Dockerfile linter
Check a Dockerfile for invalid instructions, broken stage references and risky build habits such as unpinned base images, apt-get without -y and scripts piped straight into a shell.
Up to 500,000 characters. Everything runs on your device in a background worker. Downloads: JSON report, CSV findings and SARIF 2.1.0. Paste the Dockerfile text. Up to 500,000 characters. Review the settings before running.
Your result
How to use Dockerfile linter
- Paste the Dockerfile.
- Run the check.
- Review each finding with its line and rule.
- Download the JSON report, CSV or SARIF file.
Useful next steps
What is checked
The instruction table and rules are written by Happytails.ai from the Dockerfile reference and the Docker building best practices guide (docs.docker.com, read on 16 October 2026). Each instruction is checked for its name and argument count, then stages are tracked so COPY --from can be matched to an earlier stage name or index.
Build habits
The linter flags base images without a version tag, repeated CMD, ENTRYPOINT or HEALTHCHECK, shell form CMD and ENTRYPOINT, relative WORKDIR, apt-get install without -y or cleanup, sudo, curl or wget piped to a shell, ADD where COPY fits, secrets in ENV or ARG names, and containers that run as root. BuildKit heredocs such as RUN <<EOF are read as part of their instruction.
Limits
Shell commands inside RUN are matched as text, not run or parsed as a full shell script, so unusual quoting can hide a pattern. Base images are not pulled, so a USER set by the base image is not known.