Dockerfile Linter & Best-Practice Checker
Paste a Dockerfile and the checker flags unpinned base images, the latest tag, missing USER (root in prod), absent HEALTHCHECK, secret-leak patterns, multi-stage build opportunities, and layer-cache-hostile ordering — with the instruction line and a suggested fix. Paste your .dockerignore alongside it and the checker flags what the build context is still shipping. Filter by minimum severity when you only want what blocks a release. The Findings tab has per-rule detail; Stages shows the build stages. Runs in your browser; the Dockerfile is never uploaded.
Auto-lints as you type. Ctrl+Enter to re-run. The .dockerignore box is optional — supply it to see what a broad COPY . . would pull in.
How to use the Dockerfile Linter & Best-Practice Checker
Lint and review a Dockerfile against container build best practices before you commit. The checker flags unpinned base images, the latest tag, missing USER (root-runs-prod), absent HEALTHCHECK, secret-leak patterns, multi-stage build opportunities, layer-cache hostile ordering, and context-bloat risks. Useful for PR reviews, hardening legacy services, and onboarding to a new repo. Runs locally; the Dockerfile is never uploaded.
What it does
- Parses Dockerfile syntax line by line.
- Flags unpinned base images (
FROM node,FROM node:latest) and recommends digests or pinned tags. - Detects missing
USER— final image still runs as root. - Reports absent
HEALTHCHECK, especially important for long-running services. - Spots secret leaks:
ARG/ENVwith credentials,COPYof.env,RUNwith inline tokens. - Suggests multi-stage builds for build-toolchain-heavy images.
- Flags layer-cache hostile ordering (e.g.
COPY . .before installing deps). - Reports context-bloat risks (large
COPY, missing.dockerignorehints).
When to use it
- Quick review before opening a container-related PR.
- Audit an inherited Dockerfile for security and build risks.
- Hardening pass before a production cutover.
- Generate a checklist for a code review comment.
- Train new engineers on container best practices.
- Pre-flight check before pushing an image to a registry.
How to use it
- Paste the Dockerfile into the input.
- The lint report appears with severity (error / warning / info), instruction line, and suggested fix.
- Open the Findings tab for per-rule detail, or Stages for the build stages.
- Copy the findings summary into a PR comment or ticket.
- Pair with the Docker Compose Helper for compose files and the ENV Converter for env-var handling.
Tips & pitfalls
- Pin base images — use a digest (
FROM node@sha256:...) or a specific tag, notlatest. - Add a non-root
USER. Production should never run as root unless explicitly required. - Use multi-stage builds to keep build tools out of the final image — much smaller, fewer CVEs.
- Order layers from least-frequently-changing to most (deps before code) so the cache works.
- Never bake secrets into the image — pass them at runtime or use BuildKit secrets.
- Add a
.dockerignorewithnode_modules,.git, build artifacts to keep context small.
FAQ
- How do I lint a Dockerfile online? Paste the Dockerfile — the linter flags issues with severity and suggested fixes.
- What is the difference between this and hadolint? hadolint is a popular CLI linter; this tool covers similar best-practice rules in the browser without installing anything.
- Why is running as root bad? If the container is compromised, root inside the container is closer to root outside it — add a non-root
USER. - How do I pin a base image? Use a digest:
FROM node@sha256:abcd…. Tags can change; digests are immutable. - Is my Dockerfile uploaded? No. Linting runs entirely in your browser.
- Does this catch all vulnerabilities? No — it covers Dockerfile best practices. Scan the built image with Trivy, Snyk, or Grype for CVE coverage.
Runs locally in your browser. No uploads. Pair with an image scanner (Trivy, Snyk) for CVE coverage of the built image.