Dockerfile risk

x402 resource x402 REST

47-85-47-24.sslip.io · 47-85-47-24.sslip.io · Infrastructure

Provider site ↗

Review a built-in risky Dockerfile for embedded build secrets, mutable base images, unverified downloads, unsafe permissions, root runtime, and package-manager hygiene without building or pulling an image

Price per call 0.001 USDC per call published unit: per call

Calls · 30d — not reported by any source

Payers · 30d — not reported by any source

Observed inflows · 30d — not attributable

Inflow growth · 7d — not comparable (baseline under $1 or window incomplete)

Payment evidence Attribution blocked confidence: low · read 2026-10-29

Observed inflows · last 30 days

No inflow observed in this window

The payout address is also published by 10 other service(s); the volume cannot be attributed to one of them.

Observed inflows by window for Dockerfile risk.
Window	Observed	Transfers
Last complete day (2026-10-30)	—	—
Last 7 days	—	—
Last 30 days	—	—
Growth, 7d against the 7 before	not comparable

Source: on-chain transfer scan (USDC on Base) Window: 2026-10-01 → 2026-10-30 Scanned: 30/30 days Sample: 0 days with a measurement First seen: never Last update: 2026-10-30

Daily history →. Observed transfers show value arriving at the payout address; they do not establish service revenue.

Blockchain wallets

Full addresses · public payment evidence

Receiving wallets are payment addresses published for this service. Sending wallets transferred funds to an exclusive receiving address; this alone does not prove a purchase or identify an agent.

Receiving wallets · provider payment addresses

All published receiving wallet addresses for Dockerfile risk.
Network	Full wallet address	Evidence
Base	0xfe8b1298727706a6d9737c5afbc7af8e76842b91	Shared address · activity cannot be assigned to this serviceFrom source record · source: payai

Sending wallets · observed counterparties

No sending wallet addresses have been retained for this service. Buyer wallets are unknown; daily totals and reported payer counts do not reveal their addresses.

Coverage includes retained scans only, not every historical transaction. Earlier daily totals cannot recover sender addresses. Sender lists exclude shared receiving wallets, whose transfers could belong to another service. A provider address does not establish wallet ownership.

Competitors & category benchmark

Rank the whole category →

Closest competitors Infrastructure

Events 223 calls · 0.005 USDC per call —
Agent Web Tools 71 calls · 0.001 USDC per call $0.227
Pulse 62 calls · 0.003 USDC per call —
StableStudio 59 calls · 0.01 USDC per call —
neo timestamp 57 calls · 0.01 USDC per call —

Sorted by source-measured calls, not by our opinion. The right-hand figure is observed inflow, which stays empty for peers whose address is shared.

Category benchmark 6,058 services in this category

With a measured call count	972 (16.0 %)
With a published price	1,116 (18.4 %)
With attributable inflows	19 (0.3 %)
Observed inflows · 30d	$63.56
Median measured calls	2
Median price per call	$0.01

Similar services

All of Infrastructure →

Events x402 REST usage

Query Ethereum contract event logs via eth_getLogs - filter by contract, topic, and block range

api.onesource.io Infrastructure 223 calls / 30d checked 2026-10-31

0.005 USDC per call per call

Agent Web Tools x402 REST usage

Check if a URL is up: status, latency, redirects, title.

agent-web-tools.agent-web-tools.workers.dev Infrastructure 71 calls / 30d checked 2026-10-31

0.001 USDC per call per call

Pulse x402 REST usage

China pulse, cheap enough to POLL: what China is talking about RIGHT NOW and what is NEW since your last call - built for agents that monitor continuously. Returns `consensus` (phrases trending on 2+ of Weibo/Baidu/Douyi...

stockwaves.net Infrastructure 62 calls / 30d checked 2026-10-30

0.003 USDC per call per call

StableStudio x402 REST usage

Get a client token for direct upload to Vercel Blob

stablestudio.dev Infrastructure 59 calls / 30d checked 2026-10-31

0.01 USDC per call per call

Chosen by category and by whether we have measured them, not by who pays us. A sponsored placement in this list is labelled as such.

Service details, payment routes and source evidence

Where you can pay

1 route from the provider's payment requirements

Payment networks and amounts published for Dockerfile risk.
Network	Scheme	Amount	Asset
Base	exact	0.001	USDC

“exact” is the price per call. “upto” is a ceiling the client sets, not a price. Atomic amount 1000 = 0.001 USDC per call on Base.

What you can call

access: payment per call (x402)

endpoint https://47-85-47-24.sslip.io/v1/dockerfile-risk

Request

{
    "type": "http",
    "method": "GET",
    "queryParams": {
        "scenario": "risky-container-build"
    }
}

Response

{
    "type": "json",
    "example": {
        "label": "paid-demo:risky-container-build",
        "stats": {
            "line_count": 8,
            "stage_count": 1,
            "instruction_count": 8,
            "findings_by_severity": {
                "low": 3,
                "high": 9,
                "medium": 0,
                "critical": 0
            }
        },
        "stages": [
            {
                "name": "stage-0",
                "user": null,
                "final": true,
                "index": 0,
                "from_line": 1,
                "base_image": "python:latest",
                "has_healthcheck": false
            }
        ],
        "profile": "production",
        "summary": "BLOCK: 12 finding(s) across 1 build stage(s); 9 require resolution or explicit approval.",
        "verdict": "BLOCK",
        "coverage": {
            "mode": "static-dockerfile",
            "checks": [
                "base-image immutability",
                "build-secret handling",
                "remote-download integrity",
                "package-manager hygiene",
                "runtime least privilege",
                "file-permission and context-copy risk",
                "process and healthcheck form"
            ],
            "limitations": [
                "Does not inspect image layers, package vulnerabilities, signatures, provenance, or runtime configuration.",
                "Cannot verify .dockerignore contents or whether a remote artifact checksum is correct.",
                "Findings are static release gates and do not replace an image scan or sandboxed build."
            ],
            "build_executed": false,
            "registry_contacted": false,
            "secret_values_returned": false,
            "filesystem_context_read": false
        },
        "findings": [
            {
                "code": "final_stage_runs_as_root",
                "line": 1,
                "stage": 0,
                "message": "The final stage does not establish a non-root runtime user.",
                "end_line": 1,
                "severity": "high",
                "standard": "container-least-privilege",
                "instruction": "FROM",
                "remediation": "Create or select a non-root account and set USER in the final stage."
            },
            {
                "code": "mutable_or_latest_base_image",
                "line": 1,
                "stage": 0,
                "message": "The base image is untagged or uses the mutable latest tag.",
                "end_line": 1,
                "severity": "high",
                "standard": "docker-build-best-practice",
                "instruction": "FROM",
                "remediation": "Use a trusted image version and pin its sha256 digest."
            },
            {
                "code": "secret_like_arg",
                "line": 2,
                "stage": 0,
                "message": "ARG declares 1 secret-like key(s); values are intentionally omitted.",
                "end_line": 2,
                "severity": "high",
                "standard": "docker-build-secrets",
                "instruction": "ARG",
                "remediation": "Pass build credentials with BuildKit secret or SSH mounts instead of ARG or ENV."
            },
            {
                "code": "secret_like_env",
                "line": 3,
                "stage": 0,
                "message": "ENV declares 1 secret-like key(s); values are intentionally omitted.",
                "end_line": 3,
                "severity": "high",
                "standard": "docker-build-secrets",
                "instruction": "ENV",
                "remediation": "Pass build credentials with BuildKit secret or SSH mounts instead of ARG or ENV."
            },
            {
                "code": "remote_add_without_checksum",
                "line": 4,
                "stage": 0,
                "message": "ADD downloads a remote resource without an explicit checksum.",
                "end_line": 4,
                "severity": "high",
                "standard": "dockerfile-reference",
                "instruction": "ADD",
                "remediation": "Use ADD --checksum=sha256:<digest>, or download and verify the artifact in one RUN layer."
            },
            {
                "code": "sensitive_file_copied",
                "line": 5,
                "stage": 0,
                "message": "A secret-like credential or configuration path is copied into an image layer; the path value is omitted.",
                "end_line": 5,
                "severity": "high",
                "standard": "docker-build-secrets",
                "instruction": "COPY",
                "remediation": "Exclude the file with .dockerignore and inject required credentials through runtime or BuildKit secrets."
            },
            {
                "code": "remote_script_piped_to_shell",
                "line": 6,
                "stage": 0,
                "message": "A remotely downloaded script is piped directly to a shell.",
                "end_line": 6,
                "severity": "high",
                "standard": "software-supply-chain",
                "instruction": "RUN",
                "remediation": "Download a versioned artifact, verify its checksum or signature, inspect it, then execute it."
            },
            {
                "code": "tls_verification_disabled",
                "line": 6,
                "stage": 0,
                "message": "A download command disables TLS certificate verification.",
                "end_line": 6,
                "severity": "high",
                "standard": "software-supply-chain",
                "instruction": "RUN",
                "remediation": "Restore certificate verification and trust only an explicit CA when required."
            },
            {
                "code": "world_writable_permissions",
                "line": 6,
                "stage": 0,
                "message": "RUN creates world-writable permissions with chmod 777.",
                "end_line": 6,
                "severity": "high",
                "standard": "container-least-privilege",
                "instruction": "RUN",
                "remediation": "Grant the narrowest owner/group permissions required by the runtime user."
            },
            {
                "code": "missing_healthcheck",
                "line": 1,
                "stage": 0,
                "message": "The production final stage has no active HEALTHCHECK instruction.",
                "end_line": 1,
                "severity": "low",
                "standard": "dockerfile-reference",
                "instruction": "FROM",
                "remediation": "Add a bounded HEALTHCHECK or document that the orchestrator owns equivalent probes."
            },
            {
                "code": "relative_workdir",
                "line": 7,
                "stage": 0,
                "message": "WORKDIR uses a relative path.",
                "end_line": 7,
                "severity": "low",
                "standard": "docker-build-best-practice",
                "instruction": "WORKDIR",
                "remediation": "Use an absolute WORKDIR for predictable filesystem layout."
            },
            {
                "code": "shell_form_process_instruction",
                "line": 8,
                "stage": 0,
                "message": "CMD uses shell form, which can complicate signal and argument handling.",
                "end_line": 8,
                "severity": "low",
                "standard": "dockerfile-reference",
                "instruction": "CMD",
                "remediation": "Use JSON exec form for CMD when shell expansion is not required."
            }
        ],
        "risk_score": 100,
        "analysis_id": "docker-324e1d9d94b0d50a2959",
        "approval_gates": [
            "Resolve or explicitly approve 9 critical/high finding(s) before publishing the image.",
            "Confirm that no credential remains in image layers, build history, or copied context.",
            "Require a documented exception if the production process must run as root."
        ],
        "analyzer_version": "dockerguard-dockerfile/1.0"
    }
}

Examples are the provider's own, not a call we made.

Opportunity insights

2 findings from measured data

Payment attribution is blocked

The payout address is shared with 10 other service(s). That is normal for facilitator and platform addresses, and it is why this profile shows no inflow figure. The volume exists — it just cannot be split without inventing a rule.
How attribution works →
Category benchmark

19 of 6,058 services (0.3%) in Infrastructure have attributable inflows; 972 have a source-measured call count. Median measured calls: 2.
Rank this category by observed inflows →

What the provider says

Quoted from PayAI · source record · read 2026-10-29

Facts and where they come from

Price: 0.001 USDC per call Provider claim
Recorded value: 0.001 USDC per call.
Unit: per call
Protocol: x402, REST · transport: HTTP Provider claim
Auth: x402
Endpoint: https://47-85-47-24.sslip.io/v1/dockerfile-risk
Source: PayAI · Public discovery API (provider-published records)
Last checked: Not checked by us yet — the data is as the source published it
First seen: 2026-10-26

Money, and what it actually proves

Verified revenue · 30d Unknown

Observed inflows · 30d —

Attribution Shared

Receipt ledger Not connected

Attribution blocked · confidence low
The payout address is also published by 10 other service(s); the volume cannot be attributed to one of them.

Why revenue is “unknown”. A revenue figure needs a receipt: an amount a buyer actually paid for this service. We hold none for this entry, and we hold no funds at all. What we have instead is nothing measurable: no price, no attributable address, no receipt. The payout address is also published by 10 other service(s); the volume cannot be attributed to one of them.

Daily market statistics — the ledger view, day by day

No daily history has been archived for this service yet. Open the full daily history →

Payment rails

Base · exact · USDC

0xFe8b1298727706A6D9737C5afbC7AF8e76842B91

0.001 USDC

From source record

A payment rail is where the provider asks to be paid. It is not proof that anything was paid through it.

Provenance

One row per statement. “Verified” means we checked it ourselves and the finding is quoted. “Provider claim” means we read it in the provider's own record. “Not found” is a statement about our search, not proof of absence.

Statement	Status	What we found	Source	Checked
Endpoint	Provider claim	https://47-85-47-24.sslip.io/v1/dockerfile-risk Evidence Als Resource-URL im Bazaar-Eintrag geführt.	facilitator.payai.network	2026-10-29
Input output	Provider claim	Request/response examples published with the listing Evidence Beispiel-Ein- und -Ausgabe stammen aus dem Bazaar-Eintrag des Anbieters.	facilitator.payai.network	2026-10-29
Payment	Provider claim	1 rail: Base · payee 0xFe8b1298727706A6D9737C5afbC7AF8e76842B91 Evidence Aus den `accepts`-Einträgen: Netzwerk, Asset, Empfängeradresse und Betrag. Die Adresse ist die Grundlage der späteren On-Chain-Zuordnung; sie ist noch nicht durch eine eigene 402-Antwort bestätigt.	facilitator.payai.network	2026-10-29
Pricing	Provider claim	0.001 USDC per call Evidence Atomic amount 1000 = 0.001 USDC per call on Base. Netzwerk: Base.	facilitator.payai.network	2026-10-29
Protocol	Provider claim	x402 (HTTP 402 payment challenge) Evidence Im x402 Bazaar als zahlungspflichtige HTTP-Ressource gelistet (x402Version 2, Typ http).	facilitator.payai.network	2026-10-29
Provider	Provider claim	47-85-47-24.sslip.io Evidence Die Ressource wird unter diesem Host im x402 Bazaar geführt; die Angaben stammen vom Anbieter.	facilitator.payai.network	2026-10-29

Endpoint checks

We have not called this endpoint yet. Until we do, everything above is what the source published — no more.

Price

0.001 USDC per call

price checked 2026-10-29 Open at 47-85-47-24.sslip.io

You buy from the provider, not from us. This page takes no payment, holds no funds and stores no wallet keys.

Save

Kept in this browser session — no account needed.

Favourites are kept on this site only.