The problem
Dockerfiles accumulate “smells” — missing flags, leftover package caches, insecure defaults — that quietly inflate image size and attack surface. They are hard to spot because they hide across both the Dockerfile instructions and the shell commands inside RUN.
The approach
docker-parfum parses the Dockerfile and its embedded shell into a single AST using Tree-sitter, applies ~32 detection rules, and can rewrite the file to fix the violations automatically.
In practice
It is the analysis engine behind the study Empirical Study of the Docker Smells Impact on the Image Size (ICSE 2024), which measured how much these smells actually cost across a large corpus of projects.
Highlights
- Parses Dockerfile + embedded shell into one Tree-sitter AST
- ~32 detection rules with automatic rewriting
- Analysis engine for an ICSE 2024 study