Checks

When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Exposing port 22 might allow users to SSH into the container.

You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.

COPY '--from' should not mention the current FROM alias, since it is impossible to copy from itself.

There can only be one ENTRYPOINT instruction in a Dockerfile. Only the last ENTRYPOINT instruction in the Dockerfile will have an effect.

UNIX ports outside the range 0-65535 are exposed.

For clarity and reliability, you should always use absolute paths for your WORKDIR.

Avoid using 'RUN' with 'sudo' commands, as it can lead to unpredictable behavior.

When a COPY command has more than two arguments, the last one should end with a slash.

Different FROMs can't have the same alias defined.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Avoid using both 'wget' and 'curl' since these tools have the same effect.

You should use 'yum clean all' after using a 'yum install' command to clean package cached data and reduce image size.

There can only be one CMD instruction in a Dockerfile. If you list more than one CMD then only the last CMD will take effect.

The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.

Cached package data should be cleaned after installation to reduce image size.

The layer and image size should be reduced by deleting unneeded caches after running zypper.

'apt-get' calls should use the flag '-y' to avoid manual user input.

MAINTAINER has been deprecated since Docker 1.13.0.

Providing more than one HEALTHCHECK instruction per stage is confusing and error-prone.

You should use 'apk add' with '--no-cache' to clean package cached data and reduce image size.

You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

Cached package data should be cleaned after installation to reduce image size.