severity": "low",
    "tags": [
      "args",
      "caching",
      "fix-dockerfile",
      "generate-dockerfile",
      "optimization"
    ],
    "description": "Changing ARGs invalidate all subsequent cache layers"
  },
  {
    "id": "k8s-resource-quotas",
    "category": "kubernetes",
    "pattern": "namespace:",
    "recommendation": "Consider setting ResourceQuotas for namespaces to limit resource consumption",
    "example": "apiVersion: v1\nkind: ResourceQuota\nmetadata:\n  namespace: production\nspec:\n  hard:\n    requests.cpu: \"4\"\n    requests.memory: 8Gi\n    limits.cpu: \"8\"\n    limits.memory: 16Gi",
    "severity": "medium",
    "tags": [
      "generate-k8s-manifests",
      "limits",
      "namespace",
      "prepare-cluster",
      "quotas"
    ],
    "description": "Resource quotas prevent resource exhaustion at the namespace level"
  },
  {
    "id": "dockerfile-signal-handling",
    "category": "dockerfile",
    "pattern": "CMD.*node",
    "recommendation": "Use proper init system or signal handling for Node.js containers",
    "example": "RUN apk add --no-cache dumb-init\nENTRYPOINT [\"dumb-init\", \"--\"]\nCMD [\"node\", \"server.js\"]",
    "severity": "medium",
    "tags": [
      "fix-dockerfile",
      "generate-dockerfile",
      "init",
      "node",
      "signals"
    ],
    "description": "Proper signal handling ensures graceful shutdowns and zombie process cleanup"
  },
  {
    "id": "minimal-file-creation-dockerfile",
    "category": "dockerfile",
    "pattern": ".*",
    "recommendation": "CRITICAL: Only create Dockerfiles and .dockerignore files. Do NOT create extra files like README.md, docker-compose.yml, or other markdown documentation unless explicitly requested by the user.",
    "example": "# Dockerfile generation: Create only:\n# - Dockerfile\n# - .dockerignore\n",
    "severity": "required",
    "tags": [
      "best-practices",
      "dockerfile",
      "file-creation",
      "fix-dockerfile",
      "generate-dockerfile",
      "minimal",
      "organization"
    ],
    "description": "Minimize file creation to only Dockerfiles."
  },
  {
    "id": "minimal-file-creation-kubernetes",
    "category": "kubernetes",
    "pattern": ".*",
    "recommendation": "CRITICAL: Only create yaml files for kubernetes manifests. Do NOT create extra files like README.md, docker-compose.yml, helm charts or other markdown documentations unless explicitly requested by the user. Generate the manifests in a manifests/ directory with separate files for each resource type (deployment.yaml, service.yaml, configmap.yaml, etc.).",
    "example": "# Kubernetes manifest generation: Create only yaml files in manifests/ directory\n# - manifests/deployment.yaml\n# - manifests/service.yaml\n",
    "severity": "required",
    "tags": [
      "best-practices",
      "deploy",
      "file-creation",
      "generate-k8s-manifests",
      "kubernetes",
      "minimal",
      "organization"
    ],
    "description": "Minimize file creation to only manifest yaml files. Keep manifests organized in separate files within manifests/ directory."
  }
]