@docker-doctor/cli 0.5.2 → 0.6.0

package/dist/{src-BOGzkp17.mjs → src-BLeXr_hR.mjs}

@@ -4,7 +4,7 @@ import path from "node:path";
 import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
 
 //#region package.json
-var version = "0.5.2";
+var version = "0.6.0";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -60,20 +60,66 @@ const createIgnoreMatcher = (patterns) => {
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
-const walk = async (dir, fileList = []) => {
-	const files = await fs.readdir(dir, { withFileTypes: true });
+const PRUNED_DIRECTORIES = [
+	".git",
+	".hg",
+	".svn",
+	"node_modules",
+	"bower_components",
+	".pnpm-store",
+	".yarn",
+	".venv",
+	"venv",
+	"__pycache__",
+	".tox",
+	".mypy_cache",
+	".pytest_cache",
+	".ruff_cache",
+	".gradle",
+	".turbo",
+	".next",
+	".nuxt",
+	".svelte-kit",
+	".parcel-cache",
+	".cache",
+	"coverage",
+	"dist"
+];
+const PRUNED = new Set(PRUNED_DIRECTORIES);
+const toPosixRelative = (rootDir, file) => path.relative(rootDir, file).split(path.sep).join("/");
+const SUBTREE_SUFFIX = "/**";
+const createPrunedDirectoryMatcher = (patterns = []) => createIgnoreMatcher(patterns.filter((pattern) => pattern.endsWith(SUBTREE_SUFFIX)).map((pattern) => pattern.slice(0, -3)));
+const isPermissionError = (error) => error instanceof Error && "code" in error && (error.code === "EACCES" || error.code === "EPERM");
+const walk = async (dir, options, fileList = []) => {
+	let files;
+	try {
+		files = await fs.readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		if (dir !== options.rootDir && isPermissionError(error)) {
+			options.onSkippedDirectory?.(toPosixRelative(options.rootDir, dir));
+			return fileList;
+		}
+		throw error;
+	}
 	await Promise.all(files.map(async (file) => {
 		const filePath = path.join(dir, file.name);
+		if (file.isSymbolicLink()) {
+			fileList.push(filePath);
+			return;
+		}
 		if (file.isDirectory()) {
-			if (file.name === "node_modules" || file.name === ".git" || file.name === ".next" || file.name === "dist" || file.name === ".turbo") return;
-			await walk(filePath, fileList);
+			if (PRUNED.has(file.name) || options.isPrunedByConfig(toPosixRelative(options.rootDir, filePath))) return;
+			await walk(filePath, options, fileList);
 		} else fileList.push(filePath);
 	}));
 	return fileList;
 };
-const toPosixRelative = (rootDir, file) => path.relative(rootDir, file).split(path.sep).join("/");
 const discoverProject = async (rootDir, options) => {
-	const allFiles = await walk(rootDir);
+	const allFiles = await walk(rootDir, {
+		isPrunedByConfig: createPrunedDirectoryMatcher(options?.ignoreFiles),
+		onSkippedDirectory: options?.onSkippedDirectory,
+		rootDir
+	});
 	const dockerfiles = [];
 	const composeFiles = [];
 	const dockerignores = [];
@@ -258,7 +304,7 @@ const parseDockerfile = (content, file = "Dockerfile") => {
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
 		if (!insideHeredoc && trimmed.startsWith("#")) continue;
-		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
+		if (!insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -429,6 +475,13 @@ const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	severity
 });
 
+//#endregion
+//#region ../core/src/rules/package-managers.ts
+const APT_GET_INSTALL_RE = /\bapt-get(?:\s+-\S+)*\s+install\b/u;
+const APT_GET_UPDATE_RE = /\bapt-get(?:\s+-\S+)*\s+update\b/u;
+const hasAptGetInstall = (text) => APT_GET_INSTALL_RE.test(text);
+const hasAptGetUpdate = (text) => APT_GET_UPDATE_RE.test(text);
+
 //#endregion
 //#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
@@ -444,6 +497,16 @@ const requireHealthcheck = {
 	key: "docker-doctor/require-healthcheck",
 	message: "Add a HEALTHCHECK instruction"
 };
+const AUTO_EXTRACT_SUFFIXES = [
+	".tar",
+	".tar.gz",
+	".tgz",
+	".tar.bz2",
+	".tbz2",
+	".tbz",
+	".tar.xz",
+	".txz"
+];
 const preferCopyOverAdd = {
 	category: "Best Practices",
 	check(instructions, file) {
@@ -452,7 +515,7 @@ const preferCopyOverAdd = {
 			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
-			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
+			const isArchive = AUTO_EXTRACT_SUFFIXES.some((suffix) => src.toLowerCase().endsWith(suffix));
 			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -490,8 +553,8 @@ const combineAptUpdateInstall = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
-			const hasUpdate = inst.args.includes("apt-get update");
-			const hasInstall = inst.args.includes("apt-get install");
+			const hasUpdate = hasAptGetUpdate(inst.args);
+			const hasInstall = hasAptGetInstall(inst.args);
 			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
 			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
@@ -571,18 +634,32 @@ const avoidRunCd = {
 	key: "docker-doctor/avoid-run-cd",
 	message: "Avoid changing directories with cd in RUN"
 };
+const PACKAGE_LIST_START_RE = /\b(?:apt-get(?:\s+-\S+)*\s+install|apk\s+add|yum\s+install|dnf\s+install)\b/u;
+const SHELL_SEPARATOR_RE$1 = /[;|]|&&/u;
+const WHITESPACE_RE$1 = /\s+/u;
+const collectPackageList = (raw) => {
+	const start = PACKAGE_LIST_START_RE.exec(raw);
+	if (!start) return [];
+	const packages = [];
+	const tokens = raw.slice(start.index + start[0].length).split(WHITESPACE_RE$1);
+	for (const token of tokens) {
+		if (SHELL_SEPARATOR_RE$1.test(token)) break;
+		if (token !== "" && token !== "\\" && !token.startsWith("-")) packages.push(token);
+	}
+	return packages;
+};
 const sortMultilineArgs = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { raw } = inst;
-			const isPackageInstall = raw.includes("apt-get install") || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
+			const isPackageInstall = hasAptGetInstall(raw) || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
 			const hasContinuation = raw.includes("\\\n") || raw.includes("\\\r\n");
 			if (isPackageInstall && hasContinuation) {
-				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
+				const packages = collectPackageList(raw);
 				if (packages.length > 1) {
-					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
+					const sorted = packages.toSorted();
 					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
@@ -834,48 +911,21 @@ const pinModelVersion = {
 const composeModelRules = [undefinedModelReference, pinModelVersion];
 
 //#endregion
-//#region ../core/src/rules/secret-keywords.ts
-const SECRET_KEY_PATTERNS = [
-	/password(?:[_-]|$)/iu,
-	/(?:^|[_-])secret(?:[_-]|$)/iu,
-	/(?:^|[_-])token(?:[_-]|$)/iu,
-	/(?:^|[_-])api_key(?:[_-]|$)/iu,
-	/(?:^|[_-])apikey(?:[_-]|$)/iu,
-	/(?:^|[_-])private_key(?:[_-]|$)/iu,
-	/(?:^|[_-])auth(?:[_-]|$)/iu,
-	/(?:^|[_-])pat(?:[_-]|$)/iu
-];
-const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
-const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
-const isLiteralSecretValue = (value) => value.length > 0 && !value.startsWith("$") && !CREDENTIAL_FREE_URL.test(value);
-
-//#endregion
-//#region ../core/src/rules/compose-security.ts
-const noPrivilegedService = {
-	category: "Compose",
-	check(composeContent, file, context) {
-		const diagnostics = [];
-		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
-			"services",
-			name,
-			"privileged"
-		])));
-		return diagnostics;
-	},
-	defaultSeverity: "error",
-	help: "Remove `privileged: true` and grant only what the service needs: specific capabilities via `cap_add`, or individual device access via `devices`.",
-	key: "docker-doctor/no-privileged-service",
-	message: "Do not run services in privileged mode"
-};
-const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+//#region ../core/src/rules/compose-mounts.ts
+/**
+* Shared parsing for Compose `volumes:` entries, used by every rule that
+* reasons about bind mounts. A Compose volume entry is either the short
+* `[SOURCE:]TARGET[:MODE]` string or the long-syntax object; both collapse
+* to a `VolumeMount`.
+*/
 const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
 const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
-const resolveInterpolationDefaults = (value) => value.replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const HOME_INTERPOLATION = /\$\{HOME\}|\$HOME(?![A-Za-z0-9_])/gu;
+const PWD_INTERPOLATION = /\$\{PWD\}|\$PWD(?![A-Za-z0-9_])/gu;
+const LEADING_INTERPOLATION_RE = /^\$(?:\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*)/u;
+const applyFoldsAndDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(PWD_INTERPOLATION, ".").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback);
+const resolveInterpolationDefaults = (value) => applyFoldsAndDefaults(value).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
 const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
-const isDockerSocketPath = (rawPath) => {
-	const normalized = rawPath.replaceAll("\\", "/");
-	return PATH_SHAPED.test(normalized) && (normalized.endsWith("/docker.sock") || normalized.endsWith("/pipe/docker_engine"));
-};
 const splitShortSyntax = (spec) => {
 	const parts = [];
 	let depth = 0;
@@ -893,28 +943,137 @@ const splitShortSyntax = (spec) => {
 	parts.push(current);
 	return parts;
 };
+const DRIVE_LETTER = /^[A-Za-z]$/u;
+const joinDriveLetter = (parts) => {
+	const [first, second, ...rest] = parts;
+	if (first !== void 0 && second !== void 0 && DRIVE_LETTER.test(first) && /^[\\/]/u.test(second)) return [`${first}:${second}`, ...rest];
+	return parts;
+};
+const shortSyntaxReadOnly = (mode) => mode !== void 0 && mode.split(",").includes("ro");
 const volumeMount = (volume) => {
 	if (typeof volume === "string") {
-		const [source, target] = splitShortSyntax(volume);
-		return target === void 0 ? void 0 : {
+		const [source, target, mode] = joinDriveLetter(splitShortSyntax(volume));
+		if (target === void 0) return;
+		return {
+			readOnly: shortSyntaxReadOnly(mode),
 			source,
-			target
+			target,
+			type: void 0
 		};
 	}
 	if (volume && typeof volume === "object") {
-		const { source, target } = volume;
+		const { read_only: readOnly, source, target, type } = volume;
 		return {
+			readOnly: readOnly === true,
 			source: typeof source === "string" ? source : void 0,
-			target: typeof target === "string" ? target : void 0
+			target: typeof target === "string" ? target : void 0,
+			type: typeof type === "string" ? type : void 0
 		};
 	}
 };
-const mountsDockerSocket = (volume) => {
-	const mount = volumeMount(volume);
-	if (!mount?.source) return false;
-	const resolvedSource = resolveInterpolationDefaults(mount.source);
-	if (resolvedSource !== "") return isDockerSocketPath(resolvedSource);
-	return resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+/**
+* The host path a bind mount reads from, with interpolation defaults
+* applied and Windows separators folded to `/`. Undefined when the entry is
+* not a bind mount (named volume, tmpfs, anonymous volume) or when the
+* source starts with an interpolation that has no default. A source such as
+* `${DATA_DIR}/pg` names no known host location, so no rule can say whether
+* it is inside the project.
+*/
+const bindMountSource = (mount) => {
+	if (mount.type !== void 0 && mount.type !== "bind") return;
+	if (!mount.source) return;
+	const withDefaults = applyFoldsAndDefaults(mount.source);
+	if (LEADING_INTERPOLATION_RE.test(withDefaults)) return;
+	const resolved = withDefaults.replace(INTERPOLATION_WITHOUT_DEFAULT, "").replaceAll("\\", "/");
+	if (resolved === "" || !PATH_SHAPED.test(resolved)) return;
+	return resolved;
+};
+const isDockerSocketPath = (hostPath) => hostPath.endsWith("/docker.sock") || hostPath.endsWith("/pipe/docker_engine");
+const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+/**
+* Whether the entry bind-mounts the Docker socket, under any of its host
+* spellings. A source that starts with `${VAR}` names no known host path,
+* but a `/docker.sock` suffix or a socket target still identifies it.
+*/
+const mountsDockerSocket = (mount) => {
+	const source = bindMountSource(mount);
+	if (source !== void 0) return isDockerSocketPath(source);
+	if (mount.type !== void 0 && mount.type !== "bind") return false;
+	if (!mount.source) return false;
+	const remainder = resolveInterpolationDefaults(mount.source);
+	return isDockerSocketPath(remainder) || remainder === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+};
+const WINDOWS_DRIVE_ROOT = /^[A-Za-z]:\/?$/u;
+const WINDOWS_DRIVE_PREFIX = /^[A-Za-z]:/u;
+const SYSTEM_DIRECTORIES = [
+	"/etc",
+	"/root",
+	"/home",
+	"/Users",
+	"/proc",
+	"/sys",
+	"/boot",
+	"/run",
+	"/var/run"
+];
+const startsWithDirectory = (hostPath, directory) => hostPath === directory || hostPath.startsWith(`${directory}/`);
+/**
+* Classifies where on the host a bind-mount source points. `project` is a
+* relative path that stays inside the Compose project directory; everything
+* else reaches outside it.
+*/
+const classifyHostPath = (hostPath) => {
+	const collapsed = path.posix.normalize(hostPath);
+	const normalized = collapsed.length > 1 ? collapsed.replace(/\/+$/u, "") : collapsed;
+	if (normalized === "~") return "home";
+	if (normalized.startsWith("~/")) return normalized.startsWith("~/.") ? "home-dotfile" : "host";
+	if (normalized === "." || normalized.startsWith("./")) return "project";
+	if (normalized === ".." || normalized.startsWith("../")) return "parent";
+	if (WINDOWS_DRIVE_ROOT.test(normalized)) return "root";
+	if (WINDOWS_DRIVE_PREFIX.test(normalized)) return "host";
+	if (normalized === "/") return "root";
+	if (!normalized.startsWith("/")) return "project";
+	for (const directory of SYSTEM_DIRECTORIES) if (startsWithDirectory(normalized, directory)) return "system";
+	return "host";
+};
+
+//#endregion
+//#region ../core/src/rules/secret-keywords.ts
+const SECRET_KEY_PATTERNS = [
+	/password(?:[_-]|$)/iu,
+	/(?:^|[_-])secret(?:[_-]|$)/iu,
+	/(?:^|[_-])token(?:[_-]|$)/iu,
+	/(?:^|[_-])api_key(?:[_-]|$)/iu,
+	/(?:^|[_-])apikey(?:[_-]|$)/iu,
+	/(?:^|[_-])private_key(?:[_-]|$)/iu,
+	/(?:^|[_-])auth(?:[_-]|$)/iu,
+	/(?:^|[_-])pat(?:[_-]|$)/iu
+];
+const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
+const SURROUNDING_QUOTES_RE = /^(?<quote>["'])(?<inner>.*)\k<quote>$/su;
+const isLiteralSecretValue = (value) => {
+	const unquoted = value.match(SURROUNDING_QUOTES_RE)?.groups?.inner ?? value;
+	return unquoted.length > 0 && !unquoted.startsWith("$") && !CREDENTIAL_FREE_URL.test(unquoted);
+};
+
+//#endregion
+//#region ../core/src/rules/compose-security.ts
+const noPrivilegedService = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+			"services",
+			name,
+			"privileged"
+		])));
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Remove `privileged: true` and grant only what the service needs: specific capabilities via `cap_add`, or individual device access via `devices`.",
+	key: "docker-doctor/no-privileged-service",
+	message: "Do not run services in privileged mode"
 };
 const noDockerSocketMount = {
 	category: "Compose",
@@ -923,12 +1082,15 @@ const noDockerSocketMount = {
 		for (const [name, config] of composeServices(composeContent)) {
 			const { volumes } = config;
 			if (!Array.isArray(volumes)) continue;
-			for (const [index, volume] of volumes.entries()) if (mountsDockerSocket(volume)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
-				"services",
-				name,
-				"volumes",
-				index
-			])));
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (mount && mountsDockerSocket(mount)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
 		}
 		return diagnostics;
 	},
@@ -937,6 +1099,73 @@ const noDockerSocketMount = {
 	key: "docker-doctor/no-docker-socket-mount",
 	message: "Do not bind-mount the Docker socket into services"
 };
+const BROAD_SCOPE_REASONS = {
+	home: "the whole home directory",
+	"home-dotfile": "a hidden directory under the home directory, where credentials and tool configuration live",
+	parent: "a directory above the Compose project",
+	root: "the host's root filesystem",
+	system: "a host system directory"
+};
+const noBroadBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0) continue;
+				const reason = BROAD_SCOPE_REASONS[classifyHostPath(source)];
+				if (reason === void 0) continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts '${source}', ${reason}. Everything under it is readable by the container, and a writable mount is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Mount the narrowest directory the service actually reads (`./data`, not `~` or `/`), and add `:ro` unless the service must write to it. Host paths the service only needs at build time belong in the image instead.",
+	key: "docker-doctor/no-broad-bind-mount",
+	message: "Do not bind-mount broad host directories into services"
+};
+const preferReadOnlyBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mount.readOnly || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0 || classifyHostPath(source) === "project") continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts host path '${source}' read-write. A writable host mount lets the container change files outside the project, and is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Append `:ro` to the short syntax, or set `read_only: true` in the long syntax, unless the service must write to the host path.",
+	key: "docker-doctor/prefer-read-only-bind-mount",
+	message: "Bind mounts outside the project should be read-only"
+};
+const literalValue = (value) => {
+	if (typeof value === "string") return value;
+	if (typeof value === "number") return String(value);
+};
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -952,15 +1181,16 @@ const noPlaintextSecrets = {
 				if (eqIndex <= 0) continue;
 				const key = entry.slice(0, eqIndex);
 				const value = entry.slice(eqIndex + 1);
-				if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+				if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
 					index
 				]));
 			}
-			else if (environment && typeof environment === "object") {
-				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+			else if (environment && typeof environment === "object") for (const [key, value] of Object.entries(environment)) {
+				const literal = literalValue(value);
+				if (literal !== void 0 && isSecretKey(key) && isLiteralSecretValue(literal)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
@@ -978,6 +1208,8 @@ const noPlaintextSecrets = {
 const composeSecurityRules = [
 	noPrivilegedService,
 	noDockerSocketMount,
+	noBroadBindMount,
+	preferReadOnlyBindMount,
 	noPlaintextSecrets
 ];
 
@@ -1018,7 +1250,7 @@ const cleanPackageCache = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (hasAptGetInstall(args) && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
 			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -1028,7 +1260,40 @@ const cleanPackageCache = {
 	key: "docker-doctor/clean-package-cache",
 	message: "Clean up package manager cache in the same RUN layer"
 };
-const installsDevDependencies = (args) => (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune");
+const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/u;
+const WHITESPACE_RE = /\s+/u;
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/u;
+const NODE_PACKAGE_MANAGERS = /* @__PURE__ */ new Set([
+	"npm",
+	"yarn",
+	"pnpm",
+	"bun"
+]);
+const INSTALL_VERBS = /* @__PURE__ */ new Set([
+	"install",
+	"ci",
+	"i"
+]);
+const NON_DEV_INSTALL_FLAGS = /* @__PURE__ */ new Set([
+	"-g",
+	"--global",
+	"--production",
+	"--omit=dev",
+	"--only=prod",
+	"--only=production",
+	"--prod",
+	"-P",
+	"-p"
+]);
+const segmentInstallsDevDependencies = (segment) => {
+	const tokens = segment.split(WHITESPACE_RE).filter(Boolean);
+	const commandStart = tokens.findIndex((token) => !ENV_ASSIGNMENT_RE.test(token));
+	if (commandStart === -1) return false;
+	const [manager, verb, ...options] = tokens.slice(commandStart);
+	if (!(NODE_PACKAGE_MANAGERS.has(manager) && INSTALL_VERBS.has(verb))) return false;
+	return !tokens.slice(0, commandStart).includes("NODE_ENV=production") && options.every((option) => option.startsWith("-") && !NON_DEV_INSTALL_FLAGS.has(option));
+};
+const installsDevDependencies = (args) => !args.includes("prune") && maskQuotedText(args).split(SHELL_SEPARATOR_RE).some(segmentInstallsDevDependencies);
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
@@ -1074,11 +1339,12 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
+const BUILD_TOOL_COMMAND_RE = /(?:^|&&|\|\||;|\||\(|`|\$\()\s*(?:make|cmake)(?=\s|$)/u;
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || BUILD_TOOL_COMMAND_RE.test(maskQuotedText(inst.args))))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -1137,7 +1403,8 @@ const hasDockerignoreFor = (dockerfilePath, projectFiles) => {
 	const lastSlash = dockerfilePath.lastIndexOf("/");
 	const dir = lastSlash === -1 ? "" : dockerfilePath.slice(0, lastSlash);
 	const adjacent = dir === "" ? ".dockerignore" : `${dir}/.dockerignore`;
-	return projectFiles.some((f) => f === adjacent || f === ".dockerignore");
+	const perDockerfile = `${dockerfilePath}.dockerignore`;
+	return projectFiles.some((f) => f === adjacent || f === perDockerfile || f === ".dockerignore");
 };
 const useDockerignore = {
 	category: "Performance",
@@ -1549,13 +1816,13 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 3;
+const REPORT_SCHEMA_VERSION = 4;
 const resolveCategory = (diagnostic) => {
 	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
 	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
 	return category;
 };
-const toJsonReport = (diagnostics, score, label, project) => ({
+const toJsonReport = (diagnostics, score, label, project, failures = []) => ({
 	diagnostics: diagnostics.map((d) => ({
 		category: resolveCategory(d),
 		column: d.column,
@@ -1566,13 +1833,17 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 		rule: d.rule,
 		severity: d.severity
 	})),
+	failures: failures.map(({ file, message }) => ({
+		file,
+		message
+	})),
 	label,
 	project,
-	schemaVersion: 3,
+	schemaVersion: 4,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
 
 //#endregion
 export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
-//# sourceMappingURL=src-BOGzkp17.mjs.map
+//# sourceMappingURL=src-BLeXr_hR.mjs.map