@docker-doctor/cli 0.5.3 → 0.6.1

package/dist/{src-CklEIXTX.mjs → src-DiEWLJ6g.mjs}

@@ -2,9 +2,10 @@
 import fs from "node:fs/promises";
 import path from "node:path";
 import { LineCounter, isAlias, isMap, isScalar, isSeq, parse, parseDocument } from "yaml";
+import { pathToFileURL } from "node:url";
 
 //#region package.json
-var version = "0.5.3";
+var version = "0.6.1";
 
 //#endregion
 //#region ../core/src/project-info/ignore.ts
@@ -44,6 +45,17 @@ const globToRegExp = (pattern) => {
 	}
 	return new RegExp(`${source}$`, "u");
 };
+const LEADING_DOT_SLASH_RE = /^(?:\.\/)+/u;
+/**
+* Accepts two spellings people bring from `.gitignore`. A leading `./` is
+* dropped because patterns are already root-relative, and a trailing `/`
+* means the whole directory. `vendor/` and `./vendor/**` both become
+* `vendor/**`.
+*/
+const normalizeIgnorePattern = (pattern) => {
+	const rootRelative = pattern.replace(LEADING_DOT_SLASH_RE, "");
+	return rootRelative.endsWith("/") ? `${rootRelative}**` : rootRelative;
+};
 /**
 * Builds a predicate over root-relative paths from `ignore.files`
 * patterns. Windows separators in the tested path are normalized to `/`
@@ -51,7 +63,7 @@ const globToRegExp = (pattern) => {
 */
 const createIgnoreMatcher = (patterns) => {
 	if (!patterns || patterns.length === 0) return () => false;
-	const regexps = patterns.map(globToRegExp);
+	const regexps = patterns.map(normalizeIgnorePattern).map(globToRegExp);
 	return (relativePath) => {
 		const normalized = relativePath.replaceAll("\\", "/");
 		return regexps.some((regexp) => regexp.test(normalized));
@@ -60,20 +72,66 @@ const createIgnoreMatcher = (patterns) => {
 
 //#endregion
 //#region ../core/src/project-info/discover.ts
-const walk = async (dir, fileList = []) => {
-	const files = await fs.readdir(dir, { withFileTypes: true });
+const PRUNED_DIRECTORIES = [
+	".git",
+	".hg",
+	".svn",
+	"node_modules",
+	"bower_components",
+	".pnpm-store",
+	".yarn",
+	".venv",
+	"venv",
+	"__pycache__",
+	".tox",
+	".mypy_cache",
+	".pytest_cache",
+	".ruff_cache",
+	".gradle",
+	".turbo",
+	".next",
+	".nuxt",
+	".svelte-kit",
+	".parcel-cache",
+	".cache",
+	"coverage",
+	"dist"
+];
+const PRUNED = new Set(PRUNED_DIRECTORIES);
+const toPosixRelative = (rootDir, file) => path.relative(rootDir, file).split(path.sep).join("/");
+const SUBTREE_SUFFIX = "/**";
+const createPrunedDirectoryMatcher = (patterns = []) => createIgnoreMatcher(patterns.map(normalizeIgnorePattern).filter((pattern) => pattern.endsWith(SUBTREE_SUFFIX)).map((pattern) => pattern.slice(0, -3)));
+const isPermissionError = (error) => error instanceof Error && "code" in error && (error.code === "EACCES" || error.code === "EPERM");
+const walk = async (dir, options, fileList = []) => {
+	let files;
+	try {
+		files = await fs.readdir(dir, { withFileTypes: true });
+	} catch (error) {
+		if (dir !== options.rootDir && isPermissionError(error)) {
+			options.onSkippedDirectory?.(toPosixRelative(options.rootDir, dir));
+			return fileList;
+		}
+		throw error;
+	}
 	await Promise.all(files.map(async (file) => {
 		const filePath = path.join(dir, file.name);
+		if (file.isSymbolicLink()) {
+			fileList.push(filePath);
+			return;
+		}
 		if (file.isDirectory()) {
-			if (file.name === "node_modules" || file.name === ".git" || file.name === ".next" || file.name === "dist" || file.name === ".turbo") return;
-			await walk(filePath, fileList);
+			if (PRUNED.has(file.name) || options.isPrunedByConfig(toPosixRelative(options.rootDir, filePath))) return;
+			await walk(filePath, options, fileList);
 		} else fileList.push(filePath);
 	}));
 	return fileList;
 };
-const toPosixRelative = (rootDir, file) => path.relative(rootDir, file).split(path.sep).join("/");
 const discoverProject = async (rootDir, options) => {
-	const allFiles = await walk(rootDir);
+	const allFiles = await walk(rootDir, {
+		isPrunedByConfig: createPrunedDirectoryMatcher(options?.ignoreFiles),
+		onSkippedDirectory: options?.onSkippedDirectory,
+		rootDir
+	});
 	const dockerfiles = [];
 	const composeFiles = [];
 	const dockerignores = [];
@@ -190,7 +248,7 @@ const HEREDOC_INSTRUCTIONS = /* @__PURE__ */ new Set([
 	"RUN"
 ]);
 const INSTRUCTION_LINE_RE = /^(?<inst>[A-Za-z]+)\s+(?<args>.*)$/u;
-const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>\w+)\k<quote>/gu;
+const HEREDOC_OPENER_RE = /(?<=^|\s)<<-?(?<quote>['"]?)(?<delim>[^\s'"<>;&|()]+)\k<quote>/gu;
 const createParserState = () => ({
 	currentArgs: "",
 	currentInstruction: "",
@@ -258,7 +316,7 @@ const parseDockerfile = (content, file = "Dockerfile") => {
 		const lineNum = i + 1;
 		const insideHeredoc = state.heredocQueue.length > 0;
 		if (!insideHeredoc && trimmed.startsWith("#")) continue;
-		if (!state.currentInstruction && !insideHeredoc && trimmed === "") continue;
+		if (!insideHeredoc && trimmed === "") continue;
 		state.rawAccumulator.push(rawLine);
 		if (insideHeredoc) processHeredocLine(state, trimmed);
 		else processInstructionLine(state, trimmed, lineNum);
@@ -337,7 +395,7 @@ const parseExecForm = (args) => {
 //#endregion
 //#region ../core/src/parsers/image-ref.ts
 const parseImageRef = (ref) => {
-	if (ref.includes("${") || ref.startsWith("$")) return {
+	if (ref.includes("$")) return {
 		isVariable: true,
 		name: ref
 	};
@@ -389,6 +447,15 @@ const isHardenedRuntimeImage = (imagePart) => {
 	const { tag } = parseImageRef(imagePart);
 	return !(tag === "dev" || tag?.endsWith("-dev"));
 };
+const DISTROLESS_NONROOT_TAG_RE = /(?:^|-)nonroot(?:-|$)/u;
+/**
+* Distroless images tagged `nonroot` (also `debug-nonroot` and the
+* per-architecture `nonroot-amd64` forms) run as uid 65532.
+*/
+const isDistrolessNonroot = (imagePart) => {
+	const { name, registry, tag } = parseImageRef(imagePart);
+	return registry === "gcr.io" && name.startsWith("distroless/") && tag !== void 0 && DISTROLESS_NONROOT_TAG_RE.test(tag);
+};
 /**
 * Why a reference would resolve differently over time: no tag at all, or
 * the mutable `latest` tag without a digest. `undefined` means the ref is
@@ -418,6 +485,11 @@ const collectStageAliases = (instructions) => {
 	return aliases;
 };
 
+//#endregion
+//#region ../core/src/parsers/run-flags.ts
+const LEADING_RUN_FLAGS_RE = /^(?:--[a-z][a-z-]*(?:=\S*)?\s+)+/u;
+const stripRunFlags = (args) => args.replace(LEADING_RUN_FLAGS_RE, "");
+
 //#endregion
 //#region ../core/src/rules/create-diagnostic.ts
 const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
@@ -429,6 +501,13 @@ const createDiagnostic = (file, ruleKey, severity, message, help, line) => ({
 	severity
 });
 
+//#endregion
+//#region ../core/src/rules/package-managers.ts
+const APT_GET_INSTALL_RE = /\bapt-get(?:\s+-\S+)*\s+install\b/u;
+const APT_GET_UPDATE_RE = /\bapt-get(?:\s+-\S+)*\s+update\b/u;
+const hasAptGetInstall = (text) => APT_GET_INSTALL_RE.test(text);
+const hasAptGetUpdate = (text) => APT_GET_UPDATE_RE.test(text);
+
 //#endregion
 //#region ../core/src/rules/best-practices.ts
 const requireHealthcheck = {
@@ -444,6 +523,16 @@ const requireHealthcheck = {
 	key: "docker-doctor/require-healthcheck",
 	message: "Add a HEALTHCHECK instruction"
 };
+const AUTO_EXTRACT_SUFFIXES = [
+	".tar",
+	".tar.gz",
+	".tgz",
+	".tar.bz2",
+	".tbz2",
+	".tbz",
+	".tar.xz",
+	".txz"
+];
 const preferCopyOverAdd = {
 	category: "Best Practices",
 	check(instructions, file) {
@@ -452,7 +541,7 @@ const preferCopyOverAdd = {
 			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
 			if (!src) continue;
 			const isRemote = src.startsWith("http://") || src.startsWith("https://");
-			const isArchive = src.endsWith(".tar") || src.endsWith(".tar.gz") || src.endsWith(".tgz") || src.endsWith(".zip");
+			const isArchive = AUTO_EXTRACT_SUFFIXES.some((suffix) => src.toLowerCase().endsWith(suffix));
 			if (!isRemote && !isArchive) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction used for regular files: '${inst.args}'. COPY is simpler and less prone to magic side effects.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -490,8 +579,8 @@ const combineAptUpdateInstall = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
-			const hasUpdate = inst.args.includes("apt-get update");
-			const hasInstall = inst.args.includes("apt-get install");
+			const hasUpdate = hasAptGetUpdate(inst.args);
+			const hasInstall = hasAptGetInstall(inst.args);
 			if (hasUpdate && !hasInstall) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get update used without apt-get install in the same instruction. This can cause caching issues and build failures.", this.help, inst.line));
 			else if (hasInstall && !hasUpdate) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN apt-get install used without apt-get update in the same instruction. Always combine them to ensure up-to-date package installation.", this.help, inst.line));
 		}
@@ -544,12 +633,14 @@ const usePipefail = {
 	key: "docker-doctor/use-pipefail",
 	message: "Use pipefail to catch pipeline command failures"
 };
+const SURROUNDING_QUOTES_RE$1 = /^(?<quote>["'])(?<inner>.*)\k<quote>$/u;
 const absoluteWorkdir = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "WORKDIR") {
-			const path = inst.args.trim();
+			const trimmed = inst.args.trim();
+			const path = trimmed.match(SURROUNDING_QUOTES_RE$1)?.groups?.inner ?? trimmed;
 			if (!/^(?:\/|\\|\$|[a-zA-Z]:)/u.test(path)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `WORKDIR specifies a relative path '${path}'. For clarity and reliability, always use absolute paths.`, this.help, inst.line));
 		}
 		return diagnostics;
@@ -563,7 +654,7 @@ const avoidRunCd = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(inst.args))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && CD_COMMAND_RE.test(maskQuotedText(stripRunFlags(inst.args)))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Avoid using 'cd' in RUN instructions. Use WORKDIR instead to change the working directory stably across layers.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "info",
@@ -571,18 +662,34 @@ const avoidRunCd = {
 	key: "docker-doctor/avoid-run-cd",
 	message: "Avoid changing directories with cd in RUN"
 };
+const PACKAGE_LIST_START_RE = /\b(?:apt-get(?:\s+-\S+)*\s+install|apk\s+add|yum\s+install|dnf\s+install)\b/u;
+const SHELL_SEPARATOR_RE$1 = /[;|]|&&/u;
+const WHITESPACE_RE$1 = /\s+/u;
+const UNCONTINUED_NEWLINE_RE = /(?<!\\[ \t]*)\r?\n/u;
+const collectPackageList = (raw) => {
+	const start = PACKAGE_LIST_START_RE.exec(raw);
+	if (!start) return [];
+	const packages = [];
+	const [command] = raw.slice(start.index + start[0].length).split(UNCONTINUED_NEWLINE_RE);
+	const tokens = command.split(WHITESPACE_RE$1);
+	for (const token of tokens) {
+		if (SHELL_SEPARATOR_RE$1.test(token)) break;
+		if (token !== "" && token !== "\\" && !token.startsWith("-")) packages.push(token);
+	}
+	return packages;
+};
 const sortMultilineArgs = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { raw } = inst;
-			const isPackageInstall = raw.includes("apt-get install") || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
+			const isPackageInstall = hasAptGetInstall(raw) || raw.includes("apk add") || raw.includes("yum install") || raw.includes("dnf install");
 			const hasContinuation = raw.includes("\\\n") || raw.includes("\\\r\n");
 			if (isPackageInstall && hasContinuation) {
-				const packages = raw.split(/\r?\n/u).slice(1).map((line) => line.trim()).filter((line) => line !== "" && !line.startsWith("&&") && !line.startsWith("-") && !line.includes("rm -rf")).map((line) => line.endsWith("\\") ? line.slice(0, -1).trim() : line).filter(Boolean);
+				const packages = collectPackageList(raw);
 				if (packages.length > 1) {
-					const sorted = packages.toSorted((a, b) => a.localeCompare(b));
+					const sorted = packages.toSorted();
 					if (!packages.every((val, idx) => val === sorted[idx])) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "Multi-line package arguments are not sorted alphanumerically. Keeping them sorted makes maintenance easier and prevents duplicates.", this.help, inst.line));
 				}
 			}
@@ -594,15 +701,18 @@ const sortMultilineArgs = {
 	key: "docker-doctor/sort-multiline-args",
 	message: "Sort multi-line arguments alphanumerically"
 };
+const USERADD_COMMAND_RE = /\buseradd\b/u;
+const NO_LOG_INIT_FLAG_RE = /(?:^|\s)(?:--no-log-init|-[A-Za-z]*l[A-Za-z]*)(?=\s|$)/u;
+const useraddWritesLoginLogs = (args) => args.split(SHELL_SEPARATOR_RE$1).some((command) => USERADD_COMMAND_RE.test(command) && !NO_LOG_INIT_FLAG_RE.test(command));
 const useraddNoLogInit = {
 	category: "Best Practices",
 	check(instructions, file) {
 		const diagnostics = [];
-		for (const inst of instructions) if (inst.instruction === "RUN" && /\buseradd\b/u.test(inst.args) && !inst.args.includes("--no-log-init")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
+		for (const inst of instructions) if (inst.instruction === "RUN" && useraddWritesLoginLogs(inst.args)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, "RUN instruction runs 'useradd' without '--no-log-init'. This can cause excessive disk space usage / exhaustion under Go's sparse tar archive bug when large UIDs are used.", this.help, inst.line));
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Pass `--no-log-init` flag to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
+	help: "Pass `--no-log-init` or its short form `-l` to useradd (e.g., `RUN useradd --no-log-init -r -g mygroup myuser`).",
 	key: "docker-doctor/useradd-no-log-init",
 	message: "Use --no-log-init with useradd"
 };
@@ -621,6 +731,13 @@ const bestPracticesRules = [
 
 //#endregion
 //#region ../core/src/rules/compose-services.ts
+const TRUE_SPELLINGS = /* @__PURE__ */ new Set([
+	"true",
+	"y",
+	"yes",
+	"on"
+]);
+const isComposeTrue = (value) => value === true || typeof value === "string" && TRUE_SPELLINGS.has(value.trim().toLowerCase());
 /**
 * Narrows an unknown compose document to its service entries. A service
 * with a null body (`web:` with nothing under it) is returned as an empty
@@ -844,7 +961,10 @@ const composeModelRules = [undefinedModelReference, pinModelVersion];
 const INTERPOLATION_WITH_DEFAULT = /\$\{[^}:?-]+:?-(?<fallback>[^}]*)\}/gu;
 const INTERPOLATION_WITHOUT_DEFAULT = /\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*/gu;
 const HOME_INTERPOLATION = /\$\{HOME\}|\$HOME(?![A-Za-z0-9_])/gu;
-const resolveInterpolationDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
+const PWD_INTERPOLATION = /\$\{PWD\}|\$PWD(?![A-Za-z0-9_])/gu;
+const LEADING_INTERPOLATION_RE = /^\$(?:\{[^}]*\}|[A-Za-z_][A-Za-z0-9_]*)/u;
+const applyFoldsAndDefaults = (value) => value.replace(HOME_INTERPOLATION, "~").replace(PWD_INTERPOLATION, ".").replace(INTERPOLATION_WITH_DEFAULT, (_match, fallback) => fallback);
+const resolveInterpolationDefaults = (value) => applyFoldsAndDefaults(value).replace(INTERPOLATION_WITHOUT_DEFAULT, "");
 const PATH_SHAPED = /^(?:[/.~]|[A-Za-z]:)/u;
 const splitShortSyntax = (spec) => {
 	const parts = [];
@@ -884,7 +1004,7 @@ const volumeMount = (volume) => {
 	if (volume && typeof volume === "object") {
 		const { read_only: readOnly, source, target, type } = volume;
 		return {
-			readOnly: readOnly === true,
+			readOnly: isComposeTrue(readOnly),
 			source: typeof source === "string" ? source : void 0,
 			target: typeof target === "string" ? target : void 0,
 			type: typeof type === "string" ? type : void 0
@@ -895,12 +1015,16 @@ const volumeMount = (volume) => {
 * The host path a bind mount reads from, with interpolation defaults
 * applied and Windows separators folded to `/`. Undefined when the entry is
 * not a bind mount (named volume, tmpfs, anonymous volume) or when the
-* source is an interpolation with no default, which names no host path.
+* source starts with an interpolation that has no default. A source such as
+* `${DATA_DIR}/pg` names no known host location, so no rule can say whether
+* it is inside the project.
 */
 const bindMountSource = (mount) => {
 	if (mount.type !== void 0 && mount.type !== "bind") return;
 	if (!mount.source) return;
-	const resolved = resolveInterpolationDefaults(mount.source).replaceAll("\\", "/");
+	const withDefaults = applyFoldsAndDefaults(mount.source);
+	if (LEADING_INTERPOLATION_RE.test(withDefaults)) return;
+	const resolved = withDefaults.replace(INTERPOLATION_WITHOUT_DEFAULT, "").replaceAll("\\", "/");
 	if (resolved === "" || !PATH_SHAPED.test(resolved)) return;
 	return resolved;
 };
@@ -908,15 +1032,16 @@ const isDockerSocketPath = (hostPath) => hostPath.endsWith("/docker.sock") || ho
 const DOCKER_SOCKET_TARGET = "/var/run/docker.sock";
 /**
 * Whether the entry bind-mounts the Docker socket, under any of its host
-* spellings. A bare `${VAR}` source names no host path, but a socket target
-* still tells the story.
+* spellings. A source that starts with `${VAR}` names no known host path,
+* but a `/docker.sock` suffix or a socket target still identifies it.
 */
 const mountsDockerSocket = (mount) => {
 	const source = bindMountSource(mount);
 	if (source !== void 0) return isDockerSocketPath(source);
 	if (mount.type !== void 0 && mount.type !== "bind") return false;
 	if (!mount.source) return false;
-	return resolveInterpolationDefaults(mount.source) === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
+	const remainder = resolveInterpolationDefaults(mount.source);
+	return isDockerSocketPath(remainder) || remainder === "" && resolveInterpolationDefaults(mount.target ?? "") === DOCKER_SOCKET_TARGET;
 };
 const WINDOWS_DRIVE_ROOT = /^[A-Za-z]:\/?$/u;
 const WINDOWS_DRIVE_PREFIX = /^[A-Za-z]:/u;
@@ -964,9 +1089,15 @@ const SECRET_KEY_PATTERNS = [
 	/(?:^|[_-])auth(?:[_-]|$)/iu,
 	/(?:^|[_-])pat(?:[_-]|$)/iu
 ];
-const isSecretKey = (key) => SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
+const SECRET_LOCATION_SUFFIX = /[_-](?:file|path)$/iu;
+const isSecretKey = (key) => !SECRET_LOCATION_SUFFIX.test(key) && SECRET_KEY_PATTERNS.some((regex) => regex.test(key));
 const CREDENTIAL_FREE_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@/\s]*(?:\/|$)/iu;
-const isLiteralSecretValue = (value) => value.length > 0 && !value.startsWith("$") && !CREDENTIAL_FREE_URL.test(value);
+const SWITCH_VALUE = /^(?:true|false|yes|no|on|off)$/iu;
+const SURROUNDING_QUOTES_RE = /^(?<quote>["'])(?<inner>.*)\k<quote>$/su;
+const isLiteralSecretValue = (value) => {
+	const unquoted = value.match(SURROUNDING_QUOTES_RE)?.groups?.inner ?? value;
+	return unquoted.length > 0 && !unquoted.startsWith("$") && !SWITCH_VALUE.test(unquoted) && !CREDENTIAL_FREE_URL.test(unquoted);
+};
 
 //#endregion
 //#region ../core/src/rules/compose-security.ts
@@ -974,7 +1105,7 @@ const noPrivilegedService = {
 	category: "Compose",
 	check(composeContent, file, context) {
 		const diagnostics = [];
-		for (const [name, config] of composeServices(composeContent)) if (config.privileged === true) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
+		for (const [name, config] of composeServices(composeContent)) if (isComposeTrue(config.privileged)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Service '${name}' runs in privileged mode. A privileged container has full access to the host's devices and kernel, so compromising this service compromises the host.`, this.help, context?.locate?.([
 			"services",
 			name,
 			"privileged"
@@ -1073,6 +1204,10 @@ const preferReadOnlyBindMount = {
 	key: "docker-doctor/prefer-read-only-bind-mount",
 	message: "Bind mounts outside the project should be read-only"
 };
+const literalValue = (value) => {
+	if (typeof value === "string") return value;
+	if (typeof value === "number") return String(value);
+};
 const noPlaintextSecrets = {
 	category: "Compose",
 	check(composeContent, file, context) {
@@ -1088,15 +1223,16 @@ const noPlaintextSecrets = {
 				if (eqIndex <= 0) continue;
 				const key = entry.slice(0, eqIndex);
 				const value = entry.slice(eqIndex + 1);
-				if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+				if (isSecretKey(key) && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
 					index
 				]));
 			}
-			else if (environment && typeof environment === "object") {
-				for (const [key, value] of Object.entries(environment)) if (isSecretKey(key) && typeof value === "string" && isLiteralSecretValue(value)) flag(name, key, context?.locate?.([
+			else if (environment && typeof environment === "object") for (const [key, value] of Object.entries(environment)) {
+				const literal = literalValue(value);
+				if (literal !== void 0 && isSecretKey(key) && isLiteralSecretValue(literal)) flag(name, key, context?.locate?.([
 					"services",
 					name,
 					"environment",
@@ -1121,13 +1257,56 @@ const composeSecurityRules = [
 
 //#endregion
 //#region ../core/src/rules/image-size.ts
+const NODE_ENV_ASSIGNMENT_RE = /(?:^|\s)NODE_ENV(?:=|\s+)["']?(?<value>[^\s"']*)/u;
+const collectStages = (instructions) => {
+	const stages = [];
+	const productionEnv = [];
+	for (const inst of instructions) if (inst.instruction === "FROM") {
+		const { base, stage } = parseFromArgs(inst.args);
+		const baseKey = base?.toLowerCase() ?? "";
+		const parent = stages.findIndex((s) => s.name !== null && s.name === baseKey);
+		productionEnv.push(parent !== -1 && productionEnv[parent]);
+		stages.push({
+			base: baseKey,
+			from: inst,
+			name: stage?.toLowerCase() ?? null,
+			runs: []
+		});
+	} else if (inst.instruction === "ENV" && stages.length > 0) {
+		const value = NODE_ENV_ASSIGNMENT_RE.exec(inst.args)?.groups?.value;
+		if (value !== void 0) productionEnv[stages.length - 1] = value === "production";
+	} else if (inst.instruction === "RUN" && stages.length > 0 && !productionEnv[stages.length - 1]) stages.at(-1)?.runs.push(inst);
+	return stages;
+};
+const shippedStages = (stages) => {
+	const shipped = [];
+	let index = stages.length - 1;
+	while (index >= 0) {
+		shipped.unshift(stages[index]);
+		const { base } = stages[index];
+		index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
+	}
+	return shipped;
+};
+const MINIMAL_BASE_MARKERS = [
+	"alpine",
+	"slim",
+	"distroless",
+	"busybox",
+	"chainguard",
+	"wolfi",
+	"chiseled",
+	"minideb",
+	"nanoserver"
+];
+const MINIMAL_BASE_SEGMENT_RE = /(?:^|[/_. -])(?:minimal|micro)(?:$|[/_. -])/u;
 const preferSlimBase = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
 		const stageAliases = collectStageAliases(instructions);
-		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const imagePart = parseFromArgs(inst.args).base;
+		for (const { from } of shippedStages(collectStages(instructions))) {
+			const imagePart = parseFromArgs(from.args).base;
 			if (!imagePart || isScratch(imagePart)) continue;
 			const ref = parseImageRef(imagePart);
 			if (ref.isVariable || stageAliases.has(imagePart.toLowerCase())) continue;
@@ -1135,7 +1314,7 @@ const preferSlimBase = {
 			if (ref.digest) continue;
 			if (!ref.tag) continue;
 			const haystack = `${ref.name} ${ref.tag}`.toLowerCase();
-			if (!(haystack.includes("alpine") || haystack.includes("slim") || haystack.includes("distroless") || haystack.includes("busybox"))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, inst.line));
+			if (!(MINIMAL_BASE_MARKERS.some((marker) => haystack.includes(marker)) || MINIMAL_BASE_SEGMENT_RE.test(haystack))) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Base image '${imagePart}' may be a full-OS distribution. Consider using a slim or alpine alternative.`, this.help, from.line));
 		}
 		return diagnostics;
 	},
@@ -1147,6 +1326,8 @@ const preferSlimBase = {
 const BUILDKIT_MOUNT_FLAG_RE = /--mount=(?<spec>\S+)/gu;
 const CACHE_TARGET_KEY_RE = /^(?:target|dst|destination)=/u;
 const cacheMountTargets = (args) => [...args.matchAll(BUILDKIT_MOUNT_FLAG_RE)].map((match) => (match.groups?.spec ?? "").split(",")).filter((options) => options.includes("type=cache")).flatMap((options) => options.filter((option) => CACHE_TARGET_KEY_RE.test(option)).map((option) => option.slice(option.indexOf("=") + 1)));
+const RECURSIVE_RM_RE = /\brm\s+(?:-[A-Za-z]+\s+)*-[A-Za-z]*[rR][A-Za-z]*\s(?<operands>[^;&|]*)/gu;
+const removesRecursively = (args, dir) => [...args.matchAll(RECURSIVE_RM_RE)].some((match) => (match.groups?.operands ?? "").includes(dir));
 const APT_CACHE_DIRS = ["/var/lib/apt", "/var/cache/apt"];
 const APK_CACHE_DIRS = ["/var/cache/apk", "/etc/apk/cache"];
 const hasCacheMountFor = (args, cacheDirs) => cacheMountTargets(args).some((target) => cacheDirs.some((dir) => target === dir || target.startsWith(`${dir}/`)));
@@ -1156,8 +1337,8 @@ const cleanPackageCache = {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "RUN") {
 			const { args } = inst;
-			if (args.includes("apt-get install") && !args.includes("rm -rf /var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
-			if (args.includes("apk add") && !args.includes("--no-cache") && !args.includes("rm -rf /var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
+			if (hasAptGetInstall(args) && !removesRecursively(args, "/var/lib/apt/lists") && !hasCacheMountFor(args, APT_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apt-get install' without removing package lists afterwards. This keeps metadata caches inside the image layer.`, this.help, inst.line));
+			if (args.includes("apk add") && !args.includes("--no-cache") && !removesRecursively(args, "/var/cache/apk") && !hasCacheMountFor(args, APK_CACHE_DIRS)) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running 'apk add' without '--no-cache' or cleaning the apk cache. This increases layer size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -1166,36 +1347,51 @@ const cleanPackageCache = {
 	key: "docker-doctor/clean-package-cache",
 	message: "Clean up package manager cache in the same RUN layer"
 };
-const installsDevDependencies = (args) => (args.includes("npm install") || args.includes("npm ci") || args.includes("yarn install")) && !args.includes("--production") && !args.includes("--omit=dev") && !args.includes("prune");
+const SHELL_SEPARATOR_RE = /\s*(?:&&|\|\||;|\|)\s*/u;
+const WHITESPACE_RE = /\s+/u;
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=/u;
+const NODE_PACKAGE_MANAGERS = /* @__PURE__ */ new Set([
+	"npm",
+	"yarn",
+	"pnpm",
+	"bun"
+]);
+const INSTALL_VERBS = /* @__PURE__ */ new Set([
+	"install",
+	"ci",
+	"i"
+]);
+const NON_DEV_INSTALL_FLAGS = /* @__PURE__ */ new Set([
+	"-g",
+	"--global",
+	"--production",
+	"--production=true",
+	"--omit=dev",
+	"--only=prod",
+	"--only=production",
+	"--prod",
+	"-P",
+	"-p"
+]);
+const segmentInstallsDevDependencies = (segment) => {
+	const tokens = segment.split(WHITESPACE_RE).filter(Boolean);
+	const commandStart = tokens.findIndex((token) => !ENV_ASSIGNMENT_RE.test(token));
+	if (commandStart === -1) return false;
+	const [manager, verb, ...options] = tokens.slice(commandStart);
+	if (!(NODE_PACKAGE_MANAGERS.has(manager) && INSTALL_VERBS.has(verb))) return false;
+	return !tokens.slice(0, commandStart).includes("NODE_ENV=production") && options.every((option) => option.startsWith("-") && !NON_DEV_INSTALL_FLAGS.has(option));
+};
+const installsDevDependencies = (args) => !args.includes("prune") && maskQuotedText(stripRunFlags(args)).split(SHELL_SEPARATOR_RE).some(segmentInstallsDevDependencies);
 const avoidDevDependencies = {
 	category: "Image Size",
 	check(instructions, file) {
 		const diagnostics = [];
-		const stages = [];
-		for (const inst of instructions) if (inst.instruction === "FROM") {
-			const { base, stage } = parseFromArgs(inst.args);
-			stages.push({
-				base: base?.toLowerCase() ?? "",
-				name: stage?.toLowerCase() ?? null,
-				runs: []
-			});
-		} else if (inst.instruction === "RUN" && stages.length > 0) stages.at(-1)?.runs.push(inst);
-		if (stages.length === 0) return diagnostics;
-		const auditedIndices = [];
-		let index = stages.length - 1;
-		while (index >= 0) {
-			auditedIndices.push(index);
-			const { base } = stages[index];
-			index = stages.slice(0, index).findIndex((s) => s.name !== null && s.name === base);
-		}
-		const finalIndex = stages.length - 1;
-		for (const stageIndex of auditedIndices.toReversed()) {
-			const stage = stages[stageIndex];
-			for (const inst of stage.runs) {
-				if (!installsDevDependencies(inst.args)) continue;
-				const where = stageIndex === finalIndex ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
-				diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
-			}
+		const stages = collectStages(instructions);
+		const finalStage = stages.at(-1);
+		for (const stage of shippedStages(stages)) for (const inst of stage.runs) {
+			if (!installsDevDependencies(inst.args)) continue;
+			const where = stage === finalStage ? "in the final stage" : `in stage '${stage.name}', whose layers the final stage inherits,`;
+			diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `Running package install '${inst.args}' ${where} without omitting devDependencies.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
@@ -1212,11 +1408,12 @@ const imageSizeRules = [
 
 //#endregion
 //#region ../core/src/rules/performance.ts
+const BUILD_TOOL_COMMAND_RE = /(?:^|&&|\|\||;|\||\(|`|\$\()\s*(?:make|cmake)(?=\s|$)/u;
 const useMultiStage = {
 	category: "Performance",
 	check(instructions, file) {
 		if (instructions.filter((inst) => inst.instruction === "FROM").length === 1) {
-			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || inst.args.includes("make")))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
+			if (instructions.some((inst) => inst.instruction === "RUN" && (inst.args.includes("npm run build") || inst.args.includes("yarn build") || inst.args.includes("bun run build") || inst.args.includes("cargo build") || BUILD_TOOL_COMMAND_RE.test(maskQuotedText(stripRunFlags(inst.args)))))) return [createDiagnostic(file, this.key, this.defaultSeverity, "Only one build stage (FROM) was detected, but build instructions were found. Multi-stage builds can significantly reduce final image size.", this.help, instructions.find((inst) => inst.instruction === "FROM")?.line || 1)];
 		}
 		return [];
 	},
@@ -1275,7 +1472,8 @@ const hasDockerignoreFor = (dockerfilePath, projectFiles) => {
 	const lastSlash = dockerfilePath.lastIndexOf("/");
 	const dir = lastSlash === -1 ? "" : dockerfilePath.slice(0, lastSlash);
 	const adjacent = dir === "" ? ".dockerignore" : `${dir}/.dockerignore`;
-	return projectFiles.some((f) => f === adjacent || f === ".dockerignore");
+	const perDockerfile = `${dockerfilePath}.dockerignore`;
+	return projectFiles.some((f) => f === adjacent || f === perDockerfile || f === ".dockerignore");
 };
 const useDockerignore = {
 	category: "Performance",
@@ -1318,7 +1516,7 @@ const noRootUser = {
 		let lastUserLine = 1;
 		for (const inst of instructions) if (inst.instruction === "FROM") {
 			const { base, stage } = parseFromArgs(inst.args);
-			const baseDefaultUser = base && isHardenedRuntimeImage(base) ? "nonroot" : "root";
+			const baseDefaultUser = base && (isHardenedRuntimeImage(base) || isDistrolessNonroot(base)) ? "nonroot" : "root";
 			lastUser = stageUser.get(base?.toLowerCase() ?? "") ?? baseDefaultUser;
 			lastUserLine = inst.line;
 			currentStage = stage?.toLowerCase() ?? null;
@@ -1397,14 +1595,16 @@ const noAddRemote = {
 	check(instructions, file) {
 		const diagnostics = [];
 		for (const inst of instructions) if (inst.instruction === "ADD") {
-			const src = inst.args.split(/\s+/u).find((p) => !p.startsWith("--"));
-			if (!src) continue;
+			const parts = inst.args.split(/\s+/u);
+			const src = parts.find((p) => !p.startsWith("--"));
+			const isVerified = parts.some((p) => p.startsWith("--checksum="));
+			if (!src || isVerified) continue;
 			if (src.startsWith("http://") || src.startsWith("https://")) diagnostics.push(createDiagnostic(file, this.key, this.defaultSeverity, `ADD instruction uses a remote URL '${src}'. Remote files added via ADD cannot be cleaned up in later layers, increasing image size.`, this.help, inst.line));
 		}
 		return diagnostics;
 	},
 	defaultSeverity: "warning",
-	help: "Use `RUN curl` or `RUN wget` instead of ADD for remote URLs, and delete the downloaded archive in the same layer to minimize size.",
+	help: "Add `--checksum=sha256:<digest>` so BuildKit verifies the download, or use `RUN curl` or `RUN wget` and delete the downloaded archive in the same layer to minimize size.",
 	key: "docker-doctor/no-add-remote",
 	message: "Avoid using ADD with remote URLs"
 };
@@ -1588,7 +1788,7 @@ const importConfig = async (filePath) => {
 	if (filePath.endsWith(".json")) return parseConfigFile(filePath, "JSON", JSON.parse);
 	if (filePath.endsWith(".yaml") || filePath.endsWith(".yml")) return parseConfigFile(filePath, "YAML", parse);
 	try {
-		const configModule = await import(filePath);
+		const configModule = await import(pathToFileURL(filePath).href);
 		return configModule.default || configModule;
 	} catch (error) {
 		const reason = typeStrippingFailure(filePath, error);
@@ -1687,13 +1887,13 @@ const calculateScore = (diagnostics) => {
 
 //#endregion
 //#region ../core/src/report.ts
-const REPORT_SCHEMA_VERSION = 3;
+const REPORT_SCHEMA_VERSION = 4;
 const resolveCategory = (diagnostic) => {
 	const category = diagnostic.category ?? findRule(diagnostic.rule)?.category;
 	if (!category) throw new Error(`Diagnostic for unknown rule "${diagnostic.rule}" has no category`);
 	return category;
 };
-const toJsonReport = (diagnostics, score, label, project) => ({
+const toJsonReport = (diagnostics, score, label, project, failures = []) => ({
 	diagnostics: diagnostics.map((d) => ({
 		category: resolveCategory(d),
 		column: d.column,
@@ -1704,13 +1904,17 @@ const toJsonReport = (diagnostics, score, label, project) => ({
 		rule: d.rule,
 		severity: d.severity
 	})),
+	failures: failures.map(({ file, message }) => ({
+		file,
+		message
+	})),
 	label,
 	project,
-	schemaVersion: 3,
+	schemaVersion: 4,
 	score,
 	timestamp: (/* @__PURE__ */ new Date()).toISOString()
 });
 
 //#endregion
 export { runDockerfileRules as a, createComposeLocator as c, discoverProject as d, version as f, runComposeRules as i, parseCompose as l, calculateScore as n, allRules as o, loadConfig as r, findRule as s, toJsonReport as t, parseDockerfile as u };
-//# sourceMappingURL=src-CklEIXTX.mjs.map
+//# sourceMappingURL=src-DiEWLJ6g.mjs.map