@docker-doctor/cli 0.4.1 → 0.4.3

package/dist/{src-DOPSHVJr.cjs → src-ILbJuJmE.cjs}

@@ -33,7 +33,7 @@ node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
 
 //#region package.json
-var version = "0.4.1";
+var version = "0.4.3";
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
@@ -60,9 +60,9 @@ const discoverProject = async (rootDir) => {
 		if (base === "docker-compose.yml" || base === "docker-compose.yaml" || base === "compose.yml" || base === "compose.yaml" || (base.startsWith("docker-compose.") || base.startsWith("compose.")) && (base.endsWith(".yml") || base.endsWith(".yaml"))) composeFiles.push(node_path.default.relative(rootDir, file));
 	}
 	return {
-		composeFiles,
-		dockerfiles,
-		dockerignores
+		composeFiles: composeFiles.toSorted(),
+		dockerfiles: dockerfiles.toSorted(),
+		dockerignores: dockerignores.toSorted()
 	};
 };
 
@@ -88,8 +88,13 @@ const DOCKERFILE_KEYWORDS = /* @__PURE__ */ new Set([
 	"VOLUME",
 	"WORKDIR"
 ]);
+const HEREDOC_INSTRUCTIONS = /* @__PURE__ */ new Set([
+	"ADD",
+	"COPY",
+	"RUN"
+]);
 const INSTRUCTION_LINE_RE = /^(?<inst>[A-Za-z]+)\s+(?<args>.*)$/u;
-const HEREDOC_OPENER_RE = /<<-?\s*(?<quote>['"]?)(?<delim>\w+)\k<quote>/gu;
+const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>\w+)\k<quote>/gu;
 const createParserState = () => ({
 	currentArgs: "",
 	currentInstruction: "",
@@ -143,7 +148,7 @@ const processInstructionLine = (state, trimmed, lineNum) => {
 			state.currentArgs = matched.args;
 		}
 	}
-	if (state.currentInstruction) state.heredocQueue.push(...findHeredocDelimiters(lineContent));
+	if (HEREDOC_INSTRUCTIONS.has(state.currentInstruction)) state.heredocQueue.push(...findHeredocDelimiters(lineContent));
 	if (state.heredocQueue.length > 0) return;
 	if (!hasContinuation) closeInstruction(state);
 };
@@ -189,7 +194,7 @@ var ParseError = class extends Error {
 //#region ../core/src/parsers/compose-parser.ts
 const parseCompose = (content, filepath) => {
 	try {
-		return (0, yaml.parse)(content);
+		return (0, yaml.parse)(content, { merge: true });
 	} catch (error) {
 		throw new ParseError({
 			file: filepath,
@@ -198,6 +203,79 @@ const parseCompose = (content, filepath) => {
 	}
 };
 
+//#endregion
+//#region ../core/src/parsers/exec-form.ts
+const parseExecForm = (args) => {
+	const trimmed = args.trim();
+	if (!trimmed.startsWith("[")) return null;
+	let parsed;
+	try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return null;
+	}
+	if (!Array.isArray(parsed)) return null;
+	if (!parsed.every((el) => typeof el === "string")) return null;
+	return parsed;
+};
+
+//#endregion
+//#region ../core/src/parsers/image-ref.ts
+const parseImageRef = (ref) => {
+	if (ref.includes("${") || ref.startsWith("$")) return {
+		isVariable: true,
+		name: ref
+	};
+	let remainder = ref;
+	let digest;
+	const atIndex = remainder.indexOf("@");
+	if (atIndex !== -1) {
+		digest = remainder.slice(atIndex + 1);
+		remainder = remainder.slice(0, atIndex);
+	}
+	let tag;
+	const lastColonIndex = remainder.lastIndexOf(":");
+	const lastSlashIndex = remainder.lastIndexOf("/");
+	if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {
+		tag = remainder.slice(lastColonIndex + 1);
+		remainder = remainder.slice(0, lastColonIndex);
+	}
+	let registry;
+	const firstSlashIndex = remainder.indexOf("/");
+	if (firstSlashIndex !== -1) {
+		const firstSegment = remainder.slice(0, firstSlashIndex);
+		if (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost") {
+			registry = firstSegment;
+			remainder = remainder.slice(firstSlashIndex + 1);
+		}
+	}
+	return {
+		digest,
+		isVariable: false,
+		name: remainder,
+		registry,
+		tag
+	};
+};
+const parseFromArgs = (args) => {
+	const parts = args.split(/\s+/u).filter(Boolean);
+	const asIndex = parts.findIndex((p) => p.toLowerCase() === "as");
+	return {
+		base: (asIndex === -1 ? parts : parts.slice(0, asIndex)).find((p) => !p.startsWith("--")) ?? null,
+		stage: asIndex === -1 ? null : parts[asIndex + 1] ?? null
+	};
+};
+const isScratch = (base) => base?.toLowerCase() === "scratch";
+const collectStageAliases = (instructions) => {
+	const aliases = /* @__PURE__ */ new Set();
+	for (const inst of instructions) {
+		if (inst.instruction !== "FROM") continue;
+		const { stage } = parseFromArgs(inst.args);
+		if (stage) aliases.add(stage.toLowerCase());
+	}
+	return aliases;
+};
+
 //#endregion
 //#region ../core/src/rules/best-practices.ts
 const createDiagnostic$4 = (file, ruleKey, severity, message, help, line) => ({
@@ -217,7 +295,7 @@ const requireHealthcheck = {
 		return [];
 	},
 	defaultSeverity: "info",
-	help: "Use HEALTHCHECK (e.g., 'HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1') so Docker can monitor the container's live status.",
+	help: "Use HEALTHCHECK (e.g., `HEALTHCHECK --interval=30s --timeout=3s CMD curl -f http://localhost/ || exit 1`) so Docker can monitor the container's live status.",
 	key: "docker-doctor/require-healthcheck",
 	message: "Add a HEALTHCHECK instruction"
 };
@@ -243,14 +321,11 @@ const useExecForm = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") {
-			const args = inst.args.trim();
-			if (!args.startsWith("[") || !args.endsWith("]")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
-		}
+		for (const inst of instructions) if ((inst.instruction === "CMD" || inst.instruction === "ENTRYPOINT") && parseExecForm(inst.args) === null) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, `${inst.instruction} instruction uses shell form instead of exec form. In shell form, the command runs under '/bin/sh -c', which does not pass signals to child processes.`, this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. ENTRYPOINT [\"node\", \"index.js\"]) so OS signals (like SIGTERM) are forwarded correctly.",
+	help: "Write CMD/ENTRYPOINT instructions as JSON arrays (e.g. `ENTRYPOINT [\"node\", \"index.js\"]`) so OS signals (like SIGTERM) are forwarded correctly.",
 	key: "docker-doctor/use-exec-form",
 	message: "Use exec form for CMD and ENTRYPOINT"
 };
@@ -261,7 +336,7 @@ const requireLabels = {
 		return [];
 	},
 	defaultSeverity: "info",
-	help: "Use LABEL instructions (e.g. LABEL org.opencontainers.image.authors=\"...\") to document ownership, license, version, and build info.",
+	help: "Use LABEL instructions (e.g. `LABEL org.opencontainers.image.authors=\"...\"`) to document ownership, license, version, and build info.",
 	key: "docker-doctor/require-labels",
 	message: "Add LABEL metadata to images"
 };
@@ -278,22 +353,47 @@ const combineAptUpdateInstall = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Combine 'apt-get update' and 'apt-get install' in the same RUN instruction (e.g. 'RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*').",
+	help: "Combine `apt-get update` and `apt-get install` in the same RUN instruction (e.g. `RUN apt-get update && apt-get install -y --no-install-recommends <package> && rm -rf /var/lib/apt/lists/*`).",
 	key: "docker-doctor/combine-apt-update-install",
 	message: "Combine apt-get update and apt-get install"
 };
+const PIPEFAIL_SETTING_RE = /(?:^|\s)-[A-Za-z]*o\s+pipefail\b/u;
+const HAS_PIPE_RE = /(?<!\|)\|(?!\|)/u;
+const shellDirectiveEnablesPipefail = (args) => {
+	const argv = parseExecForm(args);
+	return argv !== null && PIPEFAIL_SETTING_RE.test(argv.join(" "));
+};
 const usePipefail = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN") {
-			const { raw } = inst;
-			if (/(?<!\|)\|(?!\|)/u.test(raw) && !raw.includes("pipefail")) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
+		const stagePipefail = /* @__PURE__ */ new Map();
+		let shellHasPipefail = false;
+		let currentStage = null;
+		for (const inst of instructions) {
+			if (inst.instruction === "FROM") {
+				const { base, stage } = parseFromArgs(inst.args);
+				const parentStage = isScratch(base) ? null : base?.toLowerCase() ?? null;
+				shellHasPipefail = parentStage !== null && stagePipefail.get(parentStage) === true;
+				currentStage = stage?.toLowerCase() ?? null;
+				if (currentStage) stagePipefail.set(currentStage, shellHasPipefail);
+				continue;
+			}
+			if (inst.instruction === "SHELL") {
+				shellHasPipefail = shellDirectiveEnablesPipefail(inst.args);
+				if (currentStage) stagePipefail.set(currentStage, shellHasPipefail);
+				continue;
+			}
+			if (inst.instruction !== "RUN") continue;
+			const { args } = inst;
+			if (!HAS_PIPE_RE.test(args)) continue;
+			const execArgv = parseExecForm(args);
+			if (!(execArgv === null ? shellHasPipefail || PIPEFAIL_SETTING_RE.test(args) : PIPEFAIL_SETTING_RE.test(execArgv.join(" ")))) diagnostics.push(createDiagnostic$4(file, this.key, this.defaultSeverity, "RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.", this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Prepend 'set -o pipefail &&' to pipe commands, or use exec form with a shell that supports it (e.g., RUN ['/bin/bash', '-c', 'set -o pipefail && ...']).",
+	help: "Prepend `set -o pipefail &&` to pipe commands, use exec form with a shell that supports it (e.g., `RUN [\"/bin/bash\", \"-c\", \"set -o pipefail && ...\"]`), or set `SHELL [\"/bin/bash\", \"-o\", \"pipefail\", \"-c\"]` at the top of the stage.",
 	key: "docker-doctor/use-pipefail",
 	message: "Use pipefail to catch pipeline command failures"
 };
@@ -308,7 +408,7 @@ const absoluteWorkdir = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Always specify absolute paths for WORKDIR instructions (e.g. WORKDIR /app).",
+	help: "Always specify absolute paths for WORKDIR instructions (e.g. `WORKDIR /app`).",
 	key: "docker-doctor/absolute-workdir",
 	message: "Use absolute paths for WORKDIR"
 };
@@ -320,7 +420,7 @@ const avoidRunCd = {
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Use the WORKDIR instruction instead of 'cd' inside RUN to establish directory context.",
+	help: "Use the WORKDIR instruction instead of `cd` inside RUN to establish directory context.",
 	key: "docker-doctor/avoid-run-cd",
 	message: "Avoid changing directories with cd in RUN"
 };
@@ -355,7 +455,7 @@ const useraddNoLogInit = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Pass '--no-log-init' flag to useradd (e.g., 'RUN useradd --no-log-init -r -g mygroup myuser').",
+	help: "Pass `--no-log-init` flag to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
 	key: "docker-doctor/useradd-no-log-init",
 	message: "Use --no-log-init with useradd"
 };
@@ -388,9 +488,9 @@ const noVersionKey = {
 		return [];
 	},
 	defaultSeverity: "warning",
-	help: "The 'version' key is deprecated by the Compose specification. Omitting it defaults to the latest specification.",
+	help: "The `version` key is obsolete in the Compose specification. Omitting it defaults to the latest specification.",
 	key: "docker-doctor/no-version-key",
-	message: "Remove the 'version' key from Compose file"
+	message: "Remove the `version` key from the Compose file"
 };
 const requireResourceLimits = {
 	category: "Compose",
@@ -408,7 +508,7 @@ const requireResourceLimits = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Add resource limits (e.g. deploy.resources.limits) to prevent a single service from starving host resources in production.",
+	help: "Add resource limits (e.g. `deploy.resources.limits`) to prevent a single service from starving host resources in production.",
 	key: "docker-doctor/require-resource-limits",
 	message: "Define resource limits for services"
 };
@@ -429,7 +529,7 @@ const requireRestartPolicy = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Define 'restart: always' or 'restart: unless-stopped' (or deploy.restart_policy) so services restart on crashes or host reboot.",
+	help: "Define `restart: always` or `restart: unless-stopped` (or `deploy.restart_policy`) so services restart on crashes or host reboot.",
 	key: "docker-doctor/require-restart-policy",
 	message: "Set restart policy for services"
 };
@@ -449,7 +549,7 @@ const useDependsOnCondition = {
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Instead of a simple service list, use 'depends_on: { dependency: { condition: service_healthy } }' to ensure dependencies are fully ready before starting.",
+	help: "Instead of a simple service list, use `depends_on: { dependency: { condition: service_healthy } }` to ensure dependencies are fully ready before starting.",
 	key: "docker-doctor/use-depends-on-condition",
 	message: "Use long-form depends_on with healthcheck conditions"
 };
@@ -460,54 +560,6 @@ const composeRules = [
 	useDependsOnCondition
 ];
 
-//#endregion
-//#region ../core/src/parsers/image-ref.ts
-const parseImageRef = (ref) => {
-	if (ref.includes("${") || ref.startsWith("$")) return {
-		isVariable: true,
-		name: ref
-	};
-	let remainder = ref;
-	let digest;
-	const atIndex = remainder.indexOf("@");
-	if (atIndex !== -1) {
-		digest = remainder.slice(atIndex + 1);
-		remainder = remainder.slice(0, atIndex);
-	}
-	let tag;
-	const lastColonIndex = remainder.lastIndexOf(":");
-	const lastSlashIndex = remainder.lastIndexOf("/");
-	if (lastColonIndex !== -1 && lastColonIndex > lastSlashIndex) {
-		tag = remainder.slice(lastColonIndex + 1);
-		remainder = remainder.slice(0, lastColonIndex);
-	}
-	let registry;
-	const firstSlashIndex = remainder.indexOf("/");
-	if (firstSlashIndex !== -1) {
-		const firstSegment = remainder.slice(0, firstSlashIndex);
-		if (firstSegment.includes(".") || firstSegment.includes(":") || firstSegment === "localhost") {
-			registry = firstSegment;
-			remainder = remainder.slice(firstSlashIndex + 1);
-		}
-	}
-	return {
-		digest,
-		isVariable: false,
-		name: remainder,
-		registry,
-		tag
-	};
-};
-const collectStageAliases = (instructions) => {
-	const aliases = /* @__PURE__ */ new Set();
-	for (const inst of instructions) {
-		if (inst.instruction !== "FROM") continue;
-		const match = /\sas\s+(?<alias>\S+)/iu.exec(inst.args);
-		if (match?.groups?.alias) aliases.add(match.groups.alias.toLowerCase());
-	}
-	return aliases;
-};
-
 //#endregion
 //#region ../core/src/rules/image-size.ts
 const createDiagnostic$2 = (file, ruleKey, severity, message, help, line) => ({
@@ -524,21 +576,21 @@ const preferSlimBase = {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!imagePart || imagePart === "scratch") continue;
+			const imagePart = parseFromArgs(inst.args).base;
+			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
-			const tag = ref.tag.toLowerCase();
-			if (!(tag.includes("alpine") || tag.includes("slim") || tag.includes("distroless"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
+			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Prefer tags with '-slim', '-alpine', or use distroless base images to minimize the default operating system footprint.",
+	help: "Prefer tags with `-slim`, `-alpine`, or use distroless base images to minimize the default operating system footprint.",
 	key: "docker-doctor/prefer-slim-base",
-	message: "Use slim, alpine, or distroless base images"
+	message: "Prefer slim, alpine, or distroless base images"
 };
 const cleanPackageCache = {
 	category: "Image Size",
@@ -552,34 +604,47 @@ const cleanPackageCache = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "For apt-get, append '&& rm -rf /var/lib/apt/lists/*'. For apk, use 'apk add --no-cache'. For dnf/yum, run 'yum clean all'.",
+	help: "For apt-get, append `&& rm -rf /var/lib/apt/lists/*`. For apk, use `apk add --no-cache`. For dnf/yum, run `yum clean all`.",
 	key: "docker-doctor/clean-package-cache",
 	message: "Clean up package manager cache in the same RUN layer"
 };
+const installsDevDependencies = (args) => (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune");
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
-		let isLastStage = false;
-		let fromCount = 0;
-		for (const inst of instructions) if (inst.instruction === "FROM") fromCount += 1;
-		let currentStage = 0;
-		for (const inst of instructions) {
-			if (inst.instruction === "FROM") {
-				currentStage += 1;
-				isLastStage = currentStage === fromCount;
-			}
-			if (isLastStage && inst.instruction === "RUN") {
-				const { args } = inst;
-				if ((args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune")) diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' in the final stage without omitting devDependencies.`, this.help, inst.line));
+		const stages = [];
+		for (const inst of instructions) if (inst.instruction === "FROM") {
+			const { base, stage } = parseFromArgs(inst.args);
+			stages.push({
+				base: base?.toLowerCase() ?? "",
+				name: stage?.toLowerCase() ?? null,
+				runs: []
+			});
+		} else if (inst.instruction === "RUN" && stages.length > 0) stages.at(-1)?.runs.push(inst);
+		if (stages.length === 0) return diagnostics;
+		const auditedIndices = [];
+		let index = stages.length - 1;
+		while (index >= 0) {
+			auditedIndices.push(index);
+			const { base } = stages[index];
+			index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
+		}
+		const finalIndex = stages.length - 1;
+		for (const stageIndex of auditedIndices.toReversed()) {
+			const stage = stages[stageIndex];
+			for (const inst of stage.runs) {
+				if (!installsDevDependencies(inst.args)) continue;
+				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
+				diagnostics.push(createDiagnostic$2(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 			}
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "For Node.js, run 'npm prune --production' or install only production dependencies ('npm ci --omit=dev') in the runtime stage.",
+	help: "For Node.js, run `npm prune --production` or install only production dependencies (`npm ci --omit=dev`) in the runtime stage.",
 	key: "docker-doctor/avoid-dev-dependencies",
-	message: "Avoid installing development dependencies in final production stage"
+	message: "Avoid installing dev dependencies in the final stage"
 };
 const imageSizeRules = [
 	preferSlimBase,
@@ -608,7 +673,7 @@ const useMultiStage = {
 	defaultSeverity: "info",
 	help: "Use multi-stage builds (multiple FROM statements) to separate build dependencies from the runtime image and reduce size.",
 	key: "docker-doctor/use-multi-stage",
-	message: "Consider using multi-stage builds"
+	message: "Use multi-stage builds"
 };
 const orderLayers = {
 	category: "Performance",
@@ -652,10 +717,16 @@ const minimizeLayers = {
 		return diagnostics;
 	},
 	defaultSeverity: "info",
-	help: "Combine consecutive RUN instructions using '&&' and '\\' to reduce the total layer count and image size.",
+	help: "Combine consecutive RUN instructions using `&&` and `\\` to reduce the total layer count and image size.",
 	key: "docker-doctor/minimize-layers",
 	message: "Minimize the number of image layers"
 };
+const hasDockerignoreFor = (dockerfilePath, projectFiles) => {
+	const lastSlash = dockerfilePath.lastIndexOf("/");
+	const dir = lastSlash === -1 ? "" : dockerfilePath.slice(0, lastSlash);
+	const adjacent = dir === "" ? ".dockerignore" : `${dir}/.dockerignore`;
+	return projectFiles.some((f) => f === adjacent || f === ".dockerignore");
+};
 const useDockerignore = {
 	category: "Performance",
 	check(instructions, file, context) {
@@ -667,15 +738,13 @@ const useDockerignore = {
 				return src === "." || src === "./" || src === "*";
 			}
 			return false;
-		}) && context?.projectFiles) {
-			if (!context.projectFiles.some((f) => f.endsWith(".dockerignore"))) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with wildcard/directory, but no .dockerignore file was found in the workspace. This can copy local build folders and secrets.", this.help, 1)];
-		}
+		}) && context?.projectFiles && !hasDockerignoreFor(file, context.projectFiles)) return [createDiagnostic$1(file, this.key, this.defaultSeverity, "Using COPY/ADD with a wildcard or directory, but no .dockerignore file was found next to the Dockerfile or at the project root. This can copy local build folders and secrets.", this.help, 1)];
 		return [];
 	},
 	defaultSeverity: "warning",
 	help: "Create a .dockerignore file in the same directory as the Dockerfile to prevent copying unnecessary files (like node_modules, logs, build artifacts).",
 	key: "docker-doctor/use-dockerignore",
-	message: "Ensure .dockerignore is used"
+	message: "Add a .dockerignore file"
 };
 const performanceRules = [
 	useMultiStage,
@@ -694,25 +763,35 @@ const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	rule: ruleKey,
 	severity
 });
+const isRootUser = (value) => {
+	const [user] = value.split(":");
+	return user === "root" || user === "0";
+};
 const noRootUser = {
 	category: "Security",
 	check(instructions, file) {
+		const stageUser = /* @__PURE__ */ new Map();
+		let currentStage = null;
 		let lastUser = "root";
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			lastUser = "root";
+			const { base, stage } = parseFromArgs(inst.args);
+			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? "root";
 			lastUserLine = inst.line;
+			currentStage = stage?.toLowerCase() ?? null;
+			if (currentStage) stageUser.set(currentStage, lastUser);
 		} else if (inst.instruction === "USER") {
 			lastUser = inst.args.trim().toLowerCase();
 			lastUserLine = inst.line;
+			if (currentStage) stageUser.set(currentStage, lastUser);
 		}
-		if (lastUser === "root" || lastUser === "0" || lastUser === "0:0") return [createDiagnostic(file, this.key, this.defaultSeverity, "The container runs as root. Running as root allows potential container breakout vulnerabilities.", this.help, lastUserLine)];
+		if (isRootUser(lastUser)) return [createDiagnostic(file, this.key, this.defaultSeverity, "The container runs as root. Running as root allows potential container breakout vulnerabilities.", this.help, lastUserLine)];
 		return [];
 	},
 	defaultSeverity: "warning",
-	help: "Add a non-root user (e.g., 'USER node' or 'USER 1000') to improve security.",
+	help: "Add a non-root user (e.g., `USER node` or `USER 1000`) to improve security.",
 	key: "docker-doctor/no-root-user",
-	message: "Container should not run as root user"
+	message: "Run the container as a non-root user"
 };
 const noSecretsInEnv = {
 	category: "Security",
@@ -753,7 +832,7 @@ const noSecretsInEnv = {
 	defaultSeverity: "error",
 	help: "Use Docker Secrets, build arguments passed at runtime, or environment variables at runtime instead of baking them into the image.",
 	key: "docker-doctor/no-secrets-in-env",
-	message: "Do not store secrets in ENV or ARG instructions"
+	message: "Avoid storing secrets in ENV or ARG instructions"
 };
 const pinImageVersion = {
 	category: "Security",
@@ -761,8 +840,8 @@ const pinImageVersion = {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
 		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!imagePart || imagePart === "scratch") continue;
+			const imagePart = parseFromArgs(inst.args).base;
+			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
 			if (!(ref.tag || ref.digest)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' does not specify a tag. This makes builds non-deterministic.`, this.help, inst.line));
@@ -771,9 +850,9 @@ const pinImageVersion = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Specify a concrete tag instead of 'latest' or no tag (e.g., 'node:22.2.0-alpine' instead of 'node').",
+	help: "Specify a concrete tag instead of `latest` or no tag (e.g., `node:22.2.0-alpine` instead of `node`).",
 	key: "docker-doctor/pin-image-version",
-	message: "Always pin base image versions to specific tags"
+	message: "Pin base images to a specific tag or digest"
 };
 const noAddRemote = {
 	category: "Security",
@@ -787,7 +866,7 @@ const noAddRemote = {
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Use 'RUN curl' or 'RUN wget' instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
+	help: "Use `RUN curl` or `RUN wget` instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
 	key: "docker-doctor/no-add-remote",
 	message: "Avoid using ADD with remote URLs"
 };
@@ -810,15 +889,19 @@ const allComposeRules = [...composeRules];
 const allRules = [...allDockerfileRules, ...allComposeRules];
 const findRule = (key) => allRules.find((rule) => rule.key === key);
 
+//#endregion
+//#region ../core/src/runners/resolve-severity.ts
+const resolveSeverity = (rule, rulesConfig, categoriesConfig) => rulesConfig?.[rule.key] ?? categoriesConfig?.[rule.category] ?? rule.defaultSeverity;
+
 //#endregion
 //#region ../core/src/runners/dockerfile-runner.ts
-const runDockerfileRules = (instructions, file, projectFiles, rulesConfig) => {
+const runDockerfileRules = (instructions, file, projectFiles, rulesConfig, categoriesConfig) => {
 	const diagnostics = [];
 	for (const rule of allDockerfileRules) {
-		const configSeverity = rulesConfig?.[rule.key];
-		if (configSeverity === "off") continue;
+		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
+		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(instructions, file, { projectFiles });
-		if (configSeverity) for (const diag of ruleDiagnostics) diag.severity = configSeverity;
+		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -826,13 +909,13 @@ const runDockerfileRules = (instructions, file, projectFiles, rulesConfig) => {
 
 //#endregion
 //#region ../core/src/runners/compose-runner.ts
-const runComposeRules = (composeContent, file, rulesConfig) => {
+const runComposeRules = (composeContent, file, rulesConfig, categoriesConfig) => {
 	const diagnostics = [];
 	for (const rule of allComposeRules) {
-		const configSeverity = rulesConfig?.[rule.key];
-		if (configSeverity === "off") continue;
+		const severity = resolveSeverity(rule, rulesConfig, categoriesConfig);
+		if (severity === "off") continue;
 		const ruleDiagnostics = rule.check(composeContent, file);
-		if (configSeverity) for (const diag of ruleDiagnostics) diag.severity = configSeverity;
+		if (severity !== rule.defaultSeverity) for (const diag of ruleDiagnostics) diag.severity = severity;
 		diagnostics.push(...ruleDiagnostics);
 	}
 	return diagnostics;
@@ -900,6 +983,30 @@ const validateConfig = (input) => {
 	return result;
 };
 
+//#endregion
+//#region ../core/src/config/unknown-keys.ts
+const KNOWN_CATEGORIES = [
+	"Best Practices",
+	"Compose",
+	"Image Size",
+	"Performance",
+	"Security"
+];
+const keysOf = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.keys(value) : [];
+const collectUnknownConfigKeys = (raw) => {
+	if (typeof raw !== "object" || raw === null) return {
+		categories: [],
+		rules: []
+	};
+	const knownRuleKeys = new Set(allRules.map((rule) => rule.key));
+	const knownCategories = new Set(KNOWN_CATEGORIES);
+	const { categories, rules } = raw;
+	return {
+		categories: keysOf(categories).filter((key) => !knownCategories.has(key)),
+		rules: keysOf(rules).filter((key) => !knownRuleKeys.has(key))
+	};
+};
+
 //#endregion
 //#region ../core/src/config/loader.ts
 const fileExists = async (filePath) => {
@@ -929,7 +1036,12 @@ const importConfig = async (filePath) => {
 		throw new ConfigError({ message: `Failed to load config file ${filePath}: ${msg}` });
 	}
 };
-const loadConfig = async (rootDir, customPath) => {
+const warnUnknownKeys = (raw, onWarning) => {
+	const unknown = collectUnknownConfigKeys(raw);
+	for (const key of unknown.rules) onWarning(`Unknown rule "${key}" in config — it matches no rule and has no effect.`);
+	for (const key of unknown.categories) onWarning(`Unknown category "${key}" in config — categories are case-sensitive (e.g. "Best Practices", "Security").`);
+};
+const loadConfig = async (rootDir, customPath, onWarning) => {
 	let configObject = null;
 	if (customPath) {
 		const fullPath = node_path.default.resolve(rootDir, customPath);
@@ -962,7 +1074,9 @@ const loadConfig = async (rootDir, customPath) => {
 	}
 	if (!configObject) return {};
 	try {
-		return validateConfig(configObject);
+		const config = validateConfig(configObject);
+		if (onWarning) warnUnknownKeys(configObject, onWarning);
+		return config;
 	} catch (error) {
 		const msg = error instanceof Error ? error.message : String(error);
 		throw new ConfigError({ message: `Invalid configuration format: ${msg}` });
@@ -1103,4 +1217,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-DOPSHVJr.cjs.map
+//# sourceMappingURL=src-ILbJuJmE.cjs.map