Highlight the Dockerfile layers or Kubernetes YAML block
Select the multi-stage build block or the `securityContext`, `resources`, and `annotations` section in GitHub, GitLab, or docs.
How to explain Dockerfile directives and Kubernetes YAML manifests in place.
Highlight multi-stage Dockerfile layers, Kubernetes PodSecurity policies, ingress annotations, or Helm values and decode security risks and resource traps.
Best fit
Best for DevOps engineers, backend developers, and SREs reviewing container builds, CI/CD pipelines, and Kubernetes YAML configurations.
On-screen walkthrough
How this looks on a real webpage.
Instead of switching tabs and rebuilding context, highlight the exact passage that slowed you down and press your shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on macOS, fully customizable in settings).
1. Highlighted on page (Kubernetes Ingress YAML & Deployment Spec)
apiVersion: networking.k8s.io/v1 kind: Ingress metadata: annotations: nginx.ingress.kubernetes.io/configuration-snippet: | more_set_headers "X-Forwarded-For $http_x_forwarded_for"; nginx.ingress.kubernetes.io/proxy-body-size: '0' spec: rules: - host: api.example.com
Ctrl+Shift+X“What are the security and operational risks of these two ingress annotations?”
2. Vezz me on-screen answer overlay
1. **`configuration-snippet` Injection Risk**: Ingress-NGINX configuration snippets are a well-documented vector for arbitrary NGINX directive injection and cluster compromise (CVE-2022-4886 / CVE-2023-5043). Many clusters now enforce snippet disabling.
2. **`proxy-body-size: '0'` Uncapped Buffering Risk**: Setting body size to `'0'` completely disables client request body limits—leaving backend pods vulnerable to trivial HTTP POST memory-exhaustion DoS attacks.
3. **Remediation**: Remove the custom header snippet (let ingress handle X-Forwarded-For securely) and cap `proxy-body-size` to a safe limit (e.g., `10m`).
3. Suggested follow-up questions in thread
- “What annotation should we use for client body timeout to prevent Slowloris attacks?”
- “Explain how multi-stage Docker builds reduce image CVE counts.”
Step-by-step workflow
How to run this workflow in place.
Ask for security vulnerabilities and resource limits
Press your shortcut and ask Vezz me whether the container runs as root, mounts sensitive host paths, or lacks memory limits.
Generate a production-hardened rewrite
Ask Vezz me for an idiomatic multi-stage Dockerfile or a non-root `securityContext` snippet.
Key details
Why this approach works better than switching tabs.
Comparison Matrix
Reviewing Container & Kubernetes Manifests
Comparing in-page AI auditing with CLI linters and manual inspection.
| Method | Strengths | Tradeoffs |
|---|---|---|
| Vezz me on GitHub PR Diff | Instant explanation of obscure ingress annotations and Dockerfile layer bloat | Operates on the text you highlight in the browser |
| CLI Linter (kube-linter / hadolint) | Automated rule checks in CI pipelines | Outputs rule IDs without explaining *why* an annotation is risky for your workload |
| Reading Kubernetes reference docs | Authoritative specification | Takes 20 minutes to cross-reference multiple API versions and controller docs |
Frequently asked questions
Common questions about devops & cloud native.
Can Vezz me optimize multi-stage Dockerfiles for smaller image sizes?
Yes! Highlight your Dockerfile and ask Vezz me how to optimize layer caching, combine `RUN` steps, and copy only production artifacts into a distroless or Alpine final stage.
Does it work on Helm charts and Kustomize overlays?
Yes. Highlight any `values.yaml` or `kustomization.yaml` snippet on GitHub or in your browser and press your shortcut (default: Ctrl+Shift+X).
Which prompt preset is best for DevOps and infra reviews?
Use our Senior Engineer Code Reviewer or Security Threat Modeler preset.
Related workflows & guides
Explore connected pages.
Ready to try this workflow on your own reading?
Install Vezz me free, highlight text on any webpage, and press your customizable shortcut (default: Ctrl+Shift+X or Cmd+Shift+X on Mac) to get an answer right beside the source.
