Lint a Dockerfile before building
Paste a Dockerfile and get best-practice warnings — unpinned base tags, running as root, poor layer ordering — before you spend minutes on a build that you will redo anyway.
Open the tool, then paste the sample input below. Everything runs locally in your browser.
The problem
Dockerfile mistakes are slow to find because each build takes minutes: an unpinned base image breaks reproducibility, running as root is a security risk, and bad layer order busts the cache on every build. Linting first surfaces these before you build.
Sample input
FROM node:latest
COPY . .
RUN npm install
CMD ["node", "server.js"]Expected output
- Base image uses :latest - pin a specific version (e.g. node:20.11)
- COPY . . before npm install busts the dependency cache on every change
- No USER instruction - container runs as rootCopy only package files before installing, pin the base tag, and add a non-root USER — the three highest-impact fixes here.
How to do it
- Paste your Dockerfile.
- Run the best-practice checks.
- Review each warning and its rationale.
- Fix tag pinning, layer order, and the USER instruction.
- Re-check before you build.
Common mistakes
- Using the :latest tag instead of pinning a version.
- Copying the whole context before installing dependencies, busting the cache.
- Running the container as root with no USER instruction.
- Installing build tools and leaving them in the final image.
- One RUN per command, creating many unnecessary layers.
Related tools
Related guides
FAQ
Why should I not use the latest tag?
The latest tag floats, so a rebuild can pull a different image and break reproducibility. Pin a specific version such as node:20.11 so builds are deterministic.
Why does COPY before npm install slow down builds?
Copying the whole context before installing invalidates the dependency layer whenever any file changes. Copy only the package files first, install, then copy the rest.
Should a container run as root?
No. Add a USER instruction to run as a non-root user, which limits the impact if the container is compromised.
Does linting build the image?
No. Linting only reads the Dockerfile text and reports best-practice issues. It does not run Docker or build anything.
Is my Dockerfile uploaded?
No. The checks run locally in your browser. Your Dockerfile is not sent to a server.
Dockerfile linting runs locally in your browser. Nothing is uploaded.
Lint Dockerfiles, build Kubernetes and Compose manifests, validate YAML — plus every other utility.