droast
Installation
Entrypoint
Types
Droast

droast

droast (https://github.com/immanuwell/dockerfile-roast) is a standalone
Dockerfile linter: no API key, no LLM, no network access at lint time.
It complements security/trivy, which scans dependencies and secrets but does
not review Dockerfile authoring practices.

Severity model: droast exits 1 only on ERROR findings. WARNING/INFO findings
are reported but leave the exit code at 0, so most projects get an advisory
report rather than a gate.

Installation

dagger install dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2

Entrypoint

Return Type

Droast !

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \

func (m *MyModule) Example() *dagger.Droast  {
	return dag.
			Droast()
}

@function
def example() -> dagger.Droast:
	return (
		dag.droast()
	)

@func()
example(): Droast {
	return dag
		.droast()
}

Types

Droast 🔗

version() 🔗

Tag of the ghcr.io/immanuwell/droast image

Return Type

String !

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 version

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Droast().
			Version(ctx)
}

@function
async def example() -> str:
	return await (
		dag.droast()
		.version()
	)

@func()
async example(): Promise<string> {
	return dag
		.droast()
		.version()
}

minSeverity() 🔗

Lowest severity to report: info, warning, error (empty => droast default)

Return Type

String !

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 min-severity

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Droast().
			Minseverity(ctx)
}

@function
async def example() -> str:
	return await (
		dag.droast()
		.minseverity()
	)

@func()
async example(): Promise<string> {
	return dag
		.droast()
		.minSeverity()
}

skip() 🔗

Comma-separated rule IDs to ignore (e.g. “DF033,DF012”)

Return Type

String !

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 skip

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Droast().
			Skip(ctx)
}

@function
async def example() -> str:
	return await (
		dag.droast()
		.skip()
	)

@func()
async example(): Promise<string> {
	return dag
		.droast()
		.skip()
}

roast() 🔗

Keep droast’s joke lines in the output (off by default: noise in CI logs)

Return Type

Boolean !

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 roast

func (m *MyModule) Example(ctx context.Context) bool  {
	return dag.
			Droast().
			Roast(ctx)
}

@function
async def example() -> bool:
	return await (
		dag.droast()
		.roast()
	)

@func()
async example(): Promise<boolean> {
	return dag
		.droast()
		.roast()
}

lint() 🔗

Lint lints the Dockerfiles found under source and returns the report as text.

Returns an error when droast reports ERROR-severity findings and failOnFindings is true. When no Dockerfile exists, it reports that and succeeds — an absent Dockerfile is not a lint failure.

Return Type

String !

Arguments

Name	Type	Default Value	Description
source	Directory !	-	Directory to lint
subpath	String	"."	Relative subpath within source (default: “.”)
format	String	"compact"	Output format: compact, json, sarif, github
failOnFindings	Boolean	false	Fail the call when ERROR-severity findings are detected

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 lint --source DIR_PATH

func (m *MyModule) Example(ctx context.Context, source *dagger.Directory) string  {
	return dag.
			Droast().
			Lint(ctx, source)
}

@function
async def example(source: dagger.Directory) -> str:
	return await (
		dag.droast()
		.lint(source)
	)

@func()
async example(source: Directory): Promise<string> {
	return dag
		.droast()
		.lint(source)
}

lintArtifact() 🔗

LintArtifact lints the Dockerfiles under source and returns a directory holding report.<ext> (machine-readable), report.txt (human-readable) and findings (“1” when ERROR-severity findings exist, “0” otherwise).

The call never fails on findings, so reports are always exportable and the CI gate is decided by reading findings. This mirrors trivy’s ScanFsArtifact so both scanners are consumed the same way in a pipeline.

When no Dockerfile exists the artifact is still produced, with an empty report and findings “0”, so downstream publish steps do not need a special case.

Return Type

Directory !

Arguments

Name	Type	Default Value	Description
source	Directory !	-	Directory to lint
subpath	String	"."	Relative subpath within source (default: “.”)
format	String	"sarif"	Machine-readable report format: sarif, json, github (default: sarif)

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 lint-artifact --source DIR_PATH

func (m *MyModule) Example(source *dagger.Directory) *dagger.Directory  {
	return dag.
			Droast().
			Lintartifact(source)
}

@function
def example(source: dagger.Directory) -> dagger.Directory:
	return (
		dag.droast()
		.lintartifact(source)
	)

@func()
example(source: Directory): Directory {
	return dag
		.droast()
		.lintArtifact(source)
}

test() 🔗

Return Type

String !

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 test

func (m *MyModule) Example(ctx context.Context) string  {
	return dag.
			Droast().
			Test(ctx)
}

@function
async def example() -> str:
	return await (
		dag.droast()
		.test()
	)

@func()
async example(): Promise<string> {
	return dag
		.droast()
		.test()
}

withMinSeverity() 🔗

WithMinSeverity filters out findings below the given severity: info, warning, error.

Return Type

Droast !

Arguments

Name	Type	Default Value	Description
severity	String !	-	No description provided

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 with-min-severity --severity string

func (m *MyModule) Example(severity string) *dagger.Droast  {
	return dag.
			Droast().
			Withminseverity(severity)
}

@function
def example(severity: str) -> dagger.Droast:
	return (
		dag.droast()
		.withminseverity(severity)
	)

@func()
example(severity: string): Droast {
	return dag
		.droast()
		.withMinSeverity(severity)
}

withRoast() 🔗

WithRoast keeps droast’s joke lines in the report.

Return Type

Droast !

Arguments

Name	Type	Default Value	Description
enabled	Boolean	true	No description provided

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 with-roast

func (m *MyModule) Example() *dagger.Droast  {
	return dag.
			Droast().
			Withroast()
}

@function
def example() -> dagger.Droast:
	return (
		dag.droast()
		.withroast()
	)

@func()
example(): Droast {
	return dag
		.droast()
		.withRoast()
}

withSkip() 🔗

WithSkip ignores the given comma-separated rule IDs (e.g. “DF033,DF012”).

Return Type

Droast !

Arguments

Name	Type	Default Value	Description
rules	String !	-	No description provided

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 with-skip --rules string

func (m *MyModule) Example(rules string) *dagger.Droast  {
	return dag.
			Droast().
			Withskip(rules)
}

@function
def example(rules: str) -> dagger.Droast:
	return (
		dag.droast()
		.withskip(rules)
	)

@func()
example(rules: string): Droast {
	return dag
		.droast()
		.withSkip(rules)
}

withVersion() 🔗

WithVersion overrides the droast image tag.

Return Type

Droast !

Arguments

Name	Type	Default Value	Description
version	String !	-	No description provided

Example

dagger -m dev.azure.com/dordogne/DAGGER-TEMPLATES/_git/DAGGER-TEMPLATES/security/droast@ba520d37c227c2f60534c61c2ded10d70cf128e2 call \
 with-version --version string

func (m *MyModule) Example(version string) *dagger.Droast  {
	return dag.
			Droast().
			Withversion(version)
}

@function
def example(version: str) -> dagger.Droast:
	return (
		dag.droast()
		.withversion(version)
	)

@func()
example(version: string): Droast {
	return dag
		.droast()
		.withVersion(version)
}