Lint a Dockerfile

Check a Dockerfile for common mistakes, from floating FROM tags to curl piped into sh, and get rule IDs, line numbers and severities in one report.

DockerfilelintText

Questions people ask

Which rules are checked?: Twelve, each with an ID: DF001 and DF002 for floating FROM tags and :latest, DF003 and DF004 for apt-get update without install and installs without --no-install-recommends, DF005 for the deprecated MAINTAINER, DF006 for remote ADD, DF007 and DF010 as file-wide checks for a missing USER and HEALTHCHECK, DF008 for sudo, DF009 for curl or wget piped into a shell, DF011 for raw archives under COPY, and DF000 for instruction words the builder does not run.
Is this a full hadolint replacement?: No, and the report says so. The rule set is deliberately small: it catches the common mistakes people actually ship, with bounded findings. It does not carry hadolint's several hundred rules, and hadolint itself is a Haskell binary that cannot run inside this tool's sandbox, which is part of why a focused set was chosen.
How are line continuations and heredocs handled?: As the Dockerfile format specifies. Backslash continuations are joined into one logical instruction, so a rule fires once for the whole instruction; heredoc blocks opened with <<DELIM are consumed until the delimiter line, so the body is never parsed as instructions and never produces spurious findings.
What do findings look like?: Every finding names a rule ID, a severity (error, warning or info), and the line where the instruction starts. The report opens with counts by severity and closes with its scope, so you know exactly which checks ran before deciding what to fix.
What happens to my files?: The upload is removed as soon as processing finishes; the report stays downloadable for about 10 minutes, then it is deleted automatically.

About this tool

A linter that keeps its promise checkable: a small, named rule set over the raw text of one Dockerfile, with findings carrying rule IDs, severities and first-instruction line numbers, and a scope line that says the checks are static, offline and deliberately smaller than hadolint's, which is a boundary rather than an apology. Technical details: the reader tokenises the file itself: comment lines are skipped, backslash continuations assemble one logical instruction, heredoc blocks opened with the Dockerfile 1.4 <<DELIM syntax are consumed until the delimiter so their bodies are never mistaken for instructions, and ONBUILD unpacks its inner instruction exactly once. Rules are matched on the assembled instruction, from FROM pinning (digest pins satisfy DF001) and apt-get hygiene to sudo, curl-piped-to-shell and raw archives under COPY. Unknown instruction words are reported as DF000 findings on their first line. Honest limits: no build is attempted, no image is pulled, no network call happens and no Dockerfile grammar is fully validated; anything after an unquoted hash on a line is treated as a comment, and syntax outside these checks is not judged. The listing caps at 200 findings, with anything beyond counted rather than hidden.

File limits

Exactly 1 file per job
Each at most 0 MB
Result at most 10 MiB

Supported formats

Text

Capabilities

Dockerfilelint

Privacy & processing

Your file is processed in an isolated job on Tooley's own infrastructure. No third-party services are involved and nothing is stored beyond the result window.

Uploads are removed as soon as processing finishes. Results stay available for about 10 minutes, then they are deleted automatically.