We use cookies to understand how the site is used and to display ads. Analytics and advertising only run after you accept. You can change your choice anytime via the footer link or your browser settings. Privacy policy

Skip to content
>_devvkit

Dockerfile Linter

Lint Dockerfiles for best practices: layers, caching, security, size.

2 errors4 warnings2 info~4 layers · 2 stagesScore 28/100
WARN · Unpinned base imageline 1

"FROM node" has no pinned tag (defaults to latest). Pin an explicit version for reproducible builds.

ERROR · Copy everything before installing depsline 4

COPY . . before dependency install invalidates the layer cache on every change. Copy manifests first, then RUN install, then the rest. Also consider a .dockerignore.

WARN · apt-get update in a separate layerline 6

Run "apt-get update && apt-get install -y …" in one RUN to avoid stale apt indexes and extra layers.

WARN · apt-get without --no-install-recommendsline 7

Add --no-install-recommends to avoid pulling suggested packages and bloating the image.

INFO · Debug tools installedline 7

curl/vim/nano/jq bloat production images. Install them only in a dev stage or remove after use.

INFO · npm install instead of npm ciline 8

npm ci is deterministic and faster in CI/container builds when a lockfile is committed.

ERROR · Secret in ENVline 10

Hardcoded secrets in Dockerfiles are leaked in image history. Use build args / secrets or runtime env injection.

WARN · Runs as root

No USER instruction found — the container will run as root. Add USER to run as a non-privileged user.

Rule-based best-practice linting (Dockerfile reference + hadolint guidance). Layer count is an estimate: one per FROM/RUN/COPY/ADD plus the base image. .dockerignore presence cannot be verified from the Dockerfile alone. Runs entirely in your browser.

//Share this tool
//Related tools
JSON Formatter
Format, validate, minify, and prettify JSON data instantly.
JWT Decoder
Decode and inspect JWT tokens: header, payload, signature, expiration.
Base64 Encoder/Decoder
Encode text or files to Base64 and decode back. UTF-8 safe.
Regex Tester
Test regular expressions in real-time with match highlighting and groups.

Lint Dockerfiles against Docker best practices: base image pinning, layer caching order, apt-get hygiene, healthchecks, and secret handling. Get a severity-tagged report with a compliance score.

[x]Features
  • -Parses RUN, COPY, ADD, ENV, FROM and more
  • -Handles heredocs and line continuations
  • -Unpinned base tag and multi-stage warnings
  • -apt-get and pip caching rules
  • -Secrets-in-ENV and debug-tools detection
  • -Score report with copy-to-clipboard summary
>Use Cases
  • >Reviewing a Dockerfile before it hits CI
  • >Teaching container best practices in code review
  • >Shrinking image size with layer hints
  • >Hardening production images against supply-chain issues

Frequently Asked Questions

>Is my Dockerfile sent anywhere??
No. All linting happens locally in your browser with a rule engine that mimics Docker best practices.
>What rules does it check??
Pinned base image tags, missing healthchecks, COPY/ADD misuse, apt-get best practices, layer ordering for caching, debug tools in production images, and secrets in ENV, among others.
>Is the score a guarantee??
No — the score summarizes rule compliance. Final judgment about production readiness still needs runtime testing.