Free Online Dockerfile Linter

About the Dockerfile Linter

A Dockerfile is a short build script with a long reach: every layer it creates ships to every environment that pulls the image. Small mistakes such as an unpinned base image, a missing user, or a forgotten package-list cleanup can increase image size, slow builds, or create a security problem that persists for months. This linter applies a set of static rules to a pasted Dockerfile and explains each finding with a line number and a severity so you can fix the important issues first.

The parser joins backslash continuations, ignores comment-only lines, and records the first line of each instruction. The first build instruction must be FROM, because a Dockerfile without a base image cannot produce a stage. ARG before FROM is tolerated with a note, since it is a common pattern for selecting a base version. The linter flags images without a tag and images using latest, but accepts digest pins because they are reproducible. Multi-stage builds are recognized and reported as a good practice rather than treated as duplicate base instructions.

Runtime safety checks look for a missing USER instruction and for USER root or USER 0, both of which leave the container running as root. It also reports multiple CMD or ENTRYPOINT instructions, a missing WORKDIR, the deprecated MAINTAINER instruction, exposed SSH ports, and commands that pipe a remote download directly into a shell. Secret detection looks at ENV and ARG lines for names such as password, token, secret, or API key with a non-empty literal value. Secrets should be passed as build secrets or runtime environment variables instead of being baked into layers.

Package-management checks focus on Debian and Ubuntu images. The linter warns when apt-get install does not remove /var/lib/apt/lists in the same layer, when apt-get update is split across layers, and when install runs without -y. It suggests COPY instead of ADD unless the source is a URL or an archive, and notes that COPY . . benefits from a .dockerignore file. These rules are heuristics, not a complete security audit. Some findings are intentional in certain images, so review each message in context.

How to use this tool

1. Paste a Dockerfile into the editor.
2. Click Lint Dockerfile.
3. Fix errors first, then review warnings and informational notes.
4. Copy or download the report for a pull request review.

Frequently asked questions