@docker-doctor/cli 0.0.0

package/dist/src-IXht-l0J.mjs

@@ -0,0 +1,881 @@
+#!/usr/bin/env node
+import fs from "node:fs/promises";
+import path from "node:path";
+import { parse } from "yaml";
+import * as Data from "effect/Data";
+import * as Schema from "effect/Schema";
+
+//#region package.json
+var package_default = {
+	name: "docker-doctor",
+	version: "0.0.0",
+	description: "Static analysis for Dockerfile and Docker Compose files",
+	keywords: [
+		"best-practices",
+		"diagnostics",
+		"docker",
+		"docker-compose",
+		"dockerfile",
+		"linter",
+		"performance",
+		"security"
+	],
+	homepage: "https://docker-doctor.vercel.app",
+	bugs: { "url": "https://github.com/PunGrumpy/docker-doctor/issues" },
+	license: "MIT",
+	author: {
+		"name": "Noppakorn Kaewsalabnil",
+		"url": "https://www.pungrumpy.com"
+	},
+	repository: {
+		"type": "git",
+		"url": "https://github.com/PunGrumpy/docker-doctor.git",
+		"directory": "packages/docker-doctor"
+	},
+	bin: { "docker-doctor": "./dist/cli.mjs" },
+	files: ["dist", "LICENSE"],
+	type: "module",
+	sideEffects: false,
+	exports: { ".": {
+		"import": {
+			"types": "./dist/index.d.mts",
+			"default": "./dist/index.mjs"
+		},
+		"require": {
+			"types": "./dist/index.d.cts",
+			"default": "./dist/index.cjs"
+		}
+	} },
+	publishConfig: {
+		"access": "public",
+		"registry": "https://registry.npmjs.org/"
+	},
+	scripts: {
+		"build": "NODE_OPTIONS='--max-old-space-size=4096' tsdown",
+		"dev": "NODE_OPTIONS='--max-old-space-size=4096' tsdown --watch",
+		"typecheck": "tsc --noEmit",
+		"clean": "git clean -xdf .turbo node_modules dist"
+	},
+	dependencies: {
+		"@docker-doctor/core": "workspace:*",
+		"chalk": "^5.4.1",
+		"commander": "^15.0.0",
+		"effect": "4.0.0-beta.70",
+		"yaml": "^2.7.0"
+	},
+	devDependencies: {
+		"@types/node": "^26",
+		"tsdown": "^0.22.4",
+		"typescript": "^6"
+	}
+};
+
+//#endregion
+//#region ../core/src/project-info/discover.ts
+const walk = async (dir, fileList = []) => {
+	const files = await fs.readdir(dir, { withFileTypes: true });
+	await Promise.all(files.map(async (file) => {
+		const filePath = path.join(dir, file.name);
+		if (file.isDirectory()) {
+			if (file.name === "node_modules" || file.name === ".git" || file.name === ".next" || file.name === "dist" || file.name === ".turbo") return;
+			await walk(filePath, fileList);
+		} else fileList.push(filePath);
+	}));
+	return fileList;
+};
+const discoverProject = async (rootDir) => {
+	const allFiles = await walk(rootDir);
+	const dockerfiles = [];
+	const composeFiles = [];
+	for (const file of allFiles) {
+		const base = path.basename(file).toLowerCase();
+		if (base === "dockerfile" || base.startsWith("dockerfile.") || base.endsWith(".dockerfile")) dockerfiles.push(path.relative(rootDir, file));
+		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(path.relative(rootDir, file));
+	}
+	return {
+		composeFiles,
+		dockerfiles
+	};
+};
+
+//#endregion
+//#region ../core/src/parsers/dockerfile-parser.ts
+const parseDockerfile = (content) => {
+	const instructions = [];
+	const lines = content.split(/\r?\n/u);
+	let currentInstruction = "";
+	let currentArgs = "";
+	let startLine = 0;
+	let rawAccumulator = [];
+	for (const [i, rawLine] of lines.entries()) {
+		const trimmed = rawLine.trim();
+		const lineNum = i + 1;
+		if (!currentInstruction && (trimmed === "" || trimmed.startsWith("#"))) continue;
+		rawAccumulator.push(rawLine);
+		let lineContent = trimmed;
+		if (lineContent.startsWith("#")) continue;
+		const hasContinuation = lineContent.endsWith("\\");
+		if (hasContinuation) lineContent = lineContent.slice(0, -1).trim();
+		if (currentInstruction) currentArgs += (currentArgs ? " " : "") + lineContent;
+		else {
+			startLine = lineNum;
+			const match = lineContent.match(/^(?<inst>[A-Z]+)\s+(?<args>.*)$/iu);
+			if (match?.groups) {
+				currentInstruction = match.groups.inst.toUpperCase();
+				currentArgs = match.groups.args;
+			} else {
+				const word = lineContent.trim().toUpperCase();
+				if ([
+					"RUN",
+					"CMD",
+					"ENTRYPOINT",
+					"EXPOSE",
+					"USER",
+					"WORKDIR"
+				].includes(word)) {
+					currentInstruction = word;
+					currentArgs = "";
+				}
+			}
+		}
+		if (!hasContinuation) {
+			if (currentInstruction) instructions.push({
+				args: currentArgs,
+				instruction: currentInstruction,
+				line: startLine,
+				raw: rawAccumulator.join("\n")
+			});
+			currentInstruction = "";
+			currentArgs = "";
+			rawAccumulator = [];
+		}
+	}
+	if (currentInstruction) instructions.push({
+		args: currentArgs,
+		instruction: currentInstruction,
+		line: startLine,
+		raw: rawAccumulator.join("\n")
+	});
+	return instructions;
+};
+
+//#endregion
+//#region ../core/src/errors/config-error.ts
+var ConfigError = class extends Data.TaggedError("ConfigError") {};
+
+//#endregion
+//#region ../core/src/errors/file-not-found-error.ts
+var FileNotFoundError = class extends Data.TaggedError("FileNotFoundError") {};
+
+//#endregion
+//#region ../core/src/errors/parse-error.ts
+var ParseError = class extends Data.TaggedError("ParseError") {};
+
+//#endregion
+//#region ../core/src/parsers/compose-parser.ts
+const parseCompose = (content, filepath) => {
+	try {
+		return parse(content);
+	} catch (error) {
+		throw new ParseError({
+			file: filepath,
+			message: error instanceof Error ? error.message : String(error)
+		});
+	}
+};
+
+//#endregion
+//#region ../core/src/rules/best-practices.ts
+const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
+	file,
+	help,
+	line,
+	message,
+	rule: ruleKey,
+	severity
+});
+const requireHealthcheck = {
+	category: "Best Practices",
+	check(instructions, file) {
+		const hasHealthcheck = instructions.some((inst) => inst.instruction === "HEALTHCHECK");
+		const hasExposedPortsOrEntry = instructions.some((inst) => inst.instruction === "EXPOSE" || inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT");
+		if (!hasHealthcheck && hasExposedPortsOrEntry) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No HEALTHCHECK instruction found. Containers running services should expose healthchecks to enable auto-healing.", this.help, 1)];
+		return [];
+	},
+	defaultSeverity: "info",
+	help: "Use HEALTHCHECK (e.g., 'HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1') so Docker can monitor the container's live status.",
+	key: "docker-doctor/require-healthcheck",
+	message: "Add a HEALTHCHECK instruction"
+};
+const preferCopyOverAdd = {
+	category: "Best Practices",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "ADD") {
+			const [src] = inst.args.split(/\s+/u);
+			const isRemote = src.startsWith("http://") || src.startsWith("https://");
+			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
+			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Use COPY instead of ADD unless you explicitly need auto-extraction of local compressed archives (tar, zip, etc.).",
+	key: "docker-doctor/prefer-copy-over-add",
+	message: "Prefer COPY over ADD"
+};
+const useExecForm = {
+	category: "Best Practices",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") {
+			const args = inst.args.trim();
+			if (!args.startsWith("[") || !args.endsWith("]")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. ENTRYPOINT [\"node\", \"index.js\"]) so OS signals (like SIGTERM) are forwarded correctly.",
+	key: "docker-doctor/use-exec-form",
+	message: "Use exec form for CMD and ENTRYPOINT"
+};
+const requireLabels = {
+	category: "Best Practices",
+	check(instructions, file) {
+		if (!instructions.some((inst) => inst.instruction === "LABEL")) return [createDiagnostic$4(file, this.key, this.defaultSeverity, "No LABEL metadata was found in this Dockerfile. Adding labels helps identify build information, maintainers, and descriptions.", this.help, 1)];
+		return [];
+	},
+	defaultSeverity: "info",
+	help: "Use LABEL instructions (e.g. LABEL org.opencontainers.image.authors=\"...\") to document ownership, license, version, and build info.",
+	key: "docker-doctor/require-labels",
+	message: "Add LABEL metadata to images"
+};
+const combineAptUpdateInstall = {
+	category: "Best Practices",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "RUN") {
+			const hasUpdate = inst.args.includes("apt-get update");
+			const hasInstall = inst.args.includes("apt-get install");
+			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
+			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Combine 'apt-get update' and 'apt-get install' in the same RUN instruction (e.g. 'RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*').",
+	key: "docker-doctor/combine-apt-update-install",
+	message: "Combine apt-get update and apt-get install"
+};
+const usePipefail = {
+	category: "Best Practices",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "RUN") {
+			const { raw } = inst;
+			if (/(?<!\|)\|(?!\|)/u.test(raw) && !raw.includes("pipefail")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Prepend 'set -o pipefail &&' to pipe commands, or use exec form with a shell that supports it (e.g., RUN ['/bin/bash', '-c', 'set -o pipefail && ...']).",
+	key: "docker-doctor/use-pipefail",
+	message: "Use pipefail to catch pipeline command failures"
+};
+const absoluteWorkdir = {
+	category: "Best Practices",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
+			const path = inst.args.trim();
+			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Always specify absolute paths for WORKDIR instructions (e.g. WORKDIR /app).",
+	key: "docker-doctor/absolute-workdir",
+	message: "Use absolute paths for WORKDIR"
+};
+const avoidRunCd = {
+	category: "Best Practices",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\bcd\b/u.test(inst.args)) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Use the WORKDIR instruction instead of 'cd' inside RUN to establish directory context.",
+	key: "docker-doctor/avoid-run-cd",
+	message: "Avoid changing directories with cd in RUN"
+};
+const sortMultilineArgs = {
+	category: "Best Practices",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "RUN") {
+			const { raw } = inst;
+			const isPackageInstall = raw.includes("apt-get install") || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
+			const hasContinuation = raw.includes("\\\n") || raw.includes("\\\r\n");
+			if (isPackageInstall && hasContinuation) {
+				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
+				if (packages.length > 1) {
+					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
+					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
+				}
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Sort multi-line package installation lists (e.g. apk/apt package lists) alphabetically.",
+	key: "docker-doctor/sort-multiline-args",
+	message: "Sort multi-line arguments alphanumerically"
+};
+const useraddNoLogInit = {
+	category: "Best Practices",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Pass '--no-log-init' flag to useradd (e.g., 'RUN useradd --no-log-init -r -g mygroup myuser').",
+	key: "docker-doctor/useradd-no-log-init",
+	message: "Use --no-log-init with useradd"
+};
+const bestPracticesRules = [
+	requireHealthcheck,
+	preferCopyOverAdd,
+	useExecForm,
+	requireLabels,
+	combineAptUpdateInstall,
+	usePipefail,
+	absoluteWorkdir,
+	avoidRunCd,
+	sortMultilineArgs,
+	useraddNoLogInit
+];
+
+//#endregion
+//#region ../core/src/rules/compose.ts
+const createDiagnostic$3 = (file, ruleKey, severity, message, help) => ({
+	file,
+	help,
+	message,
+	rule: ruleKey,
+	severity
+});
+const noVersionKey = {
+	category: "Compose",
+	check(composeContent, file) {
+		if (composeContent && typeof composeContent === "object" && "version" in composeContent) return [createDiagnostic$3(file, this.key, this.defaultSeverity, "The 'version' property is deprecated. Remove it to use standard Compose spec behavior.", this.help)];
+		return [];
+	},
+	defaultSeverity: "warning",
+	help: "The 'version' key is deprecated by the Compose specification. Omitting it defaults to the latest specification.",
+	key: "docker-doctor/no-version-key",
+	message: "Remove the 'version' key from Compose file"
+};
+const requireResourceLimits = {
+	category: "Compose",
+	check(composeContent, file) {
+		const diagnostics = [];
+		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
+			const { services } = composeContent;
+			if (services && typeof services === "object") {
+				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
+					const limits = (config.deploy?.resources)?.limits;
+					if (!limits || !limits.cpus && !limits.memory) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' does not have CPU or memory limits defined. A resource leak in this service could crash the host.`, this.help));
+				}
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Add resource limits (e.g. deploy.resources.limits) to prevent a single service from starving host resources in production.",
+	key: "docker-doctor/require-resource-limits",
+	message: "Define resource limits for services"
+};
+const requireRestartPolicy = {
+	category: "Compose",
+	check(composeContent, file) {
+		const diagnostics = [];
+		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
+			const { services } = composeContent;
+			if (services && typeof services === "object") {
+				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
+					const hasRestart = "restart" in config;
+					const hasDeployRestart = config.deploy?.restart_policy !== void 0;
+					if (!hasRestart && !hasDeployRestart) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' has no restart policy configured. It will not restart if it crashes or if the host reboots.`, this.help));
+				}
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Define 'restart: always' or 'restart: unless-stopped' (or deploy.restart_policy) so services restart on crashes or host reboot.",
+	key: "docker-doctor/require-restart-policy",
+	message: "Set restart policy for services"
+};
+const useDependsOnCondition = {
+	category: "Compose",
+	check(composeContent, file) {
+		const diagnostics = [];
+		if (composeContent && typeof composeContent === "object" && "services" in composeContent) {
+			const { services } = composeContent;
+			if (services && typeof services === "object") {
+				for (const [name, config] of Object.entries(services)) if (config && typeof config === "object") {
+					const dependsOn = config.depends_on;
+					if (dependsOn && Array.isArray(dependsOn)) diagnostics.push(createDiagnostic$3(file, this.key, this.defaultSeverity, `Service '${name}' uses shorthand depends_on list. This only checks if containers are started, not if they are ready/healthy.`, this.help));
+				}
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Instead of a simple service list, use 'depends_on: { dependency: { condition: service_healthy } }' to ensure dependencies are fully ready before starting.",
+	key: "docker-doctor/use-depends-on-condition",
+	message: "Use long-form depends_on with healthcheck conditions"
+};
+const composeRules = [
+	noVersionKey,
+	requireResourceLimits,
+	requireRestartPolicy,
+	useDependsOnCondition
+];
+
+//#endregion
+//#region ../core/src/rules/image-size.ts
+const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
+	file,
+	help,
+	line,
+	message,
+	rule: ruleKey,
+	severity
+});
+const preferSlimBase = {
+	category: "Image Size",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "FROM") {
+			const [imagePart] = inst.args.split(/\s+/u);
+			if (imagePart === "scratch") continue;
+			const colonIndex = imagePart.indexOf(":");
+			if (colonIndex !== -1) {
+				const tag = imagePart.slice(colonIndex + 1).toLowerCase();
+				const isSlim = tag.includes("alpine") || tag.includes("slim") || tag.includes("distroless");
+				const isSha = tag.startsWith("sha256:");
+				const isStageReference = instructions.some((other) => other.line < inst.line && other.instruction === "FROM" && other.args.toLowerCase().includes(` as ${imagePart.toLowerCase()}`));
+				if (!isSlim && !isSha && !isStageReference) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Prefer tags with '-slim', '-alpine', or use distroless base images to minimize the default operating system footprint.",
+	key: "docker-doctor/prefer-slim-base",
+	message: "Use slim, alpine, or distroless base images"
+};
+const cleanPackageCache = {
+	category: "Image Size",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "RUN") {
+			const { args } = inst;
+			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "For apt-get, append '&& rm -rf /var/lib/apt/lists/*'. For apk, use 'apk add --no-cache'. For dnf/yum, run 'yum clean all'.",
+	key: "docker-doctor/clean-package-cache",
+	message: "Clean up package manager cache in the same RUN layer"
+};
+const avoidDevDependencies = {
+	category: "Image Size",
+	check(instructions, file) {
+		const diagnostics = [];
+		let isLastStage = false;
+		let fromCount = 0;
+		for (const inst of instructions) if (inst.instruction === "FROM") fromCount += 1;
+		let currentStage = 0;
+		for (const inst of instructions) {
+			if (inst.instruction === "FROM") {
+				currentStage += 1;
+				isLastStage = currentStage === fromCount;
+			}
+			if (isLastStage && inst.instruction === "RUN") {
+				const { args } = inst;
+				if ((args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' in the final stage without omitting devDependencies.`, this.help, inst.line));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "For Node.js, run 'npm prune --production' or install only production dependencies ('npm ci --omit=dev') in the runtime stage.",
+	key: "docker-doctor/avoid-dev-dependencies",
+	message: "Avoid installing development dependencies in final production stage"
+};
+const imageSizeRules = [
+	preferSlimBase,
+	cleanPackageCache,
+	avoidDevDependencies
+];
+
+//#endregion
+//#region ../core/src/rules/performance.ts
+const createDiagnostic$1 = (file, ruleKey, severity, message, help, line) => ({
+	file,
+	help,
+	line,
+	message,
+	rule: ruleKey,
+	severity
+});
+const useMultiStage = {
+	category: "Performance",
+	check(instructions, file) {
+		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+		}
+		return [];
+	},
+	defaultSeverity: "info",
+	help: "Use multi-stage builds (multiple FROM statements) to separate build dependencies from the runtime image and reduce size.",
+	key: "docker-doctor/use-multi-stage",
+	message: "Consider using multi-stage builds"
+};
+const orderLayers = {
+	category: "Performance",
+	check(instructions, file) {
+		const diagnostics = [];
+		let copyAllLine = -1;
+		for (const inst of instructions) {
+			if (inst.instruction === "COPY" || inst.instruction === "ADD") {
+				const [src] = inst.args.split(/\s+/u);
+				if ((src === "." || src === "./" || src === "*" || src.includes("src")) && copyAllLine === -1) copyAllLine = inst.line;
+			}
+			if (inst.instruction === "RUN" && copyAllLine !== -1) {
+				const args = inst.args.toLowerCase();
+				if (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install") || args.includes("bun install") || args.includes("pip install") || args.includes("cargo fetch")) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Running package installation command '${inst.args}' after copying application files (at line ${copyAllLine}). This invalidates the cache on any code changes.`, this.help, inst.line));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Copy dependency definition files (like package.json, lockfiles) and run install commands BEFORE copying the rest of the application source code.",
+	key: "docker-doctor/order-layers",
+	message: "Order layers to maximize build cache utility"
+};
+const minimizeLayers = {
+	category: "Performance",
+	check(instructions, file) {
+		const diagnostics = [];
+		let consecutiveRunCount = 0;
+		let firstRunLine = -1;
+		for (const inst of instructions) if (inst.instruction === "RUN") {
+			if (consecutiveRunCount === 0) firstRunLine = inst.line;
+			consecutiveRunCount += 1;
+		} else {
+			if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+			consecutiveRunCount = 0;
+		}
+		if (consecutiveRunCount > 2) diagnostics.push(createDiagnostic$1(file, this.key, this.defaultSeverity, `Found ${consecutiveRunCount} consecutive RUN instructions starting at line ${firstRunLine}. Consider combining them into a single RUN layer.`, this.help, firstRunLine));
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Combine consecutive RUN instructions using '&&' and '\\' to reduce the total layer count and image size.",
+	key: "docker-doctor/minimize-layers",
+	message: "Minimize the number of image layers"
+};
+const useDockerignore = {
+	category: "Performance",
+	check(instructions, file, context) {
+		if (instructions.some((inst) => {
+			if (inst.instruction === "COPY" || inst.instruction === "ADD") {
+				const [src] = inst.args.split(/\s+/u);
+				return src === "." || src === "./" || src === "*";
+			}
+			return false;
+		}) && context?.projectFiles) {
+			if (!context.projectFiles.some((f) => f.endsWith(".dockerignore"))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with wildcard/directory, but no .dockerignore file was found in the workspace. This can copy local build folders and secrets.", this.help, 1)];
+		}
+		return [];
+	},
+	defaultSeverity: "warning",
+	help: "Create a .dockerignore file in the same directory as the Dockerfile to prevent copying unnecessary files (like node_modules, logs, build artifacts).",
+	key: "docker-doctor/use-dockerignore",
+	message: "Ensure .dockerignore is used"
+};
+const performanceRules = [
+	useMultiStage,
+	orderLayers,
+	minimizeLayers,
+	useDockerignore
+];
+
+//#endregion
+//#region ../core/src/rules/security.ts
+const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
+	file,
+	help,
+	line,
+	message,
+	rule: ruleKey,
+	severity
+});
+const noRootUser = {
+	category: "Security",
+	check(instructions, file) {
+		let lastUser = "root";
+		let lastUserLine = 1;
+		for (const inst of instructions) if (inst.instruction === "USER") {
+			lastUser = inst.args.trim().toLowerCase();
+			lastUserLine = inst.line;
+		}
+		if (lastUser === "root" || lastUser === "0" || lastUser === "0:0") return [createDiagnostic(file, this.key, this.defaultSeverity, "The container runs as root. Running as root allows potential container breakout vulnerabilities.", this.help, lastUserLine)];
+		return [];
+	},
+	defaultSeverity: "warning",
+	help: "Add a non-root user (e.g., 'USER node' or 'USER 1000') to improve security.",
+	key: "docker-doctor/no-root-user",
+	message: "Container should not run as root user"
+};
+const noSecretsInEnv = {
+	category: "Security",
+	check(instructions, file) {
+		const diagnostics = [];
+		const secretKeywords = [
+			/password/iu,
+			/secret/iu,
+			/token/iu,
+			/api_key/iu,
+			/private_key/iu,
+			/auth/iu
+		];
+		for (const inst of instructions) if (inst.instruction === "ENV" || inst.instruction === "ARG") {
+			const parts = inst.args.split(/\s+/u);
+			for (const part of parts) {
+				const eqIndex = part.indexOf("=");
+				let key = "";
+				let value = "";
+				if (eqIndex > 0) {
+					key = part.slice(0, eqIndex);
+					value = part.slice(eqIndex + 1);
+				} else key = part;
+				if (secretKeywords.some((regex) => regex.test(key)) && value && !value.startsWith("$") && !value.startsWith("{")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Potential secret found in ${inst.instruction}: '${key}'. Secrets baked into images can be extracted easily by anyone with image access.`, this.help, inst.line));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Use Docker Secrets, build arguments passed at runtime, or environment variables at runtime instead of baking them into the image.",
+	key: "docker-doctor/no-secrets-in-env",
+	message: "Do not store secrets in ENV or ARG instructions"
+};
+const pinImageVersion = {
+	category: "Security",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "FROM") {
+			const [imagePart] = inst.args.split(/\s+/u);
+			if (imagePart === "scratch") continue;
+			const colonIndex = imagePart.indexOf(":");
+			const atIndex = imagePart.indexOf("@");
+			if (colonIndex === -1 && atIndex === -1) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
+			else if (colonIndex !== -1) {
+				if (imagePart.slice(colonIndex + 1) === "latest") diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' uses the mutable 'latest' tag. This makes builds non-deterministic.`, this.help, inst.line));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Specify a concrete tag instead of 'latest' or no tag (e.g., 'node:22.2.0-alpine' instead of 'node').",
+	key: "docker-doctor/pin-image-version",
+	message: "Always pin base image versions to specific tags"
+};
+const noAddRemote = {
+	category: "Security",
+	check(instructions, file) {
+		const diagnostics = [];
+		for (const inst of instructions) if (inst.instruction === "ADD") {
+			const [src] = inst.args.split(/\s+/u);
+			if (src.startsWith("http://") || src.startsWith("https://")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction uses a remote URL '${src}'. Remote files added via ADD cannot be cleaned up in later layers, increasing image size.`, this.help, inst.line));
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Use 'RUN curl' or 'RUN wget' instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
+	key: "docker-doctor/no-add-remote",
+	message: "Avoid using ADD with remote URLs"
+};
+const securityRules = [
+	noRootUser,
+	noSecretsInEnv,
+	pinImageVersion,
+	noAddRemote
+];
+
+//#endregion
+//#region ../core/src/rules/index.ts
+const allDockerfileRules = [
+	...securityRules,
+	...performanceRules,
+	...bestPracticesRules,
+	...imageSizeRules
+];
+const allComposeRules = [...composeRules];
+const allRules = [...allDockerfileRules, ...allComposeRules];
+const findRule = (key) => allRules.find((rule) => rule.key === key);
+
+//#endregion
+//#region ../core/src/runners/dockerfile-runner.ts
+const runDockerfileRules = (instructions, file, projectFiles, rulesConfig) => {
+	const diagnostics = [];
+	for (const rule of allDockerfileRules) {
+		const configSeverity = rulesConfig?.[rule.key];
+		if (configSeverity === "off") continue;
+		const ruleDiagnostics = rule.check(instructions, file, { projectFiles });
+		if (configSeverity) for (const diag of ruleDiagnostics) diag.severity = configSeverity;
+		diagnostics.push(...ruleDiagnostics);
+	}
+	return diagnostics;
+};
+
+//#endregion
+//#region ../core/src/runners/compose-runner.ts
+const runComposeRules = (composeContent, file, rulesConfig) => {
+	const diagnostics = [];
+	for (const rule of allComposeRules) {
+		const configSeverity = rulesConfig?.[rule.key];
+		if (configSeverity === "off") continue;
+		const ruleDiagnostics = rule.check(composeContent, file);
+		if (configSeverity) for (const diag of ruleDiagnostics) diag.severity = configSeverity;
+		diagnostics.push(...ruleDiagnostics);
+	}
+	return diagnostics;
+};
+
+//#endregion
+//#region ../core/src/schemas/config.ts
+const RuleSeveritySchema = Schema.Union([
+	Schema.Literal("error"),
+	Schema.Literal("warning"),
+	Schema.Literal("info"),
+	Schema.Literal("off")
+]);
+const DockerDoctorConfigSchema = Schema.Struct({
+	categories: Schema.optional(Schema.Struct({
+		"Best Practices": Schema.optional(RuleSeveritySchema),
+		Compose: Schema.optional(RuleSeveritySchema),
+		"Image Size": Schema.optional(RuleSeveritySchema),
+		Performance: Schema.optional(RuleSeveritySchema),
+		Security: Schema.optional(RuleSeveritySchema)
+	})),
+	ignore: Schema.optional(Schema.Struct({ files: Schema.optional(Schema.Array(Schema.String)) })),
+	rules: Schema.optional(Schema.Record(Schema.String, RuleSeveritySchema))
+});
+
+//#endregion
+//#region ../core/src/config/loader.ts
+const fileExists = async (filePath) => {
+	try {
+		await fs.access(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+};
+const importConfig = async (filePath) => {
+	if (filePath.endsWith(".json")) try {
+		const content = await fs.readFile(filePath, "utf-8");
+		return JSON.parse(content);
+	} catch (error) {
+		throw new ConfigError({ message: `Failed to parse config JSON: ${error instanceof Error ? error.message : String(error)}` });
+	}
+	try {
+		const configModule = await import(filePath);
+		return configModule.default || configModule;
+	} catch (error) {
+		throw new ConfigError({ message: `Failed to load config file ${filePath}: ${error instanceof Error ? error.message : String(error)}` });
+	}
+};
+const loadConfig = async (rootDir, customPath) => {
+	let configObject = null;
+	if (customPath) {
+		const fullPath = path.resolve(rootDir, customPath);
+		if (!await fileExists(fullPath)) throw new ConfigError({ message: `Specified config file not found at ${fullPath}` });
+		configObject = await importConfig(fullPath);
+	} else {
+		for (const cand of [
+			"docker-doctor.config.ts",
+			"docker-doctor.config.js",
+			"docker-doctor.config.mjs",
+			"docker-doctor.config.cjs",
+			"docker-doctor.config.json"
+		]) {
+			const fullPath = path.join(rootDir, cand);
+			if (await fileExists(fullPath)) {
+				configObject = await importConfig(fullPath);
+				break;
+			}
+		}
+		if (!configObject) {
+			const pkgPath = path.join(rootDir, "package.json");
+			if (await fileExists(pkgPath)) try {
+				const pkgContent = await fs.readFile(pkgPath, "utf-8");
+				const pkgJson = JSON.parse(pkgContent);
+				if (pkgJson.dockerDoctor) configObject = pkgJson.dockerDoctor;
+			} catch {}
+		}
+	}
+	if (!configObject) return {};
+	try {
+		return Schema.decodeSync(DockerDoctorConfigSchema)(configObject);
+	} catch (error) {
+		throw new ConfigError({ message: `Invalid configuration format: ${error instanceof Error ? error.message : String(error)}` });
+	}
+};
+
+//#endregion
+//#region ../core/src/scoring.ts
+const calculateScore = (diagnostics) => {
+	let penalty = 0;
+	for (const diag of diagnostics) if (diag.severity === "error") penalty += 10;
+	else if (diag.severity === "warning") penalty += 4;
+	else if (diag.severity === "info") penalty += 1;
+	const score = Math.max(0, 100 - penalty);
+	let label = "Critical 🚨";
+	if (score >= 90) label = "Excellent 🏆";
+	else if (score >= 75) label = "Good ✅";
+	else if (score >= 50) label = "Needs Work ⚠️";
+	return {
+		label,
+		score
+	};
+};
+
+//#endregion
+//#region ../core/src/report.ts
+const toJsonReport = (diagnostics, score, label, project) => ({
+	diagnostics: diagnostics.map((d) => ({
+		column: d.column,
+		file: d.file,
+		help: d.help,
+		line: d.line,
+		message: d.message,
+		rule: d.rule,
+		severity: d.severity
+	})),
+	label,
+	project,
+	score,
+	timestamp: (/* @__PURE__ */ new Date()).toISOString()
+});
+
+//#endregion
+export { runDockerfileRules as a, parseCompose as c, package_default as d, runComposeRules as i, parseDockerfile as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, discoverProject as u };
+//# sourceMappingURL=src-IXht-l0J.mjs.map