How AST-Based Static Analysis Catches Dockerfile Vulnerabilities That Regex Scanners Miss

A multi-stage build with obfuscated instructions or unpinned stage contexts bypasses standard regex linters with minimal effort. Consider this production Dockerfile: # syntax=docker/dockerfile:1 FROM