@intentius/chant-lexicon-docker 0.124.21 → 0.124.23

package/dist/okf/rules/DKRD012.md

@@ -1,14 +1,14 @@
 ---
 type: post-synth-check
 title: DKRD012
-description: Dockerfile has no USER instruction — container runs as root
+description: Dockerfile's final stage has no USER instruction, or ends on USER root — container runs as root
 id: DKRD012
 severity: error
 category: post-synth
 lexicon: docker
 docs: https://intentius.io/chant/lexicons/docker/rules/
 ---
-Dockerfile has no USER instruction — container runs as root
+Dockerfile's final stage has no USER instruction, or ends on USER root — container runs as root
 
 ## Applies to
 

package/dist/okf/rules/DKRD013.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD013
+description: Whole build context copied before a dependency install — every source change re-runs the install
+id: DKRD013
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Whole build context copied before a dependency install — every source change re-runs the install

package/dist/okf/rules/DKRD014.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD014
+description: RUN needs root but comes after USER switched to a non-root user
+id: DKRD014
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+RUN needs root but comes after USER switched to a non-root user

package/dist/okf/rules/DKRD015.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD015
+description: More than one CMD or ENTRYPOINT in a stage — only the last one takes effect
+id: DKRD015
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+More than one CMD or ENTRYPOINT in a stage — only the last one takes effect

package/dist/okf/rules/DKRD016.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD016
+description: COPY --from names a stage that is not defined before it
+id: DKRD016
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+COPY --from names a stage that is not defined before it

package/dist/okf/rules/DKRD017.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD017
+description: ARG before the first FROM is not used by any FROM or stage
+id: DKRD017
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+ARG before the first FROM is not used by any FROM or stage

package/dist/okf/rules/DKRD018.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD018
+description: Relative WORKDIR before any absolute WORKDIR in the stage
+id: DKRD018
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Relative WORKDIR before any absolute WORKDIR in the stage

package/dist/okf/rules/DKRD019.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD019
+description: ADD fetches a remote URL without --checksum
+id: DKRD019
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+ADD fetches a remote URL without --checksum

package/dist/okf/rules/DKRD020.md

@@ -0,0 +1,11 @@
+---
+type: post-synth-check
+title: DKRD020
+description: apt-get update in a different RUN from apt-get install — the install can use a stale package index
+id: DKRD020
+severity: error
+category: post-synth
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+apt-get update in a different RUN from apt-get install — the install can use a stale package index

package/dist/okf/rules/DKRS002.md

@@ -0,0 +1,15 @@
+---
+type: lint-rule
+title: DKRS002
+description: Per-kind Dockerfile fields written in a different order
+id: DKRS002
+severity: warning
+category: correctness
+lexicon: docker
+docs: https://intentius.io/chant/lexicons/docker/rules/
+---
+Per-kind Dockerfile fields written in a different order
+
+## Applies to
+
+- [Dockerfile](/types/Dockerfile.md)

package/dist/okf/types/DockerConfig.md

@@ -10,8 +10,10 @@ A config definition in Docker Compose
 
 ## Properties
 
-- `file` (`string`): Path to the config file
-- `content` (`string`): Inline config content
-- `external` (`boolean`): Whether the config is external
-- `labels` (`Record<string, string>`): Config labels
-- `name` (`string`): Custom config name
+- `name` (`ComposeString`): Custom name for this config.
+- `content` (`ComposeString`): Inline content of the config.
+- `environment` (`ComposeString`): Name of an environment variable from which to get the config value.
+- `file` (`ComposeString`): Path to a file containing the config value.
+- `external` (`boolean | ComposeString | { name?: ComposeString }`): Specifies that this config already exists and was created outside of Compose.
+- `labels` (`Record<string, ComposeString | number | boolean | null> | Array<ComposeString>`): Add metadata to the config using labels.
+- `template_driver` (`ComposeString`): Driver to use for templating the config's value.

package/dist/okf/types/DockerSecret.md

@@ -10,7 +10,11 @@ A secret definition in Docker Compose
 
 ## Properties
 
-- `file` (`string`): Path to the secret file
-- `external` (`boolean`): Whether the secret is external
-- `labels` (`Record<string, string>`): Secret labels
-- `name` (`string`): Custom secret name
+- `name` (`ComposeString`): Custom name for this secret.
+- `environment` (`ComposeString`): Name of an environment variable from which to get the secret value.
+- `file` (`ComposeString`): Path to a file containing the secret value.
+- `external` (`boolean | ComposeString | { name?: ComposeString }`): Specifies that this secret already exists and was created outside of Compose.
+- `labels` (`Record<string, ComposeString | number | boolean | null> | Array<ComposeString>`): Add metadata to the secret using labels.
+- `driver` (`ComposeString`): Specify which secret driver should be used for this secret.
+- `driver_opts` (`Record<string, ComposeString | number>`): Specify driver-specific options.
+- `template_driver` (`ComposeString`): Driver to use for templating the secret's value.

package/dist/okf/types/Dockerfile.md

@@ -24,7 +24,10 @@ A Dockerfile definition with ordered build instructions
 - `entrypoint`: Set the entrypoint executable
 - `cmd`: Default command arguments
 - `healthcheck`: Health check instruction
+- `globalArgs`: ARG instructions written before the first FROM
+- `steps`: Instructions after FROM, written in the order given; one instruction per step
 
 ## Governed by
 
-- [DKRD012](/rules/DKRD012.md): Dockerfile has no USER instruction — container runs as root
+- [DKRD012](/rules/DKRD012.md): Dockerfile's final stage has no USER instruction, or ends on USER root — container runs as root
+- [DKRS002](/rules/DKRS002.md): Per-kind Dockerfile fields written in a different order

package/dist/okf/types/Network.md

@@ -10,9 +10,13 @@ A network definition in Docker Compose
 
 ## Properties
 
-- `driver` (`string`): Network driver
-- `driver_opts` (`Record<string, string>`): Driver options
-- `external` (`boolean`): Whether the network is external
-- `labels` (`Record<string, string>`): Network labels
-- `internal` (`boolean`): Restrict external access
-- `ipam` (`object`): IP address management
+- `name` (`ComposeString`): Custom name for this network.
+- `driver` (`ComposeString`): Specify which driver should be used for this network. Default is 'bridge'.
+- `driver_opts` (`Record<string, ComposeString | number>`): Specify driver-specific options defined as key/value pairs.
+- `ipam` (`{ driver?: ComposeString; config?: Array<{ subnet?: ComposeString; ip_range?: ComposeString; gateway?: ComposeString; aux_addresses?: Record<string, ComposeString>; [key: `x-${string}`]: unknown }>; options?: Record<string, ComposeString>; [key: `x-${string}`]: unknown }`): Custom IP Address Management configuration for this network.
+- `external` (`boolean | ComposeString | { name?: ComposeString; [key: `x-${string}`]: unknown }`): Specifies that this network already exists and was created outside of Compose.
+- `internal` (`boolean | ComposeString`): Create an externally isolated network.
+- `enable_ipv4` (`boolean | ComposeString`): Enable IPv4 networking.
+- `enable_ipv6` (`boolean | ComposeString`): Enable IPv6 networking.
+- `attachable` (`boolean | ComposeString`): If true, standalone containers can attach to this network.
+- `labels` (`Record<string, ComposeString | number | boolean | null> | Array<ComposeString>`): Add metadata to the network using labels.

package/dist/okf/types/Service.md

@@ -10,21 +10,99 @@ A containerized service definition in Docker Compose
 
 ## Properties
 
-- `image` (`string`): Container image to use
-- `build` (`object`): Build configuration
-- `command` (`string | string[]`): Override the default command
-- `entrypoint` (`string | string[]`): Override the default entrypoint
-- `environment` (`Record<string, string>`): Environment variables
-- `ports` (`string[]`): Published ports
-- `volumes` (`string[]`): Volume mounts
-- `networks` (`string[]`): Networks to attach
-- `depends_on` (`string[] | Record<string, { condition: "service_started" | "service_healthy" | "service_completed_successfully"; restart?: boolean; required?: boolean }>`): Service dependencies (short list-form, or long form with a wait condition)
-- `restart` (`string`): Restart policy
-- `labels` (`Record<string, string>`): Container labels
-- `healthcheck` (`object`): Health check configuration
-- `deploy` (`object`): Swarm deployment configuration
-- `secrets` (`string[]`): Secrets to expose
-- `configs` (`Array<string | { source: string | Declarable; target?: string; uid?: string; gid?: string; mode?: number }>`): Configs to expose (short form, or long form with a mount target)
+- `develop` (`{ watch?: Array<{ ignore?: ComposeString | Array<ComposeString>; include?: ComposeString | Array<ComposeString>; path: ComposeString; action: "rebuild" | "sync" | "restart" | "sync+restart" | "sync+exec"; target?: ComposeString; exec?: { command: null | ComposeString | Array<ComposeString>; user?: ComposeString; privileged?: boolean | ComposeString; working_dir?: ComposeString; environment?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; [key: `x-${string}`]: unknown }; initial_sync?: boolean; [key: `x-${string}`]: unknown }>; [key: `x-${string}`]: unknown } | null`)
+- `deploy` (`{ mode?: ComposeString; endpoint_mode?: ComposeString; replicas?: number | ComposeString; labels?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; rollback_config?: { parallelism?: number | ComposeString; delay?: ComposeString; failure_action?: ComposeString; monitor?: ComposeString; max_failure_ratio?: number | ComposeString; order?: "start-first" | "stop-first"; [key: `x-${string}`]: unknown }; update_config?: { parallelism?: number | ComposeString; delay?: ComposeString; failure_action?: ComposeString; monitor?: ComposeString; max_failure_ratio?: number | ComposeString; order?: "start-first" | "stop-first"; [key: `x-${string}`]: unknown }; resources?: { limits?: { cpus?: number | ComposeString; memory?: ComposeString; pids?: number | ComposeString; [key: `x-${string}`]: unknown }; reservations?: { cpus?: number | ComposeString; memory?: ComposeString; generic_resources?: Array<{ discrete_resource_spec?: { kind?: ComposeString; value?: number | ComposeString; [key: `x-${string}`]: unknown }; [key: `x-${string}`]: unknown }>; devices?: Array<{ capabilities: Array<ComposeString>; count?: ComposeString | number; device_ids?: Array<ComposeString>; driver?: ComposeString; options?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; [key: `x-${string}`]: unknown }>; [key: `x-${string}`]: unknown }; [key: `x-${string}`]: unknown }; restart_policy?: { condition?: ComposeString; delay?: ComposeString; max_attempts?: number | ComposeString; window?: ComposeString; [key: `x-${string}`]: unknown }; placement?: { constraints?: Array<ComposeString>; preferences?: Array<{ spread?: ComposeString; [key: `x-${string}`]: unknown }>; max_replicas_per_node?: number | ComposeString; [key: `x-${string}`]: unknown }; [key: `x-${string}`]: unknown } | null`)
+- `annotations` (`Record<string, ComposeString | number | boolean | null> | Array<ComposeString>`)
+- `attach` (`boolean | ComposeString`)
+- `build` (`ComposeString | { context?: ComposeString; dockerfile?: ComposeString; dockerfile_inline?: ComposeString; entitlements?: Array<ComposeString>; args?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; ssh?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; labels?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; cache_from?: Array<ComposeString>; cache_to?: Array<ComposeString>; no_cache?: boolean | ComposeString; no_cache_filter?: ComposeString | Array<ComposeString>; additional_contexts?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; network?: ComposeString; provenance?: ComposeString | boolean; sbom?: ComposeString | boolean; pull?: boolean | ComposeString; target?: ComposeString; shm_size?: number | ComposeString; extra_hosts?: Record<string, ComposeString | Array<ComposeString>> | Array<ComposeString>; isolation?: ComposeString; privileged?: boolean | ComposeString; secrets?: Array<ComposeString | { source?: ComposeString; target?: ComposeString; uid?: ComposeString; gid?: ComposeString; mode?: number | ComposeString; [key: `x-${string}`]: unknown }>; tags?: Array<ComposeString>; ulimits?: Record<string, number | ComposeString | { hard: number | ComposeString; soft: number | ComposeString; [key: `x-${string}`]: unknown }>; platforms?: Array<ComposeString>; [key: `x-${string}`]: unknown }`): Configuration options for building the service's image.
+- `blkio_config` (`{ device_read_bps?: Array<{ path?: ComposeString; rate?: number | ComposeString }>; device_read_iops?: Array<{ path?: ComposeString; rate?: number | ComposeString }>; device_write_bps?: Array<{ path?: ComposeString; rate?: number | ComposeString }>; device_write_iops?: Array<{ path?: ComposeString; rate?: number | ComposeString }>; weight?: number | ComposeString; weight_device?: Array<{ path?: ComposeString; weight?: number | ComposeString }> }`): Block IO configuration for the service.
+- `cap_add` (`Array<ComposeString>`): Add Linux capabilities. For example, 'CAP_SYS_ADMIN', 'SYS_ADMIN', or 'NET_ADMIN'.
+- `cap_drop` (`Array<ComposeString>`): Drop Linux capabilities. For example, 'CAP_SYS_ADMIN', 'SYS_ADMIN', or 'NET_ADMIN'.
+- `cgroup` (`"host" | "private"`): Specify the cgroup namespace to join. Use 'host' to use the host's cgroup namespace, or 'private' to use a private cgroup namespace.
+- `cgroup_parent` (`ComposeString`): Specify an optional parent cgroup for the container.
+- `command` (`null | ComposeString | Array<ComposeString>`): Override the default command declared by the container image, for example 'CMD' in Dockerfile.
+- `configs` (`Array<ComposeString | { source?: ComposeString; target?: ComposeString; uid?: ComposeString; gid?: ComposeString; mode?: number | ComposeString; [key: `x-${string}`]: unknown }>`): Grant access to Configs on a per-service basis.
+- `container_name` (`ComposeString`): Specify a custom container name, rather than a generated default name.
+- `cpu_count` (`ComposeString | number`): Number of usable CPUs.
+- `cpu_percent` (`ComposeString | number`): Percentage of CPU resources to use.
+- `cpu_shares` (`number | ComposeString`): CPU shares (relative weight) for the container.
+- `cpu_quota` (`number | ComposeString`): Limit the CPU CFS (Completely Fair Scheduler) quota.
+- `cpu_period` (`number | ComposeString`): Limit the CPU CFS (Completely Fair Scheduler) period.
+- `cpu_rt_period` (`number | ComposeString`): Limit the CPU real-time period in microseconds or a duration.
+- `cpu_rt_runtime` (`number | ComposeString`): Limit the CPU real-time runtime in microseconds or a duration.
+- `cpus` (`number | ComposeString`): Number of CPUs to use. A floating-point value is supported to request partial CPUs.
+- `cpuset` (`ComposeString`): CPUs in which to allow execution (0-3, 0,1).
+- `credential_spec` (`{ config?: ComposeString; file?: ComposeString; registry?: ComposeString; [key: `x-${string}`]: unknown }`): Configure the credential spec for managed service account.
+- `depends_on` (`Array<ComposeString> | Record<string, { restart?: boolean | ComposeString; required?: boolean; condition: "service_started" | "service_healthy" | "service_completed_successfully"; [key: `x-${string}`]: unknown }>`): Express dependency between services. Service dependencies cause services to be started in dependency order. The dependent service will wait for the dependency to be ready before starting.
+- `device_cgroup_rules` (`Array<ComposeString>`): Add rules to the cgroup allowed devices list.
+- `devices` (`Array<ComposeString | { source: ComposeString; target?: ComposeString; permissions?: ComposeString; [key: `x-${string}`]: unknown }>`): List of device mappings for the container.
+- `dns` (`ComposeString | Array<ComposeString>`): Custom DNS servers to set for the service container.
+- `dns_opt` (`Array<ComposeString>`): Custom DNS options to be passed to the container's DNS resolver.
+- `dns_search` (`ComposeString | Array<ComposeString>`): Custom DNS search domains to set on the service container.
+- `domainname` (`ComposeString`): Custom domain name to use for the service container.
+- `entrypoint` (`null | ComposeString | Array<ComposeString>`): Override the default entrypoint declared by the container image, for example 'ENTRYPOINT' in Dockerfile.
+- `env_file` (`ComposeString | Array<ComposeString | { path: ComposeString; format?: ComposeString; required?: boolean | ComposeString }>`): Add environment variables from a file or multiple files. Can be a single file path or a list of file paths.
+- `label_file` (`ComposeString | Array<ComposeString>`): Add metadata to containers using files containing Docker labels.
+- `environment` (`Record<string, ComposeString | number | boolean | null> | Array<ComposeString>`): Add environment variables. You can use either an array or a list of KEY=VAL pairs.
+- `expose` (`Array<ComposeString | number>`): Expose ports without publishing them to the host machine - they'll only be accessible to linked services.
+- `extends` (`ComposeString | { service: ComposeString; file?: ComposeString }`): Extend another service, in the current file or another file.
+- `provider` (`{ type: ComposeString; options?: Record<string, ComposeString | number | boolean | Array<ComposeString | number | boolean>>; [key: `x-${string}`]: unknown }`): Specify a service which will not be manage by Compose directly, and delegate its management to an external provider.
+- `external_links` (`Array<ComposeString>`): Link to services started outside this Compose application. Specify services as <service_name>:<alias>.
+- `extra_hosts` (`Record<string, ComposeString | Array<ComposeString>> | Array<ComposeString>`): Add hostname mappings to the container network interface configuration.
+- `gpus` (`"all" | Array<{ capabilities?: Array<ComposeString>; count?: ComposeString | number; device_ids?: Array<ComposeString>; driver?: ComposeString; options?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString> }>`): Define GPU devices to use. Can be set to 'all' to use all GPUs, or a list of specific GPU devices.
+- `group_add` (`Array<ComposeString | number>`): Add additional groups which user inside the container should be member of.
+- `healthcheck` (`{ disable?: boolean | ComposeString; interval?: ComposeString; retries?: number | ComposeString; test?: ComposeString | Array<ComposeString>; timeout?: ComposeString; start_period?: ComposeString; start_interval?: ComposeString; [key: `x-${string}`]: unknown }`): Configure a health check for the container to monitor its health status.
+- `hostname` (`ComposeString`): Define a custom hostname for the service container.
+- `image` (`ComposeString`): Specify the image to start the container from. Can be a repository/tag, a digest, or a local image ID.
+- `init` (`boolean | ComposeString`): Run as an init process inside the container that forwards signals and reaps processes.
+- `ipc` (`ComposeString`): IPC sharing mode for the service container. Use 'host' to share the host's IPC namespace, 'service:[service_name]' to share with another service, or 'shareable' to allow other services to share this service's IPC namespace.
+- `isolation` (`ComposeString`): Container isolation technology to use. Supported values are platform-specific.
+- `labels` (`Record<string, ComposeString | number | boolean | null> | Array<ComposeString>`): Add metadata to containers using Docker labels. You can use either an array or a list.
+- `links` (`Array<ComposeString>`): Link to containers in another service. Either specify both the service name and a link alias (SERVICE:ALIAS), or just the service name.
+- `logging` (`{ driver?: ComposeString; options?: Record<string, ComposeString | number | null>; [key: `x-${string}`]: unknown }`): Logging configuration for the service.
+- `mac_address` (`ComposeString`): Container MAC address to set.
+- `mem_limit` (`number | ComposeString`): Memory limit for the container. A string value can use suffix like '2g' for 2 gigabytes.
+- `mem_reservation` (`ComposeString | number`): Memory reservation for the container.
+- `mem_swappiness` (`number | ComposeString`): Container memory swappiness as percentage (0 to 100).
+- `memswap_limit` (`number | ComposeString`): Amount of memory the container is allowed to swap to disk. Set to -1 to enable unlimited swap.
+- `network_mode` (`ComposeString`): Network mode. Values can be 'bridge', 'host', 'none', 'service:[service name]', or 'container:[container name]'.
+- `models` (`Array<ComposeString> | Record<string, { endpoint_var?: ComposeString; model_var?: ComposeString; [key: `x-${string}`]: unknown } | null>`): AI Models to use, referencing entries under the top-level models key.
+- `networks` (`Array<ComposeString> | Record<string, { aliases?: Array<ComposeString>; interface_name?: ComposeString; ipv4_address?: ComposeString; ipv6_address?: ComposeString; link_local_ips?: Array<ComposeString>; mac_address?: ComposeString; driver_opts?: Record<string, ComposeString | number>; priority?: number; gw_priority?: number; [key: `x-${string}`]: unknown } | null>`): Networks to join, referencing entries under the top-level networks key. Can be a list of network names or a mapping of network name to network configuration.
+- `oom_kill_disable` (`boolean | ComposeString`): Disable OOM Killer for the container.
+- `oom_score_adj` (`ComposeString | number`): Tune host's OOM preferences for the container (accepts -1000 to 1000).
+- `pid` (`ComposeString | null`): PID mode for container.
+- `pids_limit` (`number | ComposeString`): Tune a container's PIDs limit. Set to -1 for unlimited PIDs.
+- `platform` (`ComposeString`): Target platform to run on, e.g., 'linux/amd64', 'linux/arm64', or 'windows/amd64'.
+- `ports` (`Array<number | ComposeString | { name?: ComposeString; mode?: ComposeString; host_ip?: ComposeString; target?: number | ComposeString; published?: ComposeString | number; protocol?: ComposeString; app_protocol?: ComposeString; [key: `x-${string}`]: unknown }>`): Expose container ports. Short format ([HOST:]CONTAINER[/PROTOCOL]).
+- `pre_start` (`Array<{ command?: null | ComposeString | Array<ComposeString>; image?: ComposeString; user?: ComposeString; privileged?: boolean | ComposeString; working_dir?: ComposeString; environment?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; per_replica?: boolean | ComposeString; [key: `x-${string}`]: unknown }>`): Init containers to run to completion before the service container is started. Each step runs in its own ephemeral container, in declared order; a non-zero exit fails the bring-up of the service and its dependents.
+- `post_start` (`Array<{ command: null | ComposeString | Array<ComposeString>; user?: ComposeString; privileged?: boolean | ComposeString; working_dir?: ComposeString; environment?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; [key: `x-${string}`]: unknown }>`): Commands to run after the container starts. If any command fails, the container stops.
+- `pre_stop` (`Array<{ command: null | ComposeString | Array<ComposeString>; user?: ComposeString; privileged?: boolean | ComposeString; working_dir?: ComposeString; environment?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; [key: `x-${string}`]: unknown }>`): Commands to run before the container stops. If any command fails, the container stop is aborted.
+- `privileged` (`boolean | ComposeString`): Give extended privileges to the service container.
+- `profiles` (`Array<ComposeString>`): List of profiles for this service. When profiles are specified, services are only started when the profile is activated.
+- `pull_policy` (`ComposeString`): Policy for pulling images. Options include: 'always', 'never', 'if_not_present', 'missing', 'build', or time-based refresh policies.
+- `pull_refresh_after` (`ComposeString`): Time after which to refresh the image. Used with pull_policy=refresh.
+- `read_only` (`boolean | ComposeString`): Mount the container's filesystem as read only.
+- `restart` (`ComposeString`): Restart policy for the service container. Options include: 'no', 'always', 'on-failure', and 'unless-stopped'.
+- `runtime` (`ComposeString`): Runtime to use for this container, e.g., 'runc'.
+- `scale` (`number | ComposeString`): Number of containers to deploy for this service.
+- `security_opt` (`Array<ComposeString>`): Override the default labeling scheme for each container.
+- `shm_size` (`number | ComposeString`): Size of /dev/shm. A string value can use suffix like '2g' for 2 gigabytes.
+- `secrets` (`Array<ComposeString | { source?: ComposeString; target?: ComposeString; uid?: ComposeString; gid?: ComposeString; mode?: number | ComposeString; [key: `x-${string}`]: unknown }>`): Grant access to Secrets on a per-service basis.
+- `sysctls` (`Record<string, ComposeString | number | boolean | null> | Array<ComposeString>`): Kernel parameters to set in the container. You can use either an array or a list.
+- `stdin_open` (`boolean | ComposeString`): Keep STDIN open even if not attached.
+- `stop_grace_period` (`ComposeString`): Time to wait for the container to stop gracefully before sending SIGKILL (e.g., '1s', '1m30s').
+- `stop_signal` (`ComposeString`): Signal to stop the container (e.g., 'SIGTERM', 'SIGINT').
+- `storage_opt` (`Record<string, unknown>`): Storage driver options for the container.
+- `tmpfs` (`ComposeString | Array<ComposeString>`): Mount a temporary filesystem (tmpfs) into the container. Can be a single value or a list.
+- `tty` (`boolean | ComposeString`): Allocate a pseudo-TTY to service container.
+- `ulimits` (`Record<string, number | ComposeString | { hard: number | ComposeString; soft: number | ComposeString; [key: `x-${string}`]: unknown }>`): Override the default ulimits for a container.
+- `use_api_socket` (`boolean`): Bind mount Docker API socket and required auth.
+- `user` (`ComposeString`): Username or UID to run the container process as.
+- `uts` (`ComposeString`): UTS namespace to use. 'host' shares the host's UTS namespace.
+- `userns_mode` (`ComposeString`): User namespace to use. 'host' shares the host's user namespace.
+- `volumes` (`Array<ComposeString | { type: "bind" | "volume" | "tmpfs" | "cluster" | "npipe" | "image"; source?: ComposeString; target?: ComposeString; read_only?: boolean | ComposeString; consistency?: ComposeString; bind?: { propagation?: ComposeString; create_host_path?: boolean | ComposeString; recursive?: "enabled" | "disabled" | "writable" | "readonly"; selinux?: "z" | "Z"; [key: `x-${string}`]: unknown }; volume?: { labels?: Record<string, ComposeString | number | boolean | null> | Array<ComposeString>; nocopy?: boolean | ComposeString; subpath?: ComposeString; [key: `x-${string}`]: unknown }; tmpfs?: { size?: number | ComposeString; mode?: number | ComposeString; [key: `x-${string}`]: unknown }; image?: { subpath?: ComposeString; [key: `x-${string}`]: unknown }; [key: `x-${string}`]: unknown }>`): Mount host paths or named volumes accessible to the container. Short syntax (VOLUME:CONTAINER_PATH[:MODE])
+- `volumes_from` (`Array<ComposeString>`): Mount volumes from another service or container. Optionally specify read-only access (ro) or read-write (rw).
+- `working_dir` (`ComposeString`): The working directory in which the entrypoint or command will be run
 
 ## Governed by
 

package/dist/okf/types/Volume.md

@@ -10,11 +10,11 @@ A named volume definition in Docker Compose
 
 ## Properties
 
-- `driver` (`string`): Volume driver
-- `driver_opts` (`Record<string, string>`): Driver options
-- `external` (`boolean`): Whether the volume is external
-- `labels` (`Record<string, string>`): Volume labels
-- `name` (`string`): Custom volume name
+- `name` (`ComposeString`): Custom name for this volume.
+- `driver` (`ComposeString`): Specify which volume driver should be used for this volume.
+- `driver_opts` (`Record<string, ComposeString | number>`): Specify driver-specific options.
+- `external` (`boolean | ComposeString | { name?: ComposeString; [key: `x-${string}`]: unknown }`): Specifies that this volume already exists and was created outside of Compose.
+- `labels` (`Record<string, ComposeString | number | boolean | null> | Array<ComposeString>`): Add metadata to the volume using labels.
 
 ## Governed by
 

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAc7F,eAAO,MAAM,YAAY,EAAE,aA8O1B,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAiC,MAAM,0BAA0B,CAAC;AAe7F,eAAO,MAAM,YAAY,EAAE,aA8O1B,CAAC"}

package/dist/rules/add-url-checksum.ts

@@ -0,0 +1,38 @@
+/**
+ * DKRD019: ADD of a remote URL without --checksum
+ *
+ * ADD fetches an http(s) URL at build time and trusts whatever comes back.
+ * `ADD --checksum=sha256:...` makes the build fail when the content changes.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { eachDockerfile, stageLabel } from "./docker-helpers";
+
+export const dkrd019: PostSynthCheck = {
+  id: "DKRD019",
+  description: "ADD fetches a remote URL without --checksum",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        for (const instr of stage.instructions) {
+          if (instr.instruction !== "ADD") continue;
+          const words = instr.value.split(/\s+/);
+          if (words.some((w) => w.startsWith("--checksum="))) continue;
+          const url = words.find((w) => /^https?:\/\//i.test(w));
+          if (!url) continue;
+          diagnostics.push({
+            checkId: "DKRD019",
+            severity: "warning",
+            message: `${fileName} ${stageLabel(stage)}: ADD ${url} has no --checksum, so the build accepts whatever the URL serves. Add --checksum=sha256:<digest>.`,
+            lexicon: "docker",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/apt-update-alone.ts

@@ -0,0 +1,39 @@
+/**
+ * DKRD020: apt-get update in its own RUN
+ *
+ * A RUN that only runs `apt-get update` is cached as its own layer, so a
+ * later `apt-get install` in another RUN can install from a stale package
+ * index. Update and install in the same RUN.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { commandText, eachDockerfile, stageLabel } from "./docker-helpers";
+
+const UPDATE = /\bapt(-get)?\s+update\b/;
+const INSTALL = /\bapt(-get)?\s+(install|upgrade|dist-upgrade)\b/;
+
+export const dkrd020: PostSynthCheck = {
+  id: "DKRD020",
+  description: "apt-get update in a different RUN from apt-get install — the install can use a stale package index",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        const runs = stage.instructions.filter((i) => i.instruction === "RUN");
+        const updateAt = runs.findIndex((r) => UPDATE.test(commandText(r)) && !INSTALL.test(commandText(r)));
+        if (updateAt === -1) continue;
+        if (!runs.slice(updateAt + 1).some((r) => INSTALL.test(commandText(r)))) continue;
+        diagnostics.push({
+          checkId: "DKRD020",
+          severity: "warning",
+          message: `${fileName} ${stageLabel(stage)}: apt-get update runs in its own RUN, and a later RUN installs from that cached index. Run update and install in one RUN: apt-get update && apt-get install -y --no-install-recommends ...`,
+          lexicon: "docker",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/cache-busting-copy.ts

@@ -0,0 +1,65 @@
+/**
+ * DKRD013: Whole build context copied before installing dependencies
+ *
+ * `COPY . .` followed by a dependency install (npm ci, pip install -r,
+ * go mod download, ...) in the same stage invalidates the install layer on
+ * every source change. Copy the dependency manifests first, install, then
+ * copy the rest.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { commandText, eachDockerfile, instrText, stageLabel } from "./docker-helpers";
+
+/** Installs whose inputs are a few manifest files rather than the whole source tree. */
+const INSTALL = [
+  /\bnpm\s+(ci|install|i)(\s+--?[\w-]+(=\S+)?)*\s*($|&&|;|\|)/m,
+  /\byarn(\s+install)?(\s+--[\w-]+)*\s*($|&&|;|\|)/m,
+  /\bpnpm\s+(install|i)\b/,
+  /\bbun\s+install\b/,
+  /\bpip3?\s+install\b[^&;|]*\s-r\s/,
+  /\bpoetry\s+install\b/,
+  /\buv\s+sync\b/,
+  /\bpipenv\s+install\b/,
+  /\bgo\s+mod\s+download\b/,
+  /\bbundle\s+install\b/,
+  /\bcomposer\s+install\b/,
+  // A string, not a regex literal: the egress scan reads a bare `fetch` in code as a call.
+  new RegExp("\\bcargo\\s+fetch\\b"),
+  /\bdotnet\s+restore\b/,
+  /\bmvn\b[^&;|]*\bdependency:go-offline\b/,
+];
+
+/** `COPY . <dest>` (or `./`) from the build context, not from another stage. */
+function copiesWholeContext(value: string): boolean {
+  const words = value.split(/\s+/).filter((w) => w.length > 0);
+  if (words.some((w) => w.startsWith("--from"))) return false;
+  const args = words.filter((w) => !w.startsWith("--"));
+  if (args[0]?.startsWith("[")) return false;
+  return args.slice(0, -1).some((src) => src === "." || src === "./");
+}
+
+export const dkrd013: PostSynthCheck = {
+  id: "DKRD013",
+  description: "Whole build context copied before a dependency install — every source change re-runs the install",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        const copyAt = stage.instructions.findIndex((i) => i.instruction === "COPY" && copiesWholeContext(i.value));
+        if (copyAt === -1) continue;
+        const install = stage.instructions.slice(copyAt + 1).find((i) => i.instruction === "RUN" && INSTALL.some((re) => re.test(commandText(i))));
+        if (!install) continue;
+        diagnostics.push({
+          checkId: "DKRD013",
+          severity: "warning",
+          message: `${fileName} ${stageLabel(stage)}: ${instrText(stage.instructions[copyAt]!)} comes before ${instrText(install)}, so any source change re-runs the install. Copy the dependency manifests first, run the install, then copy the rest.`,
+          lexicon: "docker",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/dist/rules/copy-from-stage.ts

@@ -0,0 +1,54 @@
+/**
+ * DKRD016: COPY --from names no earlier stage
+ *
+ * `COPY --from=<name>` reads from an earlier stage with that name (or
+ * index). A name that only a later stage has, or that no stage has, is
+ * pulled as an image instead, which is almost never what was meant.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { eachDockerfile, stageLabel } from "./docker-helpers";
+
+/** Looks like an image reference rather than a stage name: has a tag, digest or registry path. */
+function looksLikeImage(ref: string): boolean {
+  return /[:/@]/.test(ref);
+}
+
+export const dkrd016: PostSynthCheck = {
+  id: "DKRD016",
+  description: "COPY --from names a stage that is not defined before it",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+
+    for (const { fileName, parsed } of eachDockerfile(ctx.outputs)) {
+      for (const stage of parsed.stages) {
+        for (const instr of stage.instructions) {
+          if (instr.instruction !== "COPY" && instr.instruction !== "ADD") continue;
+          const m = instr.value.match(/--from=(\S+)/);
+          if (!m) continue;
+          const ref = m[1]!;
+          if (ref.includes("$")) continue;
+          const earlier = parsed.stages.slice(0, stage.index);
+          if (/^\d+$/.test(ref)) {
+            if (Number(ref) < stage.index) continue;
+          } else if (earlier.some((s) => s.as?.toLowerCase() === ref.toLowerCase())) {
+            continue;
+          }
+          const later = parsed.stages.slice(stage.index).find((s) => s.as?.toLowerCase() === ref.toLowerCase() || String(s.index) === ref);
+          if (!later && looksLikeImage(ref)) continue;
+          diagnostics.push({
+            checkId: "DKRD016",
+            severity: "warning",
+            message: later
+              ? `${fileName} ${stageLabel(stage)}: ${instr.instruction} --from=${ref} names ${stageLabel(later)}, which is not defined until later. Move that stage before this one.`
+              : `${fileName} ${stageLabel(stage)}: ${instr.instruction} --from=${ref} names no stage, so Docker pulls an image called "${ref}". Name an earlier stage, or give the image a tag.`,
+            lexicon: "docker",
+          });
+        }
+      }
+    }
+
+    return diagnostics;
+  },
+};