Lint a Dockerfile for security and best practice: unpinned or latest images, running as root, secrets in ENV/ARG, curl piped to sh, ADD of URLs, apt and pip caches, sudo, chmod 777, missing HEALTHCHECK. Scored.