Docker Tip #89: Lint your Dockerfile with Hadolint
This can help you build images that stick to best practices and save time by detecting errors before you build your images.
If you prefer video, I recorded a demo video going over what’s written below.
Hadolint detects around 100 issues. These range from style choices to errors.
I recently added it to all of my Docker Compose example web
app
repos and it found a few things like forgetting to use the CMD array
syntax
in 1 spot, using _ in a label key instead of - (underscores are illegal
characters as label keys) and forgetting to set -o pipefail in a RUN
instruction when using Unix pipes.
What’s neat is it’s packaged into a Docker image so you don’t need to install
anything locally to run it, although you can brew install it as well as find
it in other package managers.
Here’s how I’ve been running it as a Docker container:
docker container run --rm -i hadolint/hadolint hadolint --ignore DL3008 - < Dockerfile
In this case it’ll lint a Dockerfile in the directory where you run the
command.
Rule DL3008 is related to version pinning all of your apt package versions in
your Dockerfile. Personally I don’t think that’s worth it since your distro
will lock those versions and ideally you would want security patches to be
updated as you re-build your images periodically. A full list of rules can be
found in hadolint’s
documentation.
If you’re curious, it uses ShellCheck to lint
your RUN instructions which is fantastic.
If you find yourself wanting to customize hadolint a bit it does support the idea of a config file which you can volume mount into hadolint’s container when you run it. I haven’t used this since the default settings are solid minus that one rule I ignored.
I have hadolint running in
CI
to help detect issues automatically. This is one case where I like avoiding a
specific image version and use latest because as hadolint gets updated, it
may add new rules. I like this because I re-build my images on a schedule and I
want CI to break if my images aren’t sticking to current best practices.
If you want CI to stick to using the same Dockerized version of hadolint you can always use a specific version. A list of tags are available on the Docker Hub.