Skip to main content

Apply Docker best practices

org.openrewrite.docker.DockerBestPractices

Apply a set of Docker best practices to Dockerfiles. This recipe applies security hardening, build optimization, and maintainability improvements based on CIS Docker Benchmark and industry best practices.

Tags​

Recipe source​

GitHub: docker.yml, Issue Tracker, Maven Central

info

This recipe is composed of more than one recipe. If you want to customize the set of recipes this is composed of, you can find and copy the GitHub source for the recipe from the link above.

This recipe is available under the Apache License Version 2.0.

Definition​

Examples​

Example 1​

DockerBestPracticesTest#appliesBestPractices

Before​
FROM ubuntu:20.04
ADD app.jar /app/
RUN apt-get update
RUN apt-get install -y curl
ENTRYPOINT /app/start.sh
After​
~~(EOL: ubuntu:20.04 (ended 2025-05-31, suggest plucky (26.04)))~~>~~(Missing HEALTHCHECK instruction)~~>FROM ubuntu:20.04
COPY app.jar /app/
RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
ENTRYPOINT ["/app/start.sh"]
USER appuser
Example 2​

DockerBestPracticesTest#appliesBestPractices

Before​
FROM ubuntu:20.04
ADD app.jar /app/
RUN apt-get update
RUN apt-get install -y curl
ENTRYPOINT /app/start.sh
After​
~~(EOL: ubuntu:20.04 (ended 2025-05-31, suggest plucky (26.04)))~~>~~(Missing HEALTHCHECK instruction)~~>FROM ubuntu:20.04
COPY app.jar /app/
RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
ENTRYPOINT ["/app/start.sh"]
USER appuser

Usage​

This recipe has no required configuration parameters and comes from a rewrite core library. It can be activated directly without adding any dependencies.

  1. Add the following to your build.gradle file:
    build.gradle
    plugins {
        id("org.openrewrite.rewrite") version("latest.release")
    }

    rewrite {
        activeRecipe("org.openrewrite.docker.DockerBestPractices")
        setExportDatatables(true)
    }

    repositories {
        mavenCentral()
    }
  2. Run gradle rewriteRun to run the recipe.

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

End-of-life Docker images​

org.openrewrite.docker.table.EolDockerImages

Records Docker base images that have reached end-of-life.

Column NameDescription
Source fileThe Dockerfile containing the EOL base image.
Stage nameThe build stage name (from AS clause), if specified.
Image nameThe name of the base image.
TagThe image tag.
EOL dateThe date when the image reached end-of-life.
Suggested replacementRecommended newer version to migrate to.