Skip to content

Dockerfile Linter

Lint Dockerfiles for common mistakes: latest tags, apt caches, running as root, ADD vs COPY, secrets in ENV and more. Nothing is uploaded.

No uploads
  • ! Line 1 Avoid the :latest tag for "node:latest" — builds will not be reproducible [latest]
  • ! Line 2 MAINTAINER is deprecated — use LABEL maintainer="…" [maintainer]
  • ✕ Line 3 "API_TOKEN" looks like a secret baked into the image — use build secrets (RUN --mount=type=secret) or runtime env [secret]
  • ! Line 4 Run apt-get update and install in the same RUN, or the cached update goes stale [apt-update]
  • ✕ Line 5 apt-get install needs -y in a non-interactive build [apt-y]
  • i Line 5 Add --no-install-recommends to keep the image small [apt-recommends]
  • i Line 5 Clean up with rm -rf /var/lib/apt/lists/* in the same RUN [apt-lists]
  • i Line 5 Consecutive RUN (line 4) — combine with && to reduce layers [layers]
  • i Line 6 Prefer npm ci for reproducible installs from package-lock.json [npm-ci]
  • i Line 6 Use WORKDIR instead of cd [cd]
  • i Line 6 Consecutive RUN (line 5) — combine with && to reduce layers [layers]
  • ! Line 7 Use COPY instead of ADD for local files [add]
  • ! Line 8 Use an absolute WORKDIR path (/app) [workdir]
  • ! Line 9 Piping a download into a shell is risky; also set SHELL ["/bin/bash", "-o", "pipefail", "-c"] so failures are caught [pipe-sh]
  • ✕ Line 10 Invalid port "70000" (1–65535) [port]
  • i Line 11 Use the JSON exec form for CMD (["cmd", "arg"]) so signals reach your process [exec-form]
  • ! Line 12 Multiple CMD instructions — only the last one (line 12) takes effect [multiple]
  • ! Line 12 The container runs as root — add a USER with a non-root account [root]
  • i Line 12 No HEALTHCHECK defined [healthcheck]

How to use Dockerfile Linter

  1. 1Open Dockerfile Linter. It runs in your browser, no sign-up.
  2. 2Type or paste your input.
  3. 3Copy or download the result.

Questions

Which rules are checked?

Common best practices similar to hadolint: pinned base images, apt/apk/pip cache cleanup, ADD vs COPY, running as root, secrets in ENV/ARG, exec-form CMD, invalid ports, multiple CMDs and more.

Is my Dockerfile uploaded?

No. Linting happens entirely in your browser.

Does it build the image?

No. It reads the Dockerfile text only.

More tools

JSON Formatter & ValidatorPretty-print, minify, validate Base64 Encoder & DecoderText and files Hash GeneratorMD5, SHA-1, SHA-256, SHA-512 Password & UUID GeneratorStrong, random, local Regex TesterLive matches and groups JWT DecoderHeader, payload, expiry Diff CheckerCompare two texts CSV ↔ JSON ↔ YAML ↔ XMLConvert data formats