Paste a Dockerfile. Get a plain-English explanation of every instruction, warnings for risky ones, and a diagram of its stages and layers. Parsed in your browser — nothing is uploaded.
Copies . from your build context to . in the image.
Copying the whole context includes .git, local .env files and anything else in the directory unless a .dockerignore excludes it. We can't see your .dockerignore here.
Safer: Add a .dockerignore (an allow-list is safest: exclude everything, then add back what the image needs) or copy only the paths you need.
Starts from the base image gcr.io/distroless/static, tag nonroot.
Without one, Docker and Compose can't tell a running container from a working one, and depends_on with service_healthy has nothing to wait for. Kubernetes ignores HEALTHCHECK and uses its own probes.
Safer: Add a HEALTHCHECK with an interval, timeout and retries, or define liveness and readiness probes in Kubernetes.
Sets the program that runs when the container starts to /app. Arguments from CMD or docker run are appended to it.
In short: paste a Dockerfile and this page explains each instruction using your real values, flags common security mistakes such as running as root and secrets baked into the image, and shows the stages and layers. It is a checklist of common mistakes, not a full audit, and it runs entirely in your browser.
What each Dockerfile instruction does
A Dockerfile is a recipe for building an image, one instruction at a time. The ones you will see most:
FROM: starts a stage from a base image. Several FROM lines make a multi-stage build, where later stages copy only what they need from earlier ones.
RUN: executes a command at build time. Each RUN adds a layer, so chaining related commands keeps images smaller.
COPY and ADD: bring files into the image. COPY is plain copying; ADD can also fetch URLs and unpack archives, which is why COPY is usually preferred.
ENV and ARG: ENV sets variables that persist in the image and at run time; ARG exists only during the build, but its value can still be recovered from image history.
USER: the account later instructions and the container run as. Without it, that is root.
EXPOSE, CMD and ENTRYPOINT: EXPOSE documents a port without publishing it; CMD and ENTRYPOINT define what runs when the container starts.
Common Dockerfile security mistakes
These are the issues the explainer warns about most often, with the safer alternative for each:
No USER instruction means the container runs as root. Create an unprivileged user and switch to it before CMD.
Secrets in ENV or ARG are stored in the image layers and history. Use build secrets (RUN --mount=type=secret) instead, and rotate anything that was already baked in.
Unpinned or :latest base images make builds unrepeatable. Pin a version, or a digest for production.
ADD from a remote URL downloads unchecked content. Use COPY, or download with RUN and verify a checksum.
Piping a download into a shell (curl | sh) runs whatever the server returns. Download, verify, then run.
A single stage that ships compilers and build tools enlarges the attack surface. Use a multi-stage build and copy only the artifacts into a slim final image.
Every check this tool makes
Each check has its own page: what it means, a risky and a safer example, and how to fix it.
No. The file is parsed and analysed in your browser with JavaScript. Nothing is sent to a server, and there is no AI call in this tool. Secret values such as passwords and tokens are masked in the output.
Does it support multi-stage builds?
Yes. Each FROM starts a stage, and the explainer shows the stages, the layers each one adds and which stage COPY --from reads from.
Does it build the image or pull base images?
No. It only reads the text you paste. It never builds, runs or pulls anything and never contacts a Docker daemon or registry.
What do the warnings mean, and are they complete?
Warnings come from a checklist of common Dockerfile mistakes, such as running as root, unpinned or :latest base images, secrets in ENV or ARG, ADD from remote URLs and piping downloads into a shell. It is a quick checklist, not a full audit. To review your whole repository — code, secrets and infrastructure config — run a full OpenRouting scan.
What happens with an instruction it does not know?
It says so. Instructions that are not in the built-in reference are shown as "Not in our reference yet" rather than guessed at.
Does it resolve ARG values or .env files?
No. It analyses the single file you paste and shows ${VAR} and ARG references as written. It does not read build arguments, .env files or .dockerignore.