CheatHadolint Dockerfile linter
Light · Postcard
102 × 152 mm · PDF
Dark · Postcard
102 × 152 mm · PDF
Ink saver · Postcard
102 × 152 mm · PDF
Light · A4 landscape
297 × 210 mm · PDF
Dark · A4 landscape
297 × 210 mm · PDF
Ink saver · A4 landscape
297 × 210 mm · PDF
Light · A3 landscape
420 × 297 mm · PDF
Dark · A3 landscape
420 × 297 mm · PDF
Ink saver · A3 landscape
420 × 297 mm · PDF
Start here
hadolint Dockerfile
Lint a Dockerfile
hadolint - < Dockerfile
Lint from stdin
--ignore DL3008Skip one rule
-t errorFail only on errors
-f jsonMachine-readable output
--trusted-registry <host>
Allow only this registry
.hadolint.yamlProject config file
# hadolint ignore=DL3006
Silence next line
Concepts
- Dockerfile file or stdin
- DL rules build best practices
- ShellCheck SC rules on shell
- Report tty, json, sarif, ...
- Exit code 0 or 1
Run it
hadolint <Dockerfile>
Lint a file
hadolint <Dockerfile> <Dockerfile2>
Lint several files
hadolint - < Dockerfile
Read the Dockerfile from stdin
docker run --rm -i hadolint/hadolint < Dockerfile
Run without installing
Also published as ghcr.io/hadolint/hadolint; tags
latest-alpine and latest-debian.
podman run --rm -i docker.io/hadolint/hadolint <
Dockerfile
Same via Podman
docker run --rm -i -v
"$PWD/.hadolint.yaml:/.config/hadolint.yaml"
hadolint/hadolint < Dockerfile
Use a config in the container
hadolint --version
Show the version
hadolint --helpList all options
hadolint -V <Dockerfile>
Verbose log to stderr
brew install hadolint
Install on macOS
scoop install hadolint
Install on Windows
Rules and severity
--ignore <RULE>
Ignore a rule (repeatable)
--error <RULE>
Raise a rule to error
--warning <RULE>
Set a rule to warning
--info <RULE>
Set a rule to info
--style <RULE>
Set a rule to style
--trusted-registry <host>
Only allow FROM images from this registry
Repeatable; violations are rule DL3026.
--require-label <label>:<type>
Require a label with a value type
Types: text, url, semver, hash, rfc3339, spdx, email.
--strict-labelsReject labels not in the schema
--disable-ignore-pragma
Ignore all inline ignore comments
Failure and output
-t <level> / --failure-threshold <level>
Exit non-zero from this severity up
Levels: error, warning, info, style, ignore, none. Default is
info. All findings are still printed.
--no-failAlways exit 0
-f <format>
Choose the output format
-f jsonJSON array of findings
-f sarifSARIF for code scanning
-f checkstyleCheckstyle XML
-f codeclimate / -f gitlab_codeclimate
Code Climate JSON
-f gnuGNU-style file:line: messages
-f sonarqube / -f junit / -f codacy
Other CI report formats
--no-colorPlain text output
--file-path-in-report <path>
Override the path shown in reports
Applies to checkstyle, codeclimate, sonarqube, junit and
gitlab_codeclimate.
Inline pragmas
# hadolint ignore=<RULE>
Ignore a rule for the next instruction
# hadolint ignore=<RULE1>,<RULE2>
Ignore several rules at once
# hadolint global ignore=<RULE>
Ignore a rule for the whole file
# hadolint shell=<shell>
Declare a non-POSIX shell
Example: powershell, so ShellCheck is not applied wrongly.
Config file
.hadolint.yamlProject config in the current directory
-c <file> / --config <file>
Use an explicit config file
ignored: [DL3008, DL3059]
List ignored rules
trustedRegistries: [docker.io]
Allowed FROM registries
failure-threshold: warning
Set the threshold
override: {error: [DL3010]}
Change rule severities
label-schema: {version: semver}
Required labels and types
format: jsonDefault output format
$XDG_CONFIG_HOME/hadolint.yaml
Per-user fallback location
Also ~/.config/hadolint.yaml and ~/.hadolint.yaml; the first
match is used, not merged.
HADOLINT_IGNORE=<RULES>
Ignore rules via environment
HADOLINT_NOFAIL=1
Never fail, via environment
Common rules
DL3006Tag the base image version
DL3007Do not use the latest tag
DL3008Pin apt-get package versions
DL3009Delete apt lists after installing
DL3015Add --no-install-recommends
DL3002Last USER should not be root
DL3003Use WORKDIR, not cd
DL3020Use COPY instead of ADD for files
DL3059Merge consecutive RUN instructions
DL4006Set pipefail before piping in RUN
SC2086Quote variables (ShellCheck)
Recipes
hadolint -t warning Dockerfile# .hadolint.yamlignored: - DL3008trustedRegistries: - docker.io - ghcr.iofailure-threshold: warningfind . -name 'Dockerfile*' -print0 \ | xargs -0 hadolint -f json > hadolint.json# hadolint ignore=DL3008RUN apt-get update && apt-get install -y curl
