Dockerfile Linter
Paste a Dockerfile and instantly find security, caching, and image-size issues — root users, secrets in ENV, :latest tags, ADD misuse — with line-level fixes,
Loading tool...
What is Dockerfile Linter?
Dockerfile Linter is a free online tool that scans pasted Dockerfiles for common security, caching, and image-size mistakes. It parses the full instruction stream — including line continuations and multi-stage builds — then applies 12+ rules modeled on hadolint, such as floating :latest base images, containers that run as root, secrets baked into ENV or ARG, ADD used where COPY fits better, unpinned apt packages, and apt caches left inside layers. Every finding points to the exact line, explains the impact, and offers a copyable fix.
Key Benefits
- Catch security and size issues before the image is built, not after an incident
- Line-level findings make fixes immediate instead of theoretical
- Severity triage tells you what must change now versus what can wait
- Copy-paste fixes and a markdown report slot straight into pull request reviews
- No install, no account, and no upload — the whole check runs in your browser
Common Use Cases
- •Reviewing a Dockerfile before merging a pull request
- •Auditing existing images for root users and embedded secrets
- •Shrinking image size by cleaning apt/pip/npm caches in layers
- •Onboarding developers to Dockerfile best practices with concrete feedback
- •Preparing containers for security scan or compliance review
Lint a Dockerfile in Your Browser
- Paste your Dockerfile: Drop the full file contents into the input box — parsing handles line continuations and skips comments, and results update as you type.
- Check the severity summary: The counters show errors, warnings, notes, and the number of parsed instructions so you can gauge overall file health at a glance.
- Work through the issues: Each finding shows its rule ID, line number, message, and a suggested fix — press Copy fix to grab a corrected snippet like pip install --no-cache-dir or npm ci.
- Share the report: Press Copy report for a plain-text summary with every issue and fix, ready to paste into a code review or ticket.
Key Features
- 12+ lint rules modeled on hadolint DL3002–DL3059 for security, caching, and size
- Line-precise findings with severity triage into errors, warnings, and notes
- Copyable fix suggestion attached to every issue
- One-click markdown lint report for pull request comments
- Full Dockerfile parser with line continuations and multi-stage builds
- Runs entirely in your browser — proprietary Dockerfiles never leave your machine
Frequently Asked Questions
Which rules does the linter check?
Hadolint-style rules such as DL3006 (FROM :latest), DL3002 (running as root), DL3008 and DL3009 (apt pinning and cleanup), DL3013 (pip cache), DL3016 (npm ci), DL3020 (ADD vs COPY), DL3011 (invalid EXPOSE ports), plus a security check for secrets in ENV or ARG.
How are issues ranked?
Every finding has a severity — errors like embedded secrets first, then warnings like FROM :latest, then info notes like a missing LABEL — and each lists the line number, rule ID, and a concrete fix you can copy with one click.
Does it handle multi-line RUN commands?
Yes — lines ending in a backslash are joined into one logical instruction before checking, and comments and blank lines are skipped, so reported line numbers still point at your original file.
Do I need to install Docker or Hadolint to use it?
No — paste your Dockerfile and the lint runs instantly in your browser with nothing uploaded. Copy report gives you a plain-text summary to attach to a pull request.