@docker-doctor/cli 0.5.2 → 0.6.0

package/dist/{src-D3jzc3GX.cjs → src-BpAv-H0Z.cjs}

@@ -33,7 +33,7 @@ node_path = __toESM(node_path, 1);
 let yaml = require("yaml");
 
 //#region package.json
-var version = "0.5.2";
+var version = "0.6.0";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -89,20 +89,66 @@ const createIgnoreMatcher = (patterns) => {
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
-const walk = async (dir, fileList = []) => {
-	const files = await node_fs_promises.default.readdir(dir, { withFileTypes: true });
+const PRUNED_DIRECTORIES = [
+	".git",
+	".hg",
+	".svn",
+	"node_modules",
+	"bower_components",
+	".pnpm-store",
+	".yarn",
+	".venv",
+	"venv",
+	"__pycache__",
+	".tox",
+	".mypy_cache",
+	".pytest_cache",
+	".ruff_cache",
+	".gradle",
+	".turbo",
+	".next",
+	".nuxt",
+	".svelte-kit",
+	".parcel-cache",
+	".cache",
+	"coverage",
+	"dist"
+];
+const PRUNED = new Set(PRUNED_DIRECTORIES);
+const toPosixRelative = (rootDir, file) => node_path.default.relative(rootDir, file).split(node_path.default.sep).join("/");
+const SUBTREE_SUFFIX = "/**";
+const createPrunedDirectoryMatcher = (patterns = []) => createIgnoreMatcher(patterns.filter((pattern) => pattern.endsWith(SUBTREE_SUFFIX)).map((pattern) => pattern.slice(0, -3)));
+const isPermissionError = (error) => error instanceof Error && "code" in error && (error.code === "EACCES" || error.code === "EPERM");
+const walk = async (dir, options, fileList = []) => {
+	let files;
+	try {
+		files = await node_fs_promises.default.readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		if (dir !== options.rootDir && isPermissionError(error)) {
+			options.onSkippedDirectory?.(toPosixRelative(options.rootDir, dir));
+			return fileList;
+		}
+		throw error;
+	}
 	await Promise.all(files.map(async (file) => {
 		const filePath = node_path.default.join(dir, file.name);
+		if (file.isSymbolicLink()) {
+			fileList.push(filePath);
+			return;
+		}
 		if (file.isDirectory()) {
-			if (file.name === "node_modules" || file.name === ".git" || file.name === ".next" || file.name === "dist" || file.name === ".turbo") return;
-			await walk(filePath, fileList);
+			if (PRUNED.has(file.name) || options.isPrunedByConfig(toPosixRelative(options.rootDir, filePath))) return;
+			await walk(filePath, options, fileList);
 		} else fileList.push(filePath);
 	}));
 	return fileList;
 };
-const toPosixRelative = (rootDir, file) => node_path.default.relative(rootDir, file).split(node_path.default.sep).join("/");
 const discoverProject = async (rootDir, options) => {
-	const allFiles = await walk(rootDir);
+	const allFiles = await walk(rootDir, {
+		isPrunedByConfig: createPrunedDirectoryMatcher(options?.ignoreFiles),
+		onSkippedDirectory: options?.onSkippedDirectory,
+		rootDir
+	});
 	const dockerfiles = [];
 	const composeFiles = [];
 	const dockerignores = [];
@@ -287,7 +333,7 @@ const parseDockerfile = (content, file = "Dockerfile") => {
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
 		if (!insideHeredoc && trimmed.startsWith("#")) continue;
-		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
+		if (!insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -458,6 +504,13 @@ const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	severity
 });
 
+//#endregion
+//#region ../core/src/rules/package-managers.ts
+const APT_GET_INSTALL_RE = /\bapt-get(?:\s+-\S+)*\s+install\b/u;
+const APT_GET_UPDATE_RE = /\bapt-get(?:\s+-\S+)*\s+update\b/u;
+const hasAptGetInstall = (text) => APT_GET_INSTALL_RE.test(text);
+const hasAptGetUpdate = (text) => APT_GET_UPDATE_RE.test(text);
+
 //#endregion
 //#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
@@ -473,6 +526,16 @@ const requireHealthcheck = {
 	key: "docker-doctor/require-healthcheck",
 	message: "Add a HEALTHCHECK instruction"
 };
+const AUTO_EXTRACT_SUFFIXES = [
+	".tar",
+	".tar.gz",
+	".tgz",
+	".tar.bz2",
+	".tbz2",
+	".tbz",
+	".tar.xz",
+	".txz"
+];
 const preferCopyOverAdd = {
 	category: "Best Practices",
 	check(instructions, file) {
@@ -481,7 +544,7 @@ const preferCopyOverAdd = {
 			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
-			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
+			const isArchive = AUTO_EXTRACT_SUFFIXES.some((suffix) => src.toLowerCase().endsWith(suffix));
 			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -519,8 +582,8 @@ const combineAptUpdateInstall = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
-			const hasUpdate = inst.args.includes("apt-get update");
-			const hasInstall = inst.args.includes("apt-get install");
+			const hasUpdate = hasAptGetUpdate(inst.args);
+			const hasInstall = hasAptGetInstall(inst.args);
 			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
 			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
@@ -600,18 +663,32 @@ const avoidRunCd = {
 	key: "docker-doctor/avoid-run-cd",
 	message: "Avoid changing directories with cd in RUN"
 };
+const PACKAGE_LIST_START_RE = /\b(?:apt-get(?:\s+-\S+)*\s+install|apk\s+add|yum\s+install|dnf\s+install)\b/u;
+const SHELL_SEPARATOR_RE$1 = /[;|]|&&/u;
+const WHITESPACE_RE$1 = /\s+/u;
+const collectPackageList = (raw) => {
+	const start = PACKAGE_LIST_START_RE.exec(raw);
+	if (!start) return [];
+	const packages = [];
+	const tokens = raw.slice(start.index + start[0].length).split(WHITESPACE_RE$1);
+	for (const token of tokens) {
+		if (SHELL_SEPARATOR_RE$1.test(token)) break;
+		if (token !== "" && token !== "\\" && !token.startsWith("-")) packages.push(token);
+	}
+	return packages;
+};
 const sortMultilineArgs = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { raw } = inst;
-			const isPackageInstall = raw.includes("apt-get install") || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
+			const isPackageInstall = hasAptGetInstall(raw) || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
 			const hasContinuation = raw.includes("\\\n") || raw.includes("\\\r\n");
 			if (isPackageInstall && hasContinuation) {
-				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
+				const packages = collectPackageList(raw);
 				if (packages.length > 1) {
-					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
+					const sorted = packages.toSorted();
 					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
@@ -863,48 +940,21 @@ const pinModelVersion = {
 const composeModelRules = [undefinedModelReference, pinModelVersion];
 
 //#endregion
-//#region ../core/src/rules/secret-keywords.ts
-const SECRET_KEY_PATTERNS = [
-	/password(?:[_-]|$)/iu,
-	/(?:^|[_-])secret(?:[_-]|$)/iu,
-	/(?:^|[_-])token(?:[_-]|$)/iu,
-	/(?:^|[_-])api_key(?:[_-]|$)/iu,
-	/(?:^|[_-])apikey(?:[_-]|$)/iu,
-	/(?:^|[_-])private_key(?:[_-]|$)/iu,
-	/(?:^|[_-])auth(?:[_-]|$)/iu,
-	/(?:^|[_-])pat(?:[_-]|$)/iu
-];
-const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
-const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
-const isLiteralSecretValue = (value) => value.length > 0 && !value.startsWith("$") && !CREDENTIAL_FREE_URL.test(value);
-
-//#endregion
-//#region ../core/src/rules/compose-security.ts
-const noPrivilegedService = {
-	category: "Compose",
-	check(composeContent, file, context) {
-		const diagnostics = [];
-		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
-			"services",
-			name,
-			"privileged"
-		])));
-		return diagnostics;
-	},
-	defaultSeverity: "error",
-	help: "Remove `privileged: true` and grant only what the service needs: specific capabilities via `cap_add`, or individual device access via `devices`.",
-	key: "docker-doctor/no-privileged-service",
-	message: "Do not run services in privileged mode"
-};
-const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+//#region ../core/src/rules/compose-mounts.ts
+/**
+* Shared parsing for Compose `volumes:` entries, used by every rule that
+* reasons about bind mounts. A Compose volume entry is either the short
+* `[SOURCE:]TARGET[:MODE]` string or the long-syntax object; both collapse
+* to a `VolumeMount`.
+*/
 const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
 const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
-const resolveInterpolationDefaults = (value) => value.replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const HOME_INTERPOLATION = /\$\{HOME\}|\$HOME(?![A-Za-z0-9_])/gu;
+const PWD_INTERPOLATION = /\$\{PWD\}|\$PWD(?![A-Za-z0-9_])/gu;
+const LEADING_INTERPOLATION_RE = /^\$(?:\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*)/u;
+const applyFoldsAndDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(PWD_INTERPOLATION, ".").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback);
+const resolveInterpolationDefaults = (value) => applyFoldsAndDefaults(value).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
 const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
-const isDockerSocketPath = (rawPath) => {
-	const normalized = rawPath.replaceAll("\\", "/");
-	return PATH_SHAPED.test(normalized) && (normalized.endsWith("/docker.sock") || normalized.endsWith("/pipe/docker_engine"));
-};
 const splitShortSyntax = (spec) => {
 	const parts = [];
 	let depth = 0;
@@ -922,28 +972,137 @@ const splitShortSyntax = (spec) => {
 	parts.push(current);
 	return parts;
 };
+const DRIVE_LETTER = /^[A-Za-z]$/u;
+const joinDriveLetter = (parts) => {
+	const [first, second, ...rest] = parts;
+	if (first !== void 0 && second !== void 0 && DRIVE_LETTER.test(first) && /^[\\/]/u.test(second)) return [`${first}:${second}`, ...rest];
+	return parts;
+};
+const shortSyntaxReadOnly = (mode) => mode !== void 0 && mode.split(",").includes("ro");
 const volumeMount = (volume) => {
 	if (typeof volume === "string") {
-		const [source, target] = splitShortSyntax(volume);
-		return target === void 0 ? void 0 : {
+		const [source, target, mode] = joinDriveLetter(splitShortSyntax(volume));
+		if (target === void 0) return;
+		return {
+			readOnly: shortSyntaxReadOnly(mode),
 			source,
-			target
+			target,
+			type: void 0
 		};
 	}
 	if (volume && typeof volume === "object") {
-		const { source, target } = volume;
+		const { read_only: readOnly, source, target, type } = volume;
 		return {
+			readOnly: readOnly === true,
 			source: typeof source === "string" ? source : void 0,
-			target: typeof target === "string" ? target : void 0
+			target: typeof target === "string" ? target : void 0,
+			type: typeof type === "string" ? type : void 0
 		};
 	}
 };
-const mountsDockerSocket = (volume) => {
-	const mount = volumeMount(volume);
-	if (!mount?.source) return false;
-	const resolvedSource = resolveInterpolationDefaults(mount.source);
-	if (resolvedSource !== "") return isDockerSocketPath(resolvedSource);
-	return resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+/**
+* The host path a bind mount reads from, with interpolation defaults
+* applied and Windows separators folded to `/`. Undefined when the entry is
+* not a bind mount (named volume, tmpfs, anonymous volume) or when the
+* source starts with an interpolation that has no default. A source such as
+* `${DATA_DIR}/pg` names no known host location, so no rule can say whether
+* it is inside the project.
+*/
+const bindMountSource = (mount) => {
+	if (mount.type !== void 0 && mount.type !== "bind") return;
+	if (!mount.source) return;
+	const withDefaults = applyFoldsAndDefaults(mount.source);
+	if (LEADING_INTERPOLATION_RE.test(withDefaults)) return;
+	const resolved = withDefaults.replace(INTERPOLATION_WITHOUT_DEFAULT, "").replaceAll("\\", "/");
+	if (resolved === "" || !PATH_SHAPED.test(resolved)) return;
+	return resolved;
+};
+const isDockerSocketPath = (hostPath) => hostPath.endsWith("/docker.sock") || hostPath.endsWith("/pipe/docker_engine");
+const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
+/**
+* Whether the entry bind-mounts the Docker socket, under any of its host
+* spellings. A source that starts with `${VAR}` names no known host path,
+* but a `/docker.sock` suffix or a socket target still identifies it.
+*/
+const mountsDockerSocket = (mount) => {
+	const source = bindMountSource(mount);
+	if (source !== void 0) return isDockerSocketPath(source);
+	if (mount.type !== void 0 && mount.type !== "bind") return false;
+	if (!mount.source) return false;
+	const remainder = resolveInterpolationDefaults(mount.source);
+	return isDockerSocketPath(remainder) || remainder === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+};
+const WINDOWS_DRIVE_ROOT = /^[A-Za-z]:\/?$/u;
+const WINDOWS_DRIVE_PREFIX = /^[A-Za-z]:/u;
+const SYSTEM_DIRECTORIES = [
+	"/etc",
+	"/root",
+	"/home",
+	"/Users",
+	"/proc",
+	"/sys",
+	"/boot",
+	"/run",
+	"/var/run"
+];
+const startsWithDirectory = (hostPath, directory) => hostPath === directory || hostPath.startsWith(`${directory}/`);
+/**
+* Classifies where on the host a bind-mount source points. `project` is a
+* relative path that stays inside the Compose project directory; everything
+* else reaches outside it.
+*/
+const classifyHostPath = (hostPath) => {
+	const collapsed = node_path.default.posix.normalize(hostPath);
+	const normalized = collapsed.length > 1 ? collapsed.replace(/\/+$/u, "") : collapsed;
+	if (normalized === "~") return "home";
+	if (normalized.startsWith("~/")) return normalized.startsWith("~/.") ? "home-dotfile" : "host";
+	if (normalized === "." || normalized.startsWith("./")) return "project";
+	if (normalized === ".." || normalized.startsWith("../")) return "parent";
+	if (WINDOWS_DRIVE_ROOT.test(normalized)) return "root";
+	if (WINDOWS_DRIVE_PREFIX.test(normalized)) return "host";
+	if (normalized === "/") return "root";
+	if (!normalized.startsWith("/")) return "project";
+	for (const directory of SYSTEM_DIRECTORIES) if (startsWithDirectory(normalized, directory)) return "system";
+	return "host";
+};
+
+//#endregion
+//#region ../core/src/rules/secret-keywords.ts
+const SECRET_KEY_PATTERNS = [
+	/password(?:[_-]|$)/iu,
+	/(?:^|[_-])secret(?:[_-]|$)/iu,
+	/(?:^|[_-])token(?:[_-]|$)/iu,
+	/(?:^|[_-])api_key(?:[_-]|$)/iu,
+	/(?:^|[_-])apikey(?:[_-]|$)/iu,
+	/(?:^|[_-])private_key(?:[_-]|$)/iu,
+	/(?:^|[_-])auth(?:[_-]|$)/iu,
+	/(?:^|[_-])pat(?:[_-]|$)/iu
+];
+const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
+const SURROUNDING_QUOTES_RE = /^(?<quote>["'])(?<inner>.*)\k<quote>$/su;
+const isLiteralSecretValue = (value) => {
+	const unquoted = value.match(SURROUNDING_QUOTES_RE)?.groups?.inner ?? value;
+	return unquoted.length > 0 && !unquoted.startsWith("$") && !CREDENTIAL_FREE_URL.test(unquoted);
+};
+
+//#endregion
+//#region ../core/src/rules/compose-security.ts
+const noPrivilegedService = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+			"services",
+			name,
+			"privileged"
+		])));
+		return diagnostics;
+	},
+	defaultSeverity: "error",
+	help: "Remove `privileged: true` and grant only what the service needs: specific capabilities via `cap_add`, or individual device access via `devices`.",
+	key: "docker-doctor/no-privileged-service",
+	message: "Do not run services in privileged mode"
 };
 const noDockerSocketMount = {
 	category: "Compose",
@@ -952,12 +1111,15 @@ const noDockerSocketMount = {
 		for (const [name, config] of composeServices(composeContent)) {
 			const { volumes } = config;
 			if (!Array.isArray(volumes)) continue;
-			for (const [index, volume] of volumes.entries()) if (mountsDockerSocket(volume)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
-				"services",
-				name,
-				"volumes",
-				index
-			])));
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (mount && mountsDockerSocket(mount)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts the Docker socket. Anything running in this container can control the Docker daemon: start privileged containers, read every volume, and escape to the host.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
 		}
 		return diagnostics;
 	},
@@ -966,6 +1128,73 @@ const noDockerSocketMount = {
 	key: "docker-doctor/no-docker-socket-mount",
 	message: "Do not bind-mount the Docker socket into services"
 };
+const BROAD_SCOPE_REASONS = {
+	home: "the whole home directory",
+	"home-dotfile": "a hidden directory under the home directory, where credentials and tool configuration live",
+	parent: "a directory above the Compose project",
+	root: "the host's root filesystem",
+	system: "a host system directory"
+};
+const noBroadBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0) continue;
+				const reason = BROAD_SCOPE_REASONS[classifyHostPath(source)];
+				if (reason === void 0) continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts '${source}', ${reason}. Everything under it is readable by the container, and a writable mount is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "warning",
+	help: "Mount the narrowest directory the service actually reads (`./data`, not `~` or `/`), and add `:ro` unless the service must write to it. Host paths the service only needs at build time belong in the image instead.",
+	key: "docker-doctor/no-broad-bind-mount",
+	message: "Do not bind-mount broad host directories into services"
+};
+const preferReadOnlyBindMount = {
+	category: "Compose",
+	check(composeContent, file, context) {
+		const diagnostics = [];
+		for (const [name, config] of composeServices(composeContent)) {
+			const { volumes } = config;
+			if (!Array.isArray(volumes)) continue;
+			for (const [index, volume] of volumes.entries()) {
+				const mount = volumeMount(volume);
+				if (!mount || mount.readOnly || mountsDockerSocket(mount)) continue;
+				const source = bindMountSource(mount);
+				if (source === void 0 || classifyHostPath(source) === "project") continue;
+				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' bind-mounts host path '${source}' read-write. A writable host mount lets the container change files outside the project, and is the foothold for VM-escape bugs like CVE-2026-77179.`, this.help, context?.locate?.([
+					"services",
+					name,
+					"volumes",
+					index
+				])));
+			}
+		}
+		return diagnostics;
+	},
+	defaultSeverity: "info",
+	help: "Append `:ro` to the short syntax, or set `read_only: true` in the long syntax, unless the service must write to the host path.",
+	key: "docker-doctor/prefer-read-only-bind-mount",
+	message: "Bind mounts outside the project should be read-only"
+};
+const literalValue = (value) => {
+	if (typeof value === "string") return value;
+	if (typeof value === "number") return String(value);
+};
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -981,15 +1210,16 @@ const noPlaintextSecrets = {
 				if (eqIndex <= 0) continue;
 				const key = entry.slice(0, eqIndex);
 				const value = entry.slice(eqIndex + 1);
-				if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+				if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
 					index
 				]));
 			}
-			else if (environment && typeof environment === "object") {
-				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+			else if (environment && typeof environment === "object") for (const [key, value] of Object.entries(environment)) {
+				const literal = literalValue(value);
+				if (literal !== void 0 && isSecretKey(key) && isLiteralSecretValue(literal)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
@@ -1007,6 +1237,8 @@ const noPlaintextSecrets = {
 const composeSecurityRules = [
 	noPrivilegedService,
 	noDockerSocketMount,
+	noBroadBindMount,
+	preferReadOnlyBindMount,
 	noPlaintextSecrets
 ];
 
@@ -1047,7 +1279,7 @@ const cleanPackageCache = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (hasAptGetInstall(args) && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
 			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -1057,7 +1289,40 @@ const cleanPackageCache = {
 	key: "docker-doctor/clean-package-cache",
 	message: "Clean up package manager cache in the same RUN layer"
 };
-const installsDevDependencies = (args) => (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune");
+const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/u;
+const WHITESPACE_RE = /\s+/u;
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/u;
+const NODE_PACKAGE_MANAGERS = /* @__PURE__ */ new Set([
+	"npm",
+	"yarn",
+	"pnpm",
+	"bun"
+]);
+const INSTALL_VERBS = /* @__PURE__ */ new Set([
+	"install",
+	"ci",
+	"i"
+]);
+const NON_DEV_INSTALL_FLAGS = /* @__PURE__ */ new Set([
+	"-g",
+	"--global",
+	"--production",
+	"--omit=dev",
+	"--only=prod",
+	"--only=production",
+	"--prod",
+	"-P",
+	"-p"
+]);
+const segmentInstallsDevDependencies = (segment) => {
+	const tokens = segment.split(WHITESPACE_RE).filter(Boolean);
+	const commandStart = tokens.findIndex((token) => !ENV_ASSIGNMENT_RE.test(token));
+	if (commandStart === -1) return false;
+	const [manager, verb, ...options] = tokens.slice(commandStart);
+	if (!(NODE_PACKAGE_MANAGERS.has(manager) && INSTALL_VERBS.has(verb))) return false;
+	return !tokens.slice(0, commandStart).includes("NODE_ENV=production") && options.every((option) => option.startsWith("-") && !NON_DEV_INSTALL_FLAGS.has(option));
+};
+const installsDevDependencies = (args) => !args.includes("prune") && maskQuotedText(args).split(SHELL_SEPARATOR_RE).some(segmentInstallsDevDependencies);
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
@@ -1103,11 +1368,12 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
+const BUILD_TOOL_COMMAND_RE = /(?:^|&&|\|\||;|\||\(|`|\$\()\s*(?:make|cmake)(?=\s|$)/u;
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || BUILD_TOOL_COMMAND_RE.test(maskQuotedText(inst.args))))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -1166,7 +1432,8 @@ const hasDockerignoreFor = (dockerfilePath, projectFiles) => {
 	const lastSlash = dockerfilePath.lastIndexOf("/");
 	const dir = lastSlash === -1 ? "" : dockerfilePath.slice(0, lastSlash);
 	const adjacent = dir === "" ? ".dockerignore" : `${dir}/.dockerignore`;
-	return projectFiles.some((f) => f === adjacent || f === ".dockerignore");
+	const perDockerfile = `${dockerfilePath}.dockerignore`;
+	return projectFiles.some((f) => f === adjacent || f === perDockerfile || f === ".dockerignore");
 };
 const useDockerignore = {
 	category: "Performance",
@@ -1578,13 +1845,13 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 3;
+const REPORT_SCHEMA_VERSION = 4;
 const resolveCategory = (diagnostic) => {
 	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
 	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
 	return category;
 };
-const toJsonReport = (diagnostics, score, label, project) => ({
+const toJsonReport = (diagnostics, score, label, project, failures = []) => ({
 	diagnostics: diagnostics.map((d) => ({
 		category: resolveCategory(d),
 		column: d.column,
@@ -1595,9 +1862,13 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 		rule: d.rule,
 		severity: d.severity
 	})),
+	failures: failures.map(({ file, message }) => ({
+		file,
+		message
+	})),
 	label,
 	project,
-	schemaVersion: 3,
+	schemaVersion: 4,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
@@ -1681,4 +1952,4 @@ Object.defineProperty(exports, 'version', {
     return version;
   }
 });
-//# sourceMappingURL=src-D3jzc3GX.cjs.map
+//# sourceMappingURL=src-BpAv-H0Z.cjs.map