Lint dockerfile

Find common Dockerfile hygiene, reproducibility, and privilege warnings.

freeworks offlinenothing uploaded
ToolDockerfile Linter
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

Dockerfile lines are scanned for instruction order, root usage, latest tags, sudo, ADD, package-cache cleanup, and related practices. Findings include line numbers and severity; no build is executed.

  • Rules target portable image hygiene rather than one policy.
  • Severity bands separate syntax from advice.

Worked example

Catch common Dockerfile anti-patterns
Detect :latest tag, sudo, missing --no-install-recommends, ADD misuse, and relative WORKDIR
Input
											FROM node:latest
RUN sudo apt-get update
RUN apt-get install -y curl
ADD . /app
WORKDIR app
Output
												# Dockerfile Lint Results

Errors: 0 | Warnings: 6 | Info: 1

[WARNING] Line 1 (DL3007): Avoid using 'latest' tag; pin to a specific version
[WARNING] Line 2 (DL3009): Combine apt-get update with install in a single RUN to avoid cache issues
[WARNING] Line 2 (DL3004): Avoid using sudo in Dockerfiles; use USER instead
[WARNING] Line 3 (DL3015): Use --no-install-recommends with apt-get install
[INFO] Line 3 (DL3059): Consider combining consecutive RUN commands with &&
[WARNING] Line 4 (DL3020): Use COPY instead of ADD for simple file copying
[WARNING] Line 5 (DL3006): WORKDIR should use absolute paths

When to use this

CI linting, security reviews, and platform image standards use Dockerfile findings.

Edge cases

  • A justified ADD can still trigger a generic warning.
  • latest can change without a Dockerfile diff.
  • Cleanup rules depend on the base distribution package manager.

References