layerlint demo && layerlint scan ./demo

pip install layerlint

layerlint demo              # 写一个"故意写坏"的 Dockerfile 并审计它
layerlint scan .            # 审计自己的项目（自动找 ./Dockerfile）
layerlint scan . --fail-on high   # CI 闸门：命中就 exit 1

python -m layerlint scan ./Dockerfile

  layerlint  ./Dockerfile
  2 stage(s) · 20 layer(s) · 15 finding(s) · risk 100/100 → CRITICAL RISK
  critical 5  high 10  medium 14  low 19
  runs as root · ports 22,8080 · 9 package(s) · 1 deletion(s) that cannot shrink the image

  findings
    HIGH     LYR502  ./Dockerfile:32
      rm removes files written by an earlier layer
      '/app/cache' was written by layer L14 (line 27) and deleted here — the bytes remain in L14
      > RUN rm -rf /app/cache
    CRITICAL LYR401  ./Dockerfile:11
      Secret-looking name in ENV or ARG
      'BUILD_TOKEN' holds credential material by its name.
      > ARG BUILD_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

layerlint layers Dockerfile

    stage layer  line  instruction detail
    1     L14    27    COPY        . /app  [adds: /app]
    1     L18    32    RUN         rm -rf /app/cache  ** still in an earlier layer: /app/cache

  ** = 字节还在镜像里：后面的删除只写一个 whiteout

uvx --from "layerlint[mcp]" layerlint-mcp

{ "mcpServers": { "layerlint": { "command": "uvx",
  "args": ["--from", "layerlint[mcp]", "layerlint-mcp"] } } }

- name: Dockerfile audit
  run: |
    pip install layerlint
    layerlint scan . --fail-on high --sarif layerlint.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: layerlint.sarif