Souus Tools
Sponsor

Development

Dockerfile Linter

Analyze your Dockerfile for best practices, security issues, and optimization opportunities with instant feedback and actionable suggestions.

Free to use No sign-up Runs in your browser

Tool workspace

2 errors 10 warnings 3 info
Line 1DL3007ERROR

Using `latest` tag in FROM (image: ubuntu:latest)

Pin a specific version tag, e.g. ubuntu:22.04 instead of ubuntu:latest.

Line 8DL3020ERROR

ADD used where COPY would suffice

Use COPY instead of ADD for copying local files. ADD has extra features (auto-extract, remote URLs) that can be surprising.

Line 2DL4000WARNING

MAINTAINER is deprecated

Use LABEL maintainer="[email protected]" instead.

Line 5DL3015WARNING

Using `apt-get install` without `--no-install-recommends`

Add --no-install-recommends to avoid installing unnecessary packages and reduce image size.

Line 6DL3014WARNING

Using `apt-get install` without `-y` flag

Add -y flag to avoid interactive prompts: apt-get install -y.

Line 6DL3015WARNING

Using `apt-get install` without `--no-install-recommends`

Add --no-install-recommends to avoid installing unnecessary packages and reduce image size.

Line 6DL3009WARNING

Missing `apt-get clean` or `rm -rf /var/lib/apt/lists/*` after install

Clean up apt cache in the same RUN layer to reduce image size.

Line 11DL3004WARNING

Using `sudo` in Dockerfile

Avoid sudo. Use USER to switch users, or run commands as root directly (default in Docker).

Line 13DL3011WARNING

EXPOSE with no port number

Specify a valid port number, e.g. EXPOSE 8080.

Line 15DL3006WARNING

Missing HEALTHCHECK instruction

Add a HEALTHCHECK to let Docker know how to check that the container is still working.

Line 15DL3002WARNING

Running as root — no USER instruction found

Add a USER instruction to run the container as a non-root user for better security.

Line 15DL3025WARNING

CMD uses shell form instead of exec form

Use exec form: CMD ["executable", "arg1", "arg2"] for proper signal handling.

Line 1DL3005INFO

Consider using a .dockerignore file

A .dockerignore file helps exclude unnecessary files from the build context, speeding up builds and reducing image size.

Line 4DL3003INFO

4 consecutive RUN instructions found

Combine RUN instructions using && to reduce image layers.

Line 9DL3000INFO

WORKDIR should use an absolute path

Use an absolute path, e.g. WORKDIR /app instead of WORKDIR app.

What Is a Dockerfile Linter?

A Dockerfile Linter is a static analysis tool that examines your Dockerfile instructions and flags potential issues. It checks for common mistakes, security vulnerabilities (like running as root), deprecated syntax, inefficient layering, missing health checks, and unpinned base image tags. Similar to tools like Hadolint, it provides severity-rated feedback with concrete suggestions to help you build smaller, safer, and more maintainable container images.

How to Use the Dockerfile Linter

  1. 1Paste your Dockerfile content into the text area.
  2. 2The linter automatically analyzes every instruction and displays a categorized list of findings.
  3. 3Each result includes a line number, severity level (error, warning, or info), a rule ID, a description, and a fix suggestion.
  4. 4Review the summary counts at the top, then address errors first, followed by warnings and informational hints.

Common Use Cases

Pre-Push Auditing

Audit Dockerfiles before pushing to a container registry to catch issues early.

CI/CD Best Practices

Enforce Dockerfile best practices in CI/CD pipelines to maintain consistent image quality.

Learning Docker

Learn Docker best practices with real-time feedback and actionable suggestions on your own Dockerfiles.

Code Review

Review Dockerfiles during code reviews to catch security issues, optimization opportunities, and deprecated syntax.

Frequently asked questions

What rules does the Dockerfile linter check?

The linter checks for over 15 rules across three severity levels: errors (missing FROM, latest tag, ADD vs COPY, duplicate CMD), warnings (apt-get flags, sudo usage, deprecated MAINTAINER, missing HEALTHCHECK/USER, shell-form CMD), and info (combining RUN layers, .dockerignore, absolute WORKDIR paths).

Is this linter equivalent to Hadolint?

This tool covers the most common and impactful Hadolint rules in a browser-based interface with no installation required. For comprehensive linting in CI/CD, consider using Hadolint alongside this tool for quick checks.

Why should I pin my base image version?

Using 'latest' or an untagged base image means your builds may break unexpectedly when the upstream image is updated. Pinning a specific version (e.g., node:20-alpine) ensures reproducible, predictable builds.

Why is running as root in a container a security risk?

Running as root inside a container increases the attack surface. If an attacker compromises the application, they have root privileges within the container, which can make container escapes more dangerous. Adding a USER instruction mitigates this risk.