dash 4.0.8 → 4.1.1

data/lib/dash/dockerfile/parser.rb

@@ -0,0 +1,199 @@
+# Turns Dockerfile text into instructions and stages.
+#
+# Line-oriented, because that is how BuildKit reads it: a physical line is joined to the
+# next while it ends in the escape character, comment lines in between are dropped, and a
+# heredoc redirection pulls the following lines in verbatim until its delimiter.
+#
+# It is deliberately forgiving. Advice is a courtesy printed next to a deploy, so a file
+# this parser cannot make sense of must produce fewer findings, never an exception — the
+# authority on whether a Dockerfile builds is BuildKit, not this.
+class Dash::Dockerfile::Parser
+  DIRECTIVE = /\A#\s*(?<name>syntax|escape)\s*=\s*(?<value>\S+)\s*\z/i
+  COMMENT = /\A\s*#/
+  BLANK = /\A\s*\z/
+  INSTRUCTION = /\A\s*(?<name>[A-Za-z]+)(?:\s+(?<rest>.*))?\z/m
+  FLAG = /\A--(?<key>[a-zA-Z][\w-]*)=(?<value>(?:"[^"]*"|'[^']*'|\S)*)\s*/
+  # `<<EOF`, `<<-EOF`, `<<"EOF"`, `<<'EOF'` — the quoted forms only change how BuildKit
+  # expands the body, not where it ends.
+  HEREDOC = /<<-?\s*(?<quote>["']?)(?<delimiter>[A-Za-z_]\w*)\k<quote>/
+  STAGE_NAME = /\A(?<base>\S+)(?:\s+AS\s+(?<name>\S+))?\z/i
+
+  def self.parse(text)
+    new(text).parse
+  end
+
+  def initialize(text)
+    @lines = text.to_s.lines.map(&:chomp)
+  end
+
+  def parse
+    directives = parse_directives
+    escape = directives["escape"] == "`" ? "`" : "\\"
+
+    instructions = parse_instructions(escape)
+    stages = build_stages(instructions)
+
+    Dash::Dockerfile::Document.new(instructions: instructions, stages: stages, directives: directives)
+  end
+
+  private
+    attr_reader :lines
+
+    # Only the comment block at the very top can carry directives; after the first
+    # instruction a `# syntax=` line is an ordinary comment.
+    def parse_directives
+      directives = {}
+
+      lines.each do |line|
+        break unless line.match?(COMMENT) || line.match?(BLANK)
+        next unless (match = line.match(DIRECTIVE))
+
+        directives[match[:name].downcase] = match[:value]
+      end
+
+      directives
+    end
+
+    def parse_instructions(escape)
+      instructions = []
+      index = 0
+
+      while index < lines.size
+        line = lines[index]
+
+        if line.match?(BLANK) || line.match?(COMMENT)
+          index += 1
+          next
+        end
+
+        started_at = index
+        text, index = join_continuations(index, escape)
+        text, index = append_heredocs(text, index)
+
+        instruction = build_instruction(text, started_at + 1)
+        instructions << instruction if instruction
+      end
+
+      instructions
+    end
+
+    # Joins physical lines while each ends in the escape character. Comment lines between
+    # them are BuildKit's own convention for annotating a long RUN, and are not part of
+    # the command.
+    def join_continuations(index, escape)
+      parts = []
+
+      while index < lines.size
+        line = lines[index]
+        index += 1
+
+        next if line.match?(COMMENT) && parts.any?
+
+        continues = line.rstrip.end_with?(escape)
+        parts << (continues ? line.rstrip.delete_suffix(escape) : line)
+        break unless continues
+      end
+
+      [ parts.map(&:strip).reject(&:empty?).join(" "), index ]
+    end
+
+    # Every heredoc opened on the instruction line consumes lines until its delimiter, in
+    # the order they were opened. The bodies are appended to the arguments so rules can
+    # match what the instruction actually runs.
+    #
+    # A delimiter that never arrives means this was not a heredoc after all (`'<<EOF'` as
+    # a quoted shell word, or a typo): nothing is consumed, so the rest of the file is
+    # still parsed rather than folded into this one instruction.
+    def append_heredocs(text, index)
+      delimiters = text.scan(HEREDOC).map(&:last)
+      return [ text, index ] if delimiters.empty?
+
+      body = []
+      at = index
+
+      delimiters.each do |delimiter|
+        terminator = (at...lines.size).find { |line| lines[line].strip == delimiter }
+        return [ text, index ] unless terminator
+
+        body.concat heredoc_commands(lines[at...terminator])
+        at = terminator + 1
+      end
+
+      # Line breaks are kept: in a RUN heredoc each line is its own shell command, and the
+      # apt rules need to know where one ends.
+      [ [ text, *body ].join("\n"), at ]
+    end
+
+    # Inside the body the shell's own continuation applies: a line ending in `\` is the
+    # same command as the next one.
+    def heredoc_commands(body)
+      body.map(&:strip).each_with_object([]) do |line, commands|
+        if commands.last&.end_with?("\\")
+          commands[-1] = "#{commands.last.delete_suffix("\\").rstrip} #{line}"
+        else
+          commands << line
+        end
+      end
+    end
+
+    def build_instruction(text, line)
+      match = text.match(INSTRUCTION)
+      return unless match
+
+      flags, args = extract_flags(match[:rest].to_s.strip)
+
+      Dash::Dockerfile::Instruction.new(name: match[:name].upcase, args: args, flags: flags, line: line)
+    end
+
+    def extract_flags(rest)
+      flags = {}
+
+      while (match = rest.match(FLAG))
+        (flags[match[:key]] ||= []) << match[:value].delete_prefix('"').delete_suffix('"')
+        rest = match.post_match.lstrip
+      end
+
+      [ flags, rest ]
+    end
+
+    def build_stages(instructions)
+      stages = []
+
+      instructions.each do |instruction|
+        if instruction.name == "FROM"
+          stages << new_stage(instruction, stages.size)
+        elsif (stage = stages.last)
+          stage.instructions << instruction
+        end
+
+        instruction.stage = stages.last unless stages.empty? && instruction.name != "FROM"
+      end
+
+      mark_shipped stages
+      stages
+    end
+
+    def new_stage(instruction, index)
+      match = instruction.args.match(STAGE_NAME)
+
+      Dash::Dockerfile::Stage.new \
+        name: match && match[:name] || "stage-#{index}",
+        named: !(match && match[:name]).nil?,
+        index: index,
+        base: (match ? match[:base] : instruction.args),
+        from: instruction
+    end
+
+    # Walk back from the final stage through the bases it inherits. A stage reached only
+    # by `COPY --from=` is not on that chain, which is the point. Only an explicit `AS`
+    # name can be inherited from; the generated `stage-N` labels are dash's, not BuildKit's.
+    def mark_shipped(stages)
+      by_name = stages.select(&:named?).to_h { |stage| [ stage.name, stage ] }
+      stage = stages.last
+
+      while stage && !stage.shipped?
+        stage.shipped = true
+        stage = by_name[stage.base]
+      end
+    end
+end

data/lib/dash/dockerfile/rules/apt_hygiene.rb

@@ -0,0 +1,35 @@
+# apt's recommended packages and its package lists both ship in the layer unless the same
+# RUN gets rid of them. Only worth saying about a stage that ends up in the image.
+class Dash::Dockerfile::Rules::AptHygiene < Dash::Dockerfile::Rules::Base
+  NO_RECOMMENDS = /--no-install-recommends/
+  LIST_CLEANUP = %r{rm\s+-rf\s+/var/lib/apt/lists}
+  APT_OPERATION = /\bapt-get\s+#{Dash::Dockerfile::Context::APT_OPTIONS.source}(?:update|install|upgrade)\b/
+  # One shell command at a time: a later, compliant install must not vouch for an
+  # earlier one, and a cleanup only counts after the last thing that refilled the lists.
+  # A heredoc body keeps its line breaks, so each of its lines is a command too.
+  SEGMENT = /&&|\|\||;|\n/
+  SUGGESTION = "add --no-install-recommends to every install and rm -rf /var/lib/apt/lists/* at the end of the same RUN"
+
+  def findings
+    document.shipped_stages.flat_map { |stage| stage.instructions }.filter_map do |instruction|
+      next unless context.apt_install?(instruction)
+
+      problems = problems_in(instruction.shell_command.split(SEGMENT))
+      next if problems.empty?
+
+      note at(instruction), "apt-get install #{problems.join(" and ")}", SUGGESTION
+    end
+  end
+
+  private
+    def problems_in(segments)
+      installs = segments.select { |segment| segment.match?(Dash::Dockerfile::Context::APT_INSTALL.first) }
+      last_apt = segments.rindex { |segment| segment.match?(APT_OPERATION) } or return []
+      cleaned = segments.drop(last_apt + 1).any? { |segment| segment.match?(LIST_CLEANUP) }
+
+      problems = []
+      problems << "installs recommended packages" if installs.any? { |segment| !segment.match?(NO_RECOMMENDS) }
+      problems << "leaves /var/lib/apt/lists in the layer" unless cleaned
+      problems
+    end
+end

data/lib/dash/dockerfile/rules/base.rb

@@ -0,0 +1,44 @@
+require "active_support/core_ext/module/delegation"
+require "active_support/core_ext/string/inflections"
+
+# A rule looks at the analysis context and returns findings. Nothing else: no IO, no
+# state, no ordering assumptions about the other rules.
+#
+# The id is derived from the class name and is a public string — operators put it in
+# `report: ignore:`, so renaming a rule class renames a config value.
+class Dash::Dockerfile::Rules::Base
+  attr_reader :context
+  delegate :document, :build, :builder, :context_dir, :dockerignore, to: :context
+
+  class << self
+    def id
+      @id ||= name.demodulize.underscore.dasherize
+    end
+  end
+
+  def initialize(context)
+    @context = context
+  end
+
+  def findings
+    []
+  end
+
+  private
+    def warning(location, message, suggestion = nil)
+      finding :warn, location, message, suggestion
+    end
+
+    def note(location, message, suggestion = nil)
+      finding :info, location, message, suggestion
+    end
+
+    def finding(severity, location, message, suggestion)
+      Dash::Dockerfile::Finding.new \
+        rule: self.class.id, severity: severity, location: location, message: message, suggestion: suggestion
+    end
+
+    def at(instruction)
+      context.location_for(instruction)
+    end
+end

data/lib/dash/dockerfile/rules/cache_busting_arg.rb

@@ -0,0 +1,40 @@
+# An ARG that changes on every commit — a git SHA, a build timestamp — invalidates every
+# layer from its first use onwards. Referenced after the dependency install it costs
+# nothing; referenced before it, it costs the whole install.
+class Dash::Dockerfile::Rules::CacheBustingArg < Dash::Dockerfile::Rules::Base
+  CACHE_BUSTING = /\A(?:.*_)?(?:GIT_SHA|COMMIT|SHA|BUILD_DATE|BUILD_TIME|BUILDTIME|VERSION)\z/i
+  # RUBY_VERSION, NODE_VERSION and friends name a toolchain and change once a quarter.
+  TOOLCHAIN = /_VERSION\z/i
+  SUGGESTION = "reference it after the dependency install, so a new commit does not invalidate it"
+
+  def findings
+    document.each_instruction("ARG").filter_map { |arg| finding_for(arg) }
+  end
+
+  private
+    def finding_for(arg)
+      name = arg.args.split("=").first.to_s
+      return unless name.match?(CACHE_BUSTING) && !name.match?(TOOLCHAIN)
+
+      stage = arg.stage || document.stages.first or return
+      barrier = last_install_line(stage) or return
+      reference = reference_before(name, arg.line, barrier)
+      return unless reference
+
+      note at(arg), "ARG #{name} changes on every commit and is referenced on line #{reference.line}, before the dependency install on line #{barrier}", SUGGESTION
+    end
+
+    def last_install_line(stage)
+      stage.instructions.select { |instruction| context.dependency_install?(instruction) }.last&.line
+    end
+
+    # A FROM that uses the ARG is pinning its base with it, which is a different thing
+    # and not something "reference it later" could ever fix.
+    def reference_before(name, from_line, barrier)
+      pattern = /\$(?:\{#{Regexp.escape(name)}\}|#{Regexp.escape(name)}(?!\w))/
+
+      document.instructions.find do |instruction|
+        instruction.name != "FROM" && instruction.line > from_line && instruction.line < barrier && instruction.to_s.match?(pattern)
+      end
+    end
+end

data/lib/dash/dockerfile/rules/cache_export_cost.rb

@@ -0,0 +1,20 @@
+# Measured only: mode=max exports every intermediate layer to the cache. On a persistent
+# builder that is often pure overhead — but only the numbers from this build can say so.
+class Dash::Dockerfile::Rules::CacheExportCost < Dash::Dockerfile::Rules::Base
+  SHARE = 0.2
+  SUGGESTION = "try mode=min under builder: cache: options:"
+
+  def findings
+    return [] unless build && mode_max?
+
+    exported, total = build.cache_export_seconds, build.total_step_seconds
+    return [] if total.zero? || exported <= total * SHARE
+
+    [ note("builder.cache", format("exporting the build cache took %.1fs of %.1fs with mode=max", exported, total), SUGGESTION) ]
+  end
+
+  private
+    def mode_max?
+      builder&.cache_to.to_s.split(",").map(&:strip).include?("mode=max")
+    end
+end

data/lib/dash/dockerfile/rules/context_size.rb

@@ -0,0 +1,20 @@
+# Measured only: how many megabytes this build actually shipped to the builder before it
+# ran a single instruction.
+class Dash::Dockerfile::Rules::ContextSize < Dash::Dockerfile::Rules::Base
+  THRESHOLD_BYTES = 50_000_000
+  SUGGESTION = "trim the build context with .dockerignore, or point builder: context: at a smaller directory"
+
+  def findings
+    bytes = build&.context_bytes
+    return [] if bytes.to_i <= THRESHOLD_BYTES
+
+    [ warning("build context", "the build shipped #{Dash::Utils.human_bytes(bytes)}#{elapsed} of build context to the builder", SUGGESTION) ]
+  end
+
+  private
+    # A build killed mid-transfer has a size but no duration; "in 0.0s" would be a
+    # measurement nobody took.
+    def elapsed
+      format(" in %.1fs", build.context_seconds) if build.context_seconds
+    end
+end

data/lib/dash/dockerfile/rules/copy_before_install.rb

@@ -0,0 +1,34 @@
+# The single most expensive Dockerfile mistake: copying the whole tree before installing
+# dependencies, so every commit — a README typo included — reinstalls them.
+class Dash::Dockerfile::Rules::CopyBeforeInstall < Dash::Dockerfile::Rules::Base
+  SUGGESTION = "copy the dependency manifests first (Gemfile, package.json, lockfiles), install, then copy the rest of the tree"
+
+  def findings
+    document.stages.filter_map { |stage| finding_for(stage) }
+  end
+
+  private
+    def finding_for(stage)
+      copy = stage.instructions.find { |instruction| context.broad_copy?(instruction) } or return
+      install = stage.instructions.find do |instruction|
+        instruction.line > copy.line && context.dependency_install?(instruction)
+      end
+      return unless install
+
+      warning at(copy), message(copy, install), SUGGESTION
+    end
+
+    def message(copy, install)
+      [ "#{copy.name} #{copy.args} runs before `#{context.install_command(install)}` (line #{install.line}), ",
+        "so dependencies reinstall on every commit", measured(install) ].compact.join
+    end
+
+    # Only when the build that just ran proves it: a cached install step costs nothing,
+    # and advice that names a number nobody measured is worse than advice that doesn't.
+    def measured(install)
+      step = context.build_step_for(install)
+      return if step.nil? || step.cached || step.seconds.to_f.zero?
+
+      format(" (measured %.1fs uncached)", step.seconds)
+    end
+end

data/lib/dash/dockerfile/rules/curl_pipe_shell.rb

@@ -0,0 +1,16 @@
+# Piping a download straight into a shell runs whatever the server sends today, and there
+# is no version in the Dockerfile to say what that was.
+class Dash::Dockerfile::Rules::CurlPipeShell < Dash::Dockerfile::Rules::Base
+  # `sudo` may carry flags with or without arguments (`-E`, `-u root`) before the shell.
+  SHELL = /(?:sudo\s+(?:-\S+(?:\s+[^-\s]\S*)?\s+)*)?(?:ba|z|k)?sh\b/
+  PIPE_TO_SHELL = /\b(?:curl|wget)\b[^|]*\|\s*#{SHELL.source}|#{SHELL.source}\s+<\(\s*(?:curl|wget)\b/
+  SUGGESTION = "download to a file, verify a checksum, then run it — and pin the version"
+
+  def findings
+    document.instructions.filter_map do |instruction|
+      next unless instruction.name == "RUN" && instruction.shell_command.match?(PIPE_TO_SHELL)
+
+      note at(instruction), "a download is piped straight into a shell, so the build runs unverified code", SUGGESTION
+    end
+  end
+end

data/lib/dash/dockerfile/rules/dockerignore_gaps.rb

@@ -0,0 +1,36 @@
+# A .dockerignore that misses the obvious offenders. .git is always worth naming; the
+# rest only when the directory actually exists in the context.
+class Dash::Dockerfile::Rules::DockerignoreGaps < Dash::Dockerfile::Rules::Base
+  ALWAYS = ".git".freeze
+  WHEN_PRESENT = %w[ node_modules tmp storage coverage log .env* ].freeze
+  SUGGESTION = "add them to .dockerignore so they are not sent to the builder"
+
+  def findings
+    return [] if dockerignore.nil?
+    return [] if (gaps = gaps()).empty?
+
+    [ finding(severity, Dash::Dockerfile::Dockerignore::FILENAME, message(gaps), SUGGESTION) ]
+  end
+
+  private
+    def gaps
+      candidates = [ ALWAYS, *WHEN_PRESENT.flat_map { |name| context.context_entries(name) } ]
+      candidates.uniq.reject { |name| dockerignore.covers?(name) }
+    end
+
+    # A context big enough to be worth seconds of every build turns the same gap from a
+    # tidiness note into something that is costing the operator time.
+    def severity
+      big_context? ? :warn : :info
+    end
+
+    def message(gaps)
+      measured = " — the measured build context was #{Dash::Utils.human_bytes(build.context_bytes)}" if big_context?
+
+      "the build context ships #{gaps.join(", ")}#{measured}"
+    end
+
+    def big_context?
+      build&.context_bytes.to_i > Dash::Dockerfile::Rules::ContextSize::THRESHOLD_BYTES
+    end
+end

data/lib/dash/dockerfile/rules/inline_env_blob.rb

@@ -0,0 +1,23 @@
+# A wall of inline assignments in front of a command means editing any one value
+# invalidates the layer — and makes the instruction unreadable in the bargain.
+class Dash::Dockerfile::Rules::InlineEnvBlob < Dash::Dockerfile::Rules::Base
+  ASSIGNMENT = /\A[A-Za-z_]\w*=(?:"[^"]*"|'[^']*'|\\.|\S)*\s+/
+  THRESHOLD = 20
+  SUGGESTION = "read them from an env file at runtime, or set the build-time ones in one ENV block, so the command line stops changing"
+
+  def findings
+    document.instructions.filter_map do |instruction|
+      next unless instruction.name == "RUN"
+      next unless (count = leading_assignments(instruction.shell_command.dup)) > THRESHOLD
+
+      note at(instruction), "#{count} inline environment assignments precede the command", SUGGESTION
+    end
+  end
+
+  private
+    def leading_assignments(command)
+      count = 0
+      count += 1 while command.sub!(ASSIGNMENT, "")
+      count
+    end
+end

data/lib/dash/dockerfile/rules/latest_base.rb

@@ -0,0 +1,24 @@
+# An unpinned base image makes a build unreproducible: the same Dockerfile builds a
+# different image tomorrow, and nothing in the deploy says so.
+class Dash::Dockerfile::Rules::LatestBase < Dash::Dockerfile::Rules::Base
+  SUGGESTION = "pin a specific tag, or a digest for a build that must be reproducible"
+
+  def findings
+    document.stages.filter_map { |stage| finding_for(stage) }
+  end
+
+  private
+    def finding_for(stage)
+      return if built_on_another_stage?(stage) || stage.scratch? || stage.digest || stage.interpolated_tag?
+
+      if stage.tag.nil?
+        warning at(stage.instructions.first), "FROM #{stage.base} has no tag, so it resolves to :latest", SUGGESTION
+      elsif stage.tag == "latest"
+        warning at(stage.instructions.first), "FROM #{stage.base} is not pinned; the base image can change between builds", SUGGESTION
+      end
+    end
+
+    def built_on_another_stage?(stage)
+      document.stages.any? { |other| other.named? && other.name == stage.base }
+    end
+end

data/lib/dash/dockerfile/rules/missing_dockerignore.rb

@@ -0,0 +1,11 @@
+# No .dockerignore means the whole working tree is shipped to the builder: .git, test
+# artifacts, node_modules, and whatever else happens to be lying around.
+class Dash::Dockerfile::Rules::MissingDockerignore < Dash::Dockerfile::Rules::Base
+  SUGGESTION = "add a .dockerignore covering .git and any build or dependency directories"
+
+  def findings
+    return [] if context_dir.nil? || dockerignore
+
+    [ warning(Dash::Dockerfile::Dockerignore::FILENAME, "the build context has no .dockerignore, so everything in it is sent to the builder", SUGGESTION) ]
+  end
+end

data/lib/dash/dockerfile/rules/no_cache_mount.rb

@@ -0,0 +1,26 @@
+# Without a cache mount, an install that misses the layer cache downloads every package
+# again. With one, it reuses whatever the last build left behind.
+class Dash::Dockerfile::Rules::NoCacheMount < Dash::Dockerfile::Rules::Base
+  def findings
+    document.instructions.filter_map do |instruction|
+      next unless installs?(instruction)
+      next if Array(instruction.flags["mount"]).any? { |mount| mount.include?("type=cache") }
+
+      note at(instruction), "#{command_for(instruction)} runs without a cache mount, so a cache miss downloads everything again",
+        "add --mount=type=cache,target=#{target_for(instruction)}"
+    end
+  end
+
+  private
+    def installs?(instruction)
+      context.dependency_install?(instruction) || context.apt_install?(instruction)
+    end
+
+    def command_for(instruction)
+      context.install_command(instruction) || "apt-get install"
+    end
+
+    def target_for(instruction)
+      context.install_cache_target(instruction) || Dash::Dockerfile::Context::APT_INSTALL.last
+    end
+end

data/lib/dash/dockerfile/rules/root_user.rb

@@ -0,0 +1,12 @@
+# A final stage that sets no USER runs as whatever its base image left it as — root, for
+# nearly every official image — and so does anything that gets a shell in it.
+class Dash::Dockerfile::Rules::RootUser < Dash::Dockerfile::Rules::Base
+  SUGGESTION = "create a non-root user and add a USER line before the entrypoint, unless the base image already switched"
+
+  def findings
+    stage = document.final_stage or return []
+    return [] if stage.instructions.any? { |instruction| instruction.name == "USER" }
+
+    [ note(at(stage.instructions.first), "the final stage sets no USER, so the container runs as whatever the base image does — usually root", SUGGESTION) ]
+  end
+end

data/lib/dash/dockerfile/rules/secret_in_build_arg.rb

@@ -0,0 +1,30 @@
+# Build args and ENV values are readable in the image history forever. A secret that has
+# to be present at build time belongs in a mount that leaves no layer behind.
+class Dash::Dockerfile::Rules::SecretInBuildArg < Dash::Dockerfile::Rules::Base
+  SECRETISH = /(PASSWORD|SECRET|TOKEN|_KEY)\b/i
+  # Rails' own placeholder: it exists precisely so no real key is needed at build time.
+  ALLOWED = %w[ SECRET_KEY_BASE_DUMMY ].freeze
+  SUGGESTION = "pass it with --mount=type=secret and list it under builder: secrets: in deploy.yml"
+
+  def findings
+    document.instructions.flat_map do |instruction|
+      next [] unless %w[ ARG ENV ].include?(instruction.name)
+
+      names(instruction).filter_map do |name|
+        next if ALLOWED.include?(name) || !name.match?(SECRETISH)
+
+        warning at(instruction), "#{instruction.name} #{name} bakes a secret into the image history", SUGGESTION
+      end
+    end
+  end
+
+  private
+    # `ENV KEY value` (legacy form) declares exactly one name, whatever the value holds;
+    # `ENV A=1 B=2` and `ARG NAME[=default]` declare one per assignment.
+    def names(instruction)
+      first = instruction.args.split(/\s+/).first.to_s
+      return [ first ] unless first.include?("=")
+
+      instruction.args.scan(/(?:\A|\s)([A-Za-z_]\w*)=/).flatten
+    end
+end

data/lib/dash/dockerfile/rules/single_stage_build_deps.rb

@@ -0,0 +1,19 @@
+# Compilers and header packages installed in the only stage ship to production: a bigger
+# image, a bigger attack surface, and nothing gained once the gems are built.
+class Dash::Dockerfile::Rules::SingleStageBuildDeps < Dash::Dockerfile::Rules::Base
+  # A lookahead for whitespace or a shell separator rather than `\b`: `+` is not a word
+  # character, so `g++\b` never matches.
+  BUILD_PACKAGES = /\b(build-essential|gcc|g\+\+|make|[\w.+-]+-dev)(?=[\s;&|)]|$)/
+  SUGGESTION = "split into a build stage and a runtime stage, and COPY --from the build output"
+
+  def findings
+    return [] unless document.stages.one?
+
+    document.stages.first.instructions.filter_map do |instruction|
+      next unless instruction.name == "RUN"
+      next unless (packages = instruction.shell_command.scan(BUILD_PACKAGES).map(&:first)).any?
+
+      warning at(instruction), "the only stage installs build tooling (#{packages.uniq.join(", ")}), which ships in the image", SUGGESTION
+    end
+  end
+end

data/lib/dash/dockerfile/rules/uncached_install.rb

@@ -0,0 +1,20 @@
+# Measured only: a dependency install that missed the cache and cost real time, where no
+# broad copy above it explains why. Something else invalidated the layer, and the operator
+# is the only one who can say what.
+class Dash::Dockerfile::Rules::UncachedInstall < Dash::Dockerfile::Rules::Base
+  THRESHOLD_SECONDS = 10
+  SUGGESTION = "check what changed above it — a COPY, an ARG, or a base image that moved"
+
+  def findings
+    return [] unless build
+
+    document.instructions.filter_map do |instruction|
+      next unless context.dependency_install?(instruction) && !context.busted_by_broad_copy?(instruction)
+
+      step = context.build_step_for(instruction)
+      next if step.nil? || step.cached || step.seconds.to_f <= THRESHOLD_SECONDS
+
+      note at(instruction), format("`%s` ran %.1fs uncached", context.install_command(instruction), step.seconds), SUGGESTION
+    end
+  end
+end