Skills2026年4月16日·1 分钟阅读

Hadolint — Dockerfile Best Practice Linter

A smart Dockerfile linter that parses Dockerfiles into an AST and checks them against proven best-practice rules, integrating ShellCheck for RUN instruction analysis.

AI Open Source
AI Open Source · Community
Agent 就绪

先审查再安装

这个资产需要先审查。复制的指令会要求 Agent dry-run、列出写入项，确认后再继续。

Needs Confirmation · 64/100策略：需确认
Agent 入口
任意 MCP/CLI Agent
类型
Skill
安装
Single
信任
信任等级：Established
入口
Hadolint Dockerfile Linter
先审查命令
npx -y tokrepo@latest install f1376326-397d-11f1-9bc6-00163e2b0d79 --target codex

先 dry-run，确认写入项后再运行此命令。

TL;DR
Hadolint catches Dockerfile anti-patterns by parsing them into an AST and applying ShellCheck.
§01

What it is

Hadolint is a smart Dockerfile linter that parses Dockerfiles into an abstract syntax tree and validates them against proven best-practice rules. It integrates ShellCheck to analyze the shell commands inside RUN instructions, catching both Dockerfile structure issues and shell scripting mistakes in a single pass.

Hadolint is aimed at DevOps engineers, platform teams, and anyone building container images who wants to catch misconfigurations before they reach production. It runs as a standalone binary, a Docker container, or a CI check.

§02

Why it saves time or tokens

Dockerfile mistakes like missing --no-cache on apt-get, using latest tags, or running as root are easy to miss in review but expensive in production. Hadolint catches them automatically. When AI assistants generate Dockerfiles, running Hadolint on the output validates correctness without a human reading every line, reducing the iteration tokens needed to get a working image.

§03

How to use

  1. Install Hadolint: download the binary from GitHub releases, or run docker pull hadolint/hadolint
  2. Lint a Dockerfile: hadolint Dockerfile
  3. Integrate into CI by adding Hadolint as a step in your GitHub Actions, GitLab CI, or Jenkins pipeline
§04

Example

# Bad Dockerfile - Hadolint will flag these
FROM ubuntu:latest
RUN apt-get update && apt-get install -y python3
COPY . /app
RUN cd /app && pip install -r requirements.txt

Hadolint output:

DL3007: Using latest is prone to errors
DL3008: Pin versions in apt-get install
DL3003: Use WORKDIR to switch to a directory
DL3042: Avoid cache directory with pip install --no-cache-dir
RuleSeverityFix
DL3007WarningPin base image tag
DL3008WarningPin apt package versions
DL3003WarningUse WORKDIR not cd
DL3042WarningAdd --no-cache-dir to pip
§05

Related on TokRepo

§06

Common pitfalls

  • Hadolint rules can be overly strict for certain base images; use .hadolint.yaml to ignore rules that do not apply to your stack
  • ShellCheck integration only works for bash/sh; RUN instructions using other shells are not analyzed
  • Running Hadolint only locally without CI integration means team members who skip it will push unvalidated Dockerfiles

常见问题

How does Hadolint integrate with CI/CD pipelines?+

Hadolint runs as a single binary or Docker container that exits with a non-zero code when violations are found. Add it as a step in GitHub Actions, GitLab CI, or any pipeline that runs shell commands. Most teams use the official GitHub Action from the Hadolint repository for one-line integration.

Can Hadolint check shell scripts inside RUN instructions?+

Yes. Hadolint embeds ShellCheck internally. When it encounters a RUN instruction, it extracts the shell commands and passes them through ShellCheck analysis. This catches quoting errors, undefined variables, and POSIX compliance issues that a Dockerfile-only linter would miss.

How do I ignore specific Hadolint rules?+

Create a `.hadolint.yaml` file in your project root and list rules under the `ignored` key. You can also inline-ignore a specific rule with a comment `# hadolint ignore=DL3008` above the offending instruction. The config file also supports setting the trusted registries and overriding severity levels.

Does Hadolint support multi-stage Dockerfiles?+

Yes. Hadolint parses the entire Dockerfile including all stages. It validates each FROM instruction, checks that COPY --from references valid stages, and applies rules independently to each build stage. Multi-stage builds are fully supported without additional configuration.

What is the difference between Hadolint and Docker Scout?+

Hadolint is a static linter that checks Dockerfile syntax and best practices before you build. Docker Scout analyzes built images for known vulnerabilities in packages. They are complementary: Hadolint catches structural problems early, while Docker Scout catches CVEs in the resulting image layers.

引用来源 (3)
  • Hadolint GitHub— Hadolint parses Dockerfiles into an AST and integrates ShellCheck
  • ShellCheck GitHub— ShellCheck is a static analysis tool for shell scripts
  • Docker Docs— Dockerfile best practices for building images
TokRepo 相关
AI DevOps toolsSecurity toolsFeatured workflows

讨论

登录后参与讨论。
还没有评论，来写第一条吧。

相关资产

SQLFluff — Modular SQL Linter and Auto-Formatter

A configurable SQL linter and formatter supporting over 20 SQL dialects, designed to enforce style rules and catch errors in data pipelines.

Skills
AI Open Source

Thanos — Global Prometheus with Unlimited Retention and High Availability

Thanos extends Prometheus with global query, unlimited storage via object storage, and HA replication. It is the proven way to run Prometheus at multi-cluster, multi-year scale without changing your existing workflow.

Skills
AI Open Source

H3 — Hexagonal Hierarchical Geospatial Indexing System

A hierarchical geospatial indexing system using hexagonal cells, developed by Uber for spatial analysis at scale.

Skills
AI Open Source

Kepler.gl — Open Source Geospatial Data Visualization

A powerful open-source tool for large-scale geospatial data visualization built on deck.gl and Mapbox GL.

Skills
AI Open Source
◈首页🔍搜索👤我的