Defined in hooks/hooks.json
{
"PreToolUse": [
{
"hooks": [
{
"type": "prompt",
"prompt": "Before writing Dockerfile or docker-compose files, validate:\n\n1. **Base Image Security**\n - Using official/verified base images?\n - Specific version tags (not 'latest')?\n - Minimal base image (alpine, distroless)?\n\n2. **Build Best Practices**\n - Multi-stage builds for size optimization?\n - Proper layer caching (COPY package files before code)?\n - Non-root user configured?\n - .dockerignore present?\n\n3. **Security Concerns**\n - No hardcoded secrets/credentials?\n - No sensitive files in build context?\n - Proper file permissions?\n\n4. **Optimization**\n - Minimal layers (combine RUN commands)?\n - Clean up package caches?\n - HEALTHCHECK defined?\n\nIf any issues found, suggest improvements before writing."
}
],
"matcher": "Write"
},
{
"hooks": [
{
"type": "prompt",
"prompt": "Before editing Dockerfile or docker-compose, review the changes for:\n\n1. **Security Impact**\n - Are new secrets/credentials being added?\n - Does the change increase attack surface?\n - Are file permissions still secure?\n\n2. **Build Efficiency**\n - Will this break layer caching?\n - Should this be a separate stage?\n - Is the layer order optimal?\n\n3. **Best Practices**\n - Still following multi-stage patterns?\n - Maintaining non-root user?\n - HEALTHCHECK still present?\n\nValidate changes align with container security and optimization standards."
}
],
"matcher": "Edit"
}
],
"PostToolUse": [
{
"hooks": [
{
"type": "prompt",
"prompt": "If a Docker command was executed (docker build, docker-compose up, docker push), consider:\n\n1. **For docker build**: Run security scan with trivy, verify image size\n2. **For docker-compose up**: Check service health, verify network connectivity\n3. **For docker push**: Verify push success, update deployment docs\n\nWould you like to run any validation steps?"
}
],
"matcher": "Bash"
},
{
"hooks": [
{
"type": "prompt",
"prompt": "Dockerfile created/updated. Recommended validation:\n\n1. **Build Test**: docker build -t test-image:local .\n2. **Lint**: hadolint Dockerfile (if installed)\n3. **Security Pre-Check**: Review secrets, base image provenance\n4. **Size Estimation**: Predict final image size\n\nShould I validate the Dockerfile or proceed with a test build?"
}
],
"matcher": "Write"
}
]
}{
"riskFlags": {
"touchesBash": true,
"matchAllTools": false,
"touchesFileWrites": true
},
"typeStats": {
"prompt": 4
},
"eventStats": {
"PreToolUse": 2,
"PostToolUse": 2
},
"originCounts": {
"absolutePaths": 0,
"pluginScripts": 0,
"projectScripts": 0
},
"timeoutStats": {
"commandsWithoutTimeout": 0
}
}