Dockerfile Linter

This linter parses the Dockerfile the way Docker does — parser directives, comments, line continuations, heredocs, --flags and multi-stage builds — and then applies rules in the spirit of hadolint and Docker's own build checks. Errors (red) are things that break the build or the image: no FROM, an unknown instruction (often a missing backslash on the line above), an exec form that is not valid JSON such as CMD ['node', 'app.js'], an EXPOSE port above 65535, two stages with the same name, or COPY --from that points to a later stage.

Warnings concern reproducibility and security. A base image without a tag or with latest changes under you. apt-get update in its own RUN is cached, so a later install uses a stale index. apt-get install without -y waits for an answer that never comes. curl … | sh runs unverified code. A name such as DB_PASSWORD in ENV or ARG ends up in the image, readable with docker history. The shell form of CMD and ENTRYPOINT wraps the process in /bin/sh -c, so it does not receive the signal of docker stop. And a final stage without USER usually runs as root.

Notes (blue) are about image size and style: --no-install-recommends, removing /var/lib/apt/lists in the same layer, pip install --no-cache-dir, apk add --no-cache, npm ci instead of npm install, pipes without pipefail, instructions in lower case. Rules look inside RUN: the command line is split at &&, ; and |, so a finding points to the physical line of the command, not to the start of the instruction. The linter reads text only; it does not build the image or pull anything.