@intentius/chant-lexicon-docker 0.124.21 → 0.124.22

package/dist/okf/rules/DKRD016.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD016
+description: COPY --from names a stage that is not defined before it
+id: DKRD016
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+COPY --from names a stage that is not defined before it

package/dist/okf/rules/DKRD017.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD017
+description: ARG before the first FROM is not used by any FROM or stage
+id: DKRD017
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+ARG before the first FROM is not used by any FROM or stage

package/dist/okf/rules/DKRD018.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD018
+description: Relative WORKDIR before any absolute WORKDIR in the stage
+id: DKRD018
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Relative WORKDIR before any absolute WORKDIR in the stage

package/dist/okf/rules/DKRD019.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD019
+description: ADD fetches a remote URL without --checksum
+id: DKRD019
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+ADD fetches a remote URL without --checksum

package/dist/okf/rules/DKRD020.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD020
+description: apt-get update in a different RUN from apt-get install — the install can use a stale package index
+id: DKRD020
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+apt-get update in a different RUN from apt-get install — the install can use a stale package index

package/dist/okf/rules/DKRS002.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: DKRS002
+description: Per-kind Dockerfile fields written in a different order
+id: DKRS002
+severity: warning
+category: correctness
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Per-kind Dockerfile fields written in a different order
+
+## Applies to
+
+- [Dockerfile](/types/Dockerfile.md)

package/dist/okf/types/Dockerfile.md

@@ -24,7 +24,10 @@ A Dockerfile definition with ordered build instructions
 - `entrypoint`: Set the entrypoint executable
 - `cmd`: Default command arguments
 - `healthcheck`: Health check instruction
+- `globalArgs`: ARG instructions written before the first FROM
+- `steps`: Instructions after FROM, written in the order given; one instruction per step
 
 ## Governed by
 
-- [DKRD012](/rules/DKRD012.md): Dockerfile has no USER instruction — container runs as root
+- [DKRD012](/rules/DKRD012.md): Dockerfile's final stage has no USER instruction, or ends on USER root — container runs as root
+- [DKRS002](/rules/DKRS002.md): Per-kind Dockerfile fields written in a different order

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAc7F,eAAO,MAAM,YAAY,EAAE,aA8O1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAe7F,eAAO,MAAM,YAAY,EAAE,aA8O1B,CAAC"}

package/dist/rules/add-url-checksum.ts

@@ -0,0 +1,38 @@
+/**
+ * DKRD019: ADD of a remote URL without --checksum
+ *
+ * ADD fetches an http(s) URL at build time and trusts whatever comes back.
+ * `ADD --checksum=sha256:...` makes the build fail when the content changes.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { eachDockerfile, stageLabel } from "./docker-helpers";
+
+export const dkrd019: PostSynthCheck = {
+  id: "DKRD019",
+  description: "ADD fetches a remote URL without --checksum",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        for (const instr of stage.instructions) {
+          if (instr.instruction !== "ADD") continue;
+          const words = instr.value.split(/\s+/);
+          if (words.some((w) => w.startsWith("--checksum="))) continue;
+          const url = words.find((w) => /^https?:\/\//i.test(w));
+          if (!url) continue;
+          diagnostics.push({
+            checkId: "DKRD019",
+            severity: "warning",
+            message: `${fileName} ${stageLabel(stage)}: ADD ${url} has no --checksum, so the build accepts whatever the URL serves. Add --checksum=sha256:<digest>.`,
+            lexicon: "docker",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/apt-update-alone.ts

@@ -0,0 +1,39 @@
+/**
+ * DKRD020: apt-get update in its own RUN
+ *
+ * A RUN that only runs `apt-get update` is cached as its own layer, so a
+ * later `apt-get install` in another RUN can install from a stale package
+ * index. Update and install in the same RUN.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { commandText, eachDockerfile, stageLabel } from "./docker-helpers";
+
+const UPDATE = /\bapt(-get)?\s+update\b/;
+const INSTALL = /\bapt(-get)?\s+(install|upgrade|dist-upgrade)\b/;
+
+export const dkrd020: PostSynthCheck = {
+  id: "DKRD020",
+  description: "apt-get update in a different RUN from apt-get install — the install can use a stale package index",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        const runs = stage.instructions.filter((i) => i.instruction === "RUN");
+        const updateAt = runs.findIndex((r) => UPDATE.test(commandText(r)) && !INSTALL.test(commandText(r)));
+        if (updateAt === -1) continue;
+        if (!runs.slice(updateAt + 1).some((r) => INSTALL.test(commandText(r)))) continue;
+        diagnostics.push({
+          checkId: "DKRD020",
+          severity: "warning",
+          message: `${fileName} ${stageLabel(stage)}: apt-get update runs in its own RUN, and a later RUN installs from that cached index. Run update and install in one RUN: apt-get update && apt-get install -y --no-install-recommends ...`,
+          lexicon: "docker",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/cache-busting-copy.ts

@@ -0,0 +1,64 @@
+/**
+ * DKRD013: Whole build context copied before installing dependencies
+ *
+ * `COPY . .` followed by a dependency install (npm ci, pip install -r,
+ * go mod download, ...) in the same stage invalidates the install layer on
+ * every source change. Copy the dependency manifests first, install, then
+ * copy the rest.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { commandText, eachDockerfile, instrText, stageLabel } from "./docker-helpers";
+
+/** Installs whose inputs are a few manifest files rather than the whole source tree. */
+const INSTALL = [
+  /\bnpm\s+(ci|install|i)(\s+--?[\w-]+(=\S+)?)*\s*($|&&|;|\|)/m,
+  /\byarn(\s+install)?(\s+--[\w-]+)*\s*($|&&|;|\|)/m,
+  /\bpnpm\s+(install|i)\b/,
+  /\bbun\s+install\b/,
+  /\bpip3?\s+install\b[^&;|]*\s-r\s/,
+  /\bpoetry\s+install\b/,
+  /\buv\s+sync\b/,
+  /\bpipenv\s+install\b/,
+  /\bgo\s+mod\s+download\b/,
+  /\bbundle\s+install\b/,
+  /\bcomposer\s+install\b/,
+  /\bcargo\s+fetch\b/,
+  /\bdotnet\s+restore\b/,
+  /\bmvn\b[^&;|]*\bdependency:go-offline\b/,
+];
+
+/** `COPY . <dest>` (or `./`) from the build context, not from another stage. */
+function copiesWholeContext(value: string): boolean {
+  const words = value.split(/\s+/).filter((w) => w.length > 0);
+  if (words.some((w) => w.startsWith("--from"))) return false;
+  const args = words.filter((w) => !w.startsWith("--"));
+  if (args[0]?.startsWith("[")) return false;
+  return args.slice(0, -1).some((src) => src === "." || src === "./");
+}
+
+export const dkrd013: PostSynthCheck = {
+  id: "DKRD013",
+  description: "Whole build context copied before a dependency install — every source change re-runs the install",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        const copyAt = stage.instructions.findIndex((i) => i.instruction === "COPY" && copiesWholeContext(i.value));
+        if (copyAt === -1) continue;
+        const install = stage.instructions.slice(copyAt + 1).find((i) => i.instruction === "RUN" && INSTALL.some((re) => re.test(commandText(i))));
+        if (!install) continue;
+        diagnostics.push({
+          checkId: "DKRD013",
+          severity: "warning",
+          message: `${fileName} ${stageLabel(stage)}: ${instrText(stage.instructions[copyAt]!)} comes before ${instrText(install)}, so any source change re-runs the install. Copy the dependency manifests first, run the install, then copy the rest.`,
+          lexicon: "docker",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/copy-from-stage.ts

@@ -0,0 +1,54 @@
+/**
+ * DKRD016: COPY --from names no earlier stage
+ *
+ * `COPY --from=<name>` reads from an earlier stage with that name (or
+ * index). A name that only a later stage has, or that no stage has, is
+ * pulled as an image instead, which is almost never what was meant.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { eachDockerfile, stageLabel } from "./docker-helpers";
+
+/** Looks like an image reference rather than a stage name: has a tag, digest or registry path. */
+function looksLikeImage(ref: string): boolean {
+  return /[:/@]/.test(ref);
+}
+
+export const dkrd016: PostSynthCheck = {
+  id: "DKRD016",
+  description: "COPY --from names a stage that is not defined before it",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        for (const instr of stage.instructions) {
+          if (instr.instruction !== "COPY" && instr.instruction !== "ADD") continue;
+          const m = instr.value.match(/--from=(\S+)/);
+          if (!m) continue;
+          const ref = m[1]!;
+          if (ref.includes("$")) continue;
+          const earlier = parsed.stages.slice(0, stage.index);
+          if (/^\d+$/.test(ref)) {
+            if (Number(ref) < stage.index) continue;
+          } else if (earlier.some((s) => s.as?.toLowerCase() === ref.toLowerCase())) {
+            continue;
+          }
+          const later = parsed.stages.slice(stage.index).find((s) => s.as?.toLowerCase() === ref.toLowerCase() || String(s.index) === ref);
+          if (!later && looksLikeImage(ref)) continue;
+          diagnostics.push({
+            checkId: "DKRD016",
+            severity: "warning",
+            message: later
+              ? `${fileName} ${stageLabel(stage)}: ${instr.instruction} --from=${ref} names ${stageLabel(later)}, which is not defined until later. Move that stage before this one.`
+              : `${fileName} ${stageLabel(stage)}: ${instr.instruction} --from=${ref} names no stage, so Docker pulls an image called "${ref}". Name an earlier stage, or give the image a tag.`,
+            lexicon: "docker",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/docker-helpers.ts

@@ -3,6 +3,7 @@
  */
 
 export { getPrimaryOutput } from "@intentius/chant/lint/post-synth";
+import { splitDockerfileInstructions } from "../../import/parser";
 
 export interface ParsedService {
   name: string;
@@ -112,3 +113,82 @@ export function extractDockerfiles(output: unknown): Map<string, string> {
   }
   return files;
 }
+
+// ── Dockerfile structure ──────────────────────────────────────────
+
+export interface DockerfileInstr {
+  /** Upper-case keyword, e.g. "RUN". */
+  instruction: string;
+  /** The rest of the instruction as written. */
+  value: string;
+}
+
+export interface ParsedStage {
+  /** 0-based position among the stages. */
+  index: number;
+  /** The FROM image (or earlier stage) without `--platform` and `AS`. */
+  from: string;
+  as?: string;
+  instructions: DockerfileInstr[];
+}
+
+export interface ParsedDockerfile {
+  /** ARG instructions before the first FROM. */
+  globalArgs: DockerfileInstr[];
+  stages: ParsedStage[];
+}
+
+/** A Dockerfile's global ARGs and stages, each stage's instructions in order. */
+export function parseDockerfileStages(content: string): ParsedDockerfile {
+  const out: ParsedDockerfile = { globalArgs: [], stages: [] };
+  for (const instr of splitDockerfileInstructions(content)) {
+    if (instr.instruction === "FROM") {
+      const words = instr.value.split(/\s+/).filter((w) => !w.startsWith("--"));
+      const asAt = words.findIndex((w) => w.toLowerCase() === "as");
+      out.stages.push({
+        index: out.stages.length,
+        from: words[0] ?? "",
+        ...(asAt > 0 && words[asAt + 1] ? { as: words[asAt + 1] } : {}),
+        instructions: [],
+      });
+    } else if (out.stages.length > 0) {
+      out.stages[out.stages.length - 1]!.instructions.push(instr);
+    } else if (instr.instruction === "ARG") {
+      out.globalArgs.push(instr);
+    }
+  }
+  return out;
+}
+
+/** How a stage is named in a message: `stage "build"` or `stage 2`. */
+export function stageLabel(stage: ParsedStage): string {
+  return stage.as ? `stage "${stage.as}"` : `stage ${stage.index + 1}`;
+}
+
+/** The first line of an instruction, for a message. */
+export function instrText(instr: DockerfileInstr): string {
+  const first = instr.value.split("\n")[0]!.replace(/\s*\\$/, "");
+  return `${instr.instruction} ${first}`;
+}
+
+/** Whether a USER value is root (by name or uid 0, with or without a group). */
+export function isRootUser(value: string): boolean {
+  const user = value.trim().split(":")[0]!;
+  return user === "root" || user === "0";
+}
+
+/** Every generated Dockerfile in a build's outputs, parsed. */
+export function eachDockerfile(outputs: Map<string, unknown>): Array<{ fileName: string; content: string; parsed: ParsedDockerfile }> {
+  const out: Array<{ fileName: string; content: string; parsed: ParsedDockerfile }> = [];
+  for (const [, output] of outputs) {
+    for (const [fileName, content] of extractDockerfiles(output)) {
+      out.push({ fileName, content, parsed: parseDockerfileStages(content) });
+    }
+  }
+  return out;
+}
+
+/** A RUN value with its line continuations joined, for matching commands. */
+export function commandText(instr: DockerfileInstr): string {
+  return instr.value.replace(/\\[ \t]*\n/g, " ");
+}

package/dist/rules/no-root-user.ts

@@ -1,34 +1,36 @@
 /**
  * DKRD012: No Root User
  *
- * Warns when a Dockerfile has no USER instruction,
- * meaning the container runs as root by default.
+ * Warns when the container would run as root: the final stage has no USER
+ * instruction, or its last USER is root. USER in an earlier stage does not
+ * carry into the final image.
  */
 
 import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
-import { extractDockerfiles } from "./docker-helpers";
+import { eachDockerfile, isRootUser, stageLabel } from "./docker-helpers";
 
 export const dkrd012: PostSynthCheck = {
   id: "DKRD012",
-  description: "Dockerfile has no USER instruction — container runs as root",
+  description: "Dockerfile's final stage has no USER instruction, or ends on USER root — container runs as root",
 
   check(ctx: PostSynthContext): PostSynthDiagnostic[] {
     const diagnostics: PostSynthDiagnostic[] = [];
 
-    for (const [_outputName, output] of ctx.outputs) {
-      const dockerfiles = extractDockerfiles(output);
-
-      for (const [fileName, content] of dockerfiles) {
-        const hasUser = /^USER\s+/m.test(content);
-        if (!hasUser) {
-          diagnostics.push({
-            checkId: "DKRD012",
-            severity: "warning",
-            message: `${fileName}: No USER instruction found. The container will run as root. Add a USER instruction to improve security.`,
-            lexicon: "docker",
-          });
-        }
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      const final = parsed.stages[parsed.stages.length - 1];
+      if (!final) continue;
+      const users = final.instructions.filter((i) => i.instruction === "USER");
+      const last = users[users.length - 1];
+      let message: string | undefined;
+      if (!last) {
+        const anyUser = parsed.stages.some((s) => s.instructions.some((i) => i.instruction === "USER"));
+        message = anyUser
+          ? `${fileName}: The final ${stageLabel(final)} has no USER instruction; a USER in an earlier stage does not carry over. The container will run as root. Add a USER step to the final stage.`
+          : `${fileName}: No USER instruction found. The container will run as root. Add a USER instruction to improve security.`;
+      } else if (isRootUser(last.value)) {
+        message = `${fileName}: The final ${stageLabel(final)} ends on USER ${last.value.trim()}, so the container runs as root. Switch to an unprivileged USER after the root setup steps.`;
       }
+      if (message) diagnostics.push({ checkId: "DKRD012", severity: "warning", message, lexicon: "docker" });
     }
 
     return diagnostics;

package/dist/rules/per-kind-order.ts

@@ -0,0 +1,130 @@
+/**
+ * DKRS002: Per-kind Dockerfile fields written in a different order
+ *
+ * A Dockerfile stage without `steps` writes its per-kind fields (`run`,
+ * `copy`, `user`, ...) in a fixed order: ARG, ENV, WORKDIR, USER, RUN, COPY,
+ * ADD, EXPOSE, VOLUME, LABEL, ENTRYPOINT, CMD, HEALTHCHECK. When the fields
+ * are declared in another order (`copy` before `run`, `run` before `user`)
+ * the generated Dockerfile does not run them in the order they read in.
+ *
+ * The fix rewrites the fields as `steps` in the fixed order, so the
+ * generated Dockerfile stays the same, with a comment to reorder them.
+ */
+
+import type { LintRule, LintDiagnostic, LintContext, LintFix } from "@intentius/chant/lint/rule";
+import { ts } from "@intentius/chant/lint/typescript";
+import { PER_KIND_ORDER, type PerKindField } from "../../dockerfile-order";
+
+const PER_KIND = new Set<string>(PER_KIND_ORDER);
+/** Per-kind fields that take one string; the rest take a list. */
+const SINGLE = new Set<string>(["workdir", "user", "entrypoint", "cmd", "healthcheck"]);
+
+const FIX_NOTE = "// Written by the DKRS002 fix in the fixed order the per-kind fields used, so the output is unchanged. Reorder the steps as the build needs.";
+
+function propName(p: ts.ObjectLiteralElementLike): string | undefined {
+  if (!(ts.isPropertyAssignment(p) || ts.isShorthandPropertyAssignment(p))) return undefined;
+  const n = p.name;
+  if (ts.isIdentifier(n) || ts.isStringLiteral(n)) return n.text;
+  return undefined;
+}
+
+function isDockerfileNew(node: ts.Node): node is ts.NewExpression {
+  if (!ts.isNewExpression(node)) return false;
+  const e = node.expression;
+  return (ts.isIdentifier(e) && e.text === "Dockerfile") || (ts.isPropertyAccessExpression(e) && e.name.text === "Dockerfile");
+}
+
+/** The stage-shaped object literals of one `new Dockerfile({...})`. */
+function stageLiterals(arg: ts.ObjectLiteralExpression): ts.ObjectLiteralExpression[] {
+  const stagesProp = arg.properties.find((p) => propName(p) === "stages");
+  if (!stagesProp) return [arg];
+  // With stages, the top-level per-kind fields are not written at all.
+  if (!ts.isPropertyAssignment(stagesProp) || !ts.isArrayLiteralExpression(stagesProp.initializer)) return [];
+  return stagesProp.initializer.elements.filter(ts.isObjectLiteralExpression);
+}
+
+/** The `{ key: value }` step texts for one per-kind field, or undefined when its value can't be split. */
+function stepTexts(sf: ts.SourceFile, key: string, p: ts.ObjectLiteralElementLike): string[] | undefined {
+  if (!ts.isPropertyAssignment(p)) return undefined;
+  const init = p.initializer;
+  if (SINGLE.has(key)) return [`{ ${key}: ${init.getText(sf)} }`];
+  if (!ts.isArrayLiteralExpression(init)) return undefined;
+  const out: string[] = [];
+  for (const el of init.elements) {
+    if (ts.isSpreadElement(el) || ts.isOmittedExpression(el)) return undefined;
+    out.push(`{ ${key}: ${el.getText(sf)} }`);
+  }
+  return out;
+}
+
+function buildFix(sf: ts.SourceFile, obj: ts.ObjectLiteralExpression, perKind: ts.ObjectLiteralElementLike[]): LintFix | undefined {
+  const byKey = new Map<string, ts.ObjectLiteralElementLike>();
+  for (const p of perKind) byKey.set(propName(p)!, p);
+  const steps: string[] = [];
+  for (const key of PER_KIND_ORDER) {
+    const p = byKey.get(key);
+    if (!p) continue;
+    const texts = stepTexts(sf, key, p);
+    if (!texts) return undefined;
+    steps.push(...texts);
+  }
+
+  const first = perKind[0]!;
+  const last = perKind[perKind.length - 1]!;
+  const start = first.getStart(sf);
+  const end = last.getEnd();
+  const lineStart = sf.text.lastIndexOf("\n", start - 1) + 1;
+  const indent = /^[ \t]*/.exec(sf.text.slice(lineStart, start))![0];
+  // Other props between the first and last per-kind field (rare) are kept, ahead of steps.
+  const kept = obj.properties.filter((p) => p.getStart(sf) > start && p.getEnd() < end && !perKind.includes(p)).map((p) => p.getText(sf));
+  const stepsText = `${FIX_NOTE}\n${indent}steps: [\n${steps.map((s) => `${indent}  ${s},`).join("\n")}\n${indent}]`;
+  return { range: [start, end], replacement: [...kept, stepsText].join(`,\n${indent}`), kind: "replace" };
+}
+
+function check(context: LintContext): LintDiagnostic[] {
+  const { sourceFile: sf } = context;
+  const diagnostics: LintDiagnostic[] = [];
+
+  const visit = (node: ts.Node): void => {
+    if (isDockerfileNew(node)) {
+      const arg = node.arguments?.[0];
+      if (arg && ts.isObjectLiteralExpression(arg)) {
+        for (const obj of stageLiterals(arg)) {
+          if (obj.properties.some((p) => propName(p) === "steps")) continue;
+          const perKind = obj.properties.filter((p) => PER_KIND.has(propName(p) ?? ""));
+          const declared = perKind.map((p) => propName(p)!);
+          const fixed = [...declared].sort((a, b) => PER_KIND_ORDER.indexOf(a as PerKindField) - PER_KIND_ORDER.indexOf(b as PerKindField));
+          if (declared.join() === fixed.join()) continue;
+          const { line, character } = sf.getLineAndCharacterOfPosition(perKind[0]!.getStart(sf));
+          const fix = buildFix(sf, obj, perKind);
+          diagnostics.push({
+            file: sf.fileName,
+            line: line + 1,
+            column: character + 1,
+            ruleId: "DKRS002",
+            severity: "warning",
+            message:
+              `Dockerfile fields declared as ${declared.join(", ")} are written in the fixed order ${fixed.join(", ")}. ` +
+              `Use steps to write the instructions in the order the build needs${fix ? " (chant lint --fix rewrites them as steps)" : ""}.`,
+            ...(fix ? { fix } : {}),
+          });
+        }
+      }
+    }
+    ts.forEachChild(node, visit);
+  };
+
+  visit(sf);
+  return diagnostics;
+}
+
+export const perKindOrderRule: LintRule = {
+  id: "DKRS002",
+  severity: "warning",
+  category: "correctness",
+  description: "Dockerfile per-kind fields are written in a fixed order that differs from the declared order — use steps",
+  check,
+  fix(context: LintContext): LintFix[] {
+    return check(context).flatMap((d) => (d.fix ? [d.fix] : []));
+  },
+};

package/dist/rules/relative-workdir.ts

@@ -0,0 +1,38 @@
+/**
+ * DKRD018: Relative WORKDIR
+ *
+ * A relative WORKDIR resolves against whatever directory the base image
+ * left, which can change with the image. Use an absolute path, at least for
+ * the first WORKDIR of a stage.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { eachDockerfile, stageLabel } from "./docker-helpers";
+
+export const dkrd018: PostSynthCheck = {
+  id: "DKRD018",
+  description: "Relative WORKDIR before any absolute WORKDIR in the stage",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        for (const instr of stage.instructions) {
+          if (instr.instruction !== "WORKDIR") continue;
+          const dir = instr.value.trim().replace(/^["']|["']$/g, "");
+          if (dir.startsWith("/") || dir.startsWith("$") || /^[A-Za-z]:[\\/]/.test(dir)) break;
+          diagnostics.push({
+            checkId: "DKRD018",
+            severity: "warning",
+            message: `${fileName} ${stageLabel(stage)}: WORKDIR ${dir} is relative to the base image's working directory. Use an absolute path.`,
+            lexicon: "docker",
+          });
+          break;
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/repeated-cmd.ts

@@ -0,0 +1,35 @@
+/**
+ * DKRD015: More than one CMD or ENTRYPOINT in a stage
+ *
+ * Only the last CMD and the last ENTRYPOINT of a stage take effect; the
+ * earlier ones are silently ignored.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { eachDockerfile, instrText, stageLabel } from "./docker-helpers";
+
+export const dkrd015: PostSynthCheck = {
+  id: "DKRD015",
+  description: "More than one CMD or ENTRYPOINT in a stage — only the last one takes effect",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        for (const kw of ["CMD", "ENTRYPOINT"]) {
+          const all = stage.instructions.filter((i) => i.instruction === kw);
+          if (all.length < 2) continue;
+          diagnostics.push({
+            checkId: "DKRD015",
+            severity: "warning",
+            message: `${fileName} ${stageLabel(stage)}: ${all.length} ${kw} instructions; only the last (${instrText(all[all.length - 1]!)}) takes effect. Remove the others.`,
+            lexicon: "docker",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};