Package: dokter
Dokter: the doctor for your DockerfilesThe objective ofdokteris to make your Dockerfiles better, it will make sure that your Dockerfiles:build secure imagesbuild smaller imagesbuild fasterfollow best practicesare pretty formattedRules informationFor an overview of the rules see:rulesDevOps lifecycleTypically, a CI/CD pipeline consists of roughly the following steps:lint codebuild Docker imagerun tests in Docker imagescan image for vulnerabilities (hopefully)push image to registrydeploy imageDokterfits into the first stage and aims to prevent building an image that exposes credentials or contains
vulnerabilities, which at the bare minimum saves CI/CD minutes.Separate processes like container registry scanning will also run, but they may run only after an image has been pushed,
potentially already exposing a vulnerable image to the public.Video explaining Dokter<iframe width="560" height="315" src="https://www.youtube.com/embed/8aKScUQjMWY" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>What makes Dokter special?Good question,Dokteris the byproduct of a much bigger effort,GitLab AI Assist, as a first starting point,
Dockerfiles were chosen. A parser was developed to fully parse Dockerfiles in a format that is designed for machine
learning. In order to train ML models, there is a need to create a large, rich dataset and in order to do that a good
analysis of Dockerfiles is needed. Hence, the creation ofDokter. It will start improving your Dockerfiles from day 1
but will become much more powerful in the future, eventually it will automatically create Dockerfiles for you.No telemetryNo worries, your Dockerfiles remain private,Dokterwon't share any telemetry with GitLab, perhaps at some point in
time when machine learning models would benefit from user feedback, the option to provide anonymous feedback may be,
with plenty of user awareness and opt-in, introduced.Dynamic parserThe parser behindDokterhas been designed with data and ML in mind, it supports parsing of all Docker instructions
and adds support for comments, both actual comments and commented out code.The parser also supports dynamic analysis, it's context aware, example:COPY./appIf a static analysis was performed, it would approve the above instruction,Dokterhowever will actually list the
files that are in.and analyze them against known files to contain credentials, but also filter against your.dockerignorefile.UsageThere are a couple of ways you can useDokter:LocalCI/CDIt is suggested to always use both, but at least run it where you are actually building and publishing your images.Local usageYou will need to installDokterfrompippipinstalldokter# Or from GitLabpipinstall--upgradedokter--extra-index-urlhttps://gitlab.com/api/v4/projects/36078023/packages/pypi/simple

dokter-dpath/to/DockerfileIf you want more information you can either run it in verbose mode or ask to explain a specific rule# Explain rule dfa001dokter-edfa001# Run in verbose mode (this will be a lot of text)dokter-v-dpath/to/DockerfileYou can also use docker:dockerrun-it-v$(pwd):/appregistry.gitlab.com/gitlab-org/incubation-engineering/ai-assist/dokter/dokter:latestdokter-ddocter.DockerfileDockerfile formatting and auto-correctionDokteris capable of creating a pretty formatted Dockerfile, as well as autocorrecting some errors found by the
analyzer. It can either show-sor write-wthe file, in case of writing it will overwrite the given Dockerfile, so
it's easier to review and commit changes.Shell commands will be analyzed usingShellCheckand where possible an error will be corrected
automatically.dokter-dDockerfile-wIn case of showing,Dokterwill first output the analysis report followed by the Dockerfile, at this moment it will
output a file with some errors corrected but not all.dokter-dDockerfile-sYou can also combine-sand-wto both show and write the Dockerfile.CI/CDUsage in GitLab CI example:dokter:image:registry.gitlab.com/gitlab-org/incubation-engineering/ai-assist/dokter/dokter:lateststage:lintscript:-dokter -d DockerfileGitLab Static Application Security Testing (SAST)To output the result ofdokterto the GitLab security overview, simply run with the--sastflag. In a future release
, support for remediation's will be added.GitLab Code QualityTo use the output in GitLab code quality you can use below as an example:dokter:image:registry.gitlab.com/gitlab-org/incubation-engineering/ai-assist/dokter/dokter:lateststage:lintscript:-dokter -d dokter.Dockerfile --gitlab-codequalityartifacts:name:"$CI_JOB_NAMEartifactsfrom$CI_PROJECT_NAMEon$CI_COMMIT_REF_SLUG"expire_in:1 daywhen:alwaysreports:codequality:-"dokter-$CI_COMMIT_SHA.json"paths:-"dokter-$CI_COMMIT_SHA.json"Automatic merge requests with resolutionsBelow is an example whereDokteris used to analyze a Dockerfile and autocorrect it, the output is then committed to a
new branch with the following name structuredokter/<source_branch_name>and a merge request will be created and
assigned to the user that started the pipeline.dokter:image:registry.gitlab.com/gitlab-org/incubation-engineering/ai-assist/dokter/dokter:lateststage:lintvariables:DOKTER_DOCKERFILE:Dockerfilebefore_script:-mkdir -p ~/.ssh && echo "$DOKTER_SSH_KEY" > ~/.ssh/id_rsa && chmod -R 700 ~/.sshscript:-dokter -d $DOKTER_DOCKERFILE --gitlab-codequality -wafter_script:-bash /create-mr.shartifacts:name:"$CI_JOB_NAMEartifactsfrom$CI_PROJECT_NAMEon$CI_COMMIT_REF_SLUG"expire_in:1 daywhen:alwaysreports:codequality:-"dokter-$CI_COMMIT_SHA.json"paths:-"dokter-$CI_COMMIT_SHA.json"rules:# Very important to prevent a loop :-)-if:$CI_COMMIT_REF_NAME !~ /^dokter/ && $CI_PIPELINE_SOURCE == "merge_request_event"Gotcha'sBelow are some subjects that could raise questions, errors.Jinja templatingJinja is ignored, what will happen is, the templated lines will get ignored and the Docker instructions
will be parsed.Example:FROMscratch{%ifsomething%}#ThislinewillbeconsideredemptyRUNecho"some command"#Thislinewillbeparsed{%endif%}#ThislinewillbeconsideredemptyHere strings (EOF)At this moment if you have ahere stringin your bash command, the Dockerfile will fail, it can not be parsed. Support
will be added in the future.