# dockerfilelint > A linter for Dockerfiles to find bugs and encourage best practices Latest version **1.8.0** (published 2020-08-10) · MIT license · 0 weekly downloads ## Install ```sh npm install dockerfilelint pnpm add dockerfilelint yarn add dockerfilelint bun add dockerfilelint ``` Provides the command `dockerfilelint`. ## Health **Score 25/100 (F)** — status: abandoned. Positive: has types; no vulnerabilities; high quality score. Warnings: low downloads; no esm support. Negative: abandoned; low maintenance score. ## Facts | | | |---|---| | Version | 1.8.0 | | Published | 2020-08-10 | | First published | 2016-02-06 | | Weekly downloads | 0 | | License | MIT | | TypeScript types | bundled | | Module format | CommonJS | | Dependencies | 5 | | Unpacked size | 225.2 KB | | Known vulnerabilities | 0 | | Install scripts | no | | GitHub stars | 1034 | | Author | Marc Campbell | | Maintainers | emosbaugh, marccampbell, nexdrew | | Keywords | dockerfile, lint, linter | ## Links - npm: https://www.npmjs.com/package/dockerfilelint - Repository: https://github.com/replicatedhq/dockerfilelint - Homepage: https://github.com/replicatedhq/dockerfilelint#readme - Issues: https://github.com/replicatedhq/dockerfilelint/issues - npm.io page: https://npm.io/package/dockerfilelint ## Dependencies (5) - [chalk](https://npm.io/package/chalk.md) ^2.4.2 - [cliui](https://npm.io/package/cliui.md) ^4.1.0 - [yargs](https://npm.io/package/yargs.md) ^13.2.1 - [lodash](https://npm.io/package/lodash.md) ^4.3.0 - [js-yaml](https://npm.io/package/js-yaml.md) ^3.6.0 ## Alternatives - [eslint-plugin-sonarjs](https://npm.io/package/eslint-plugin-sonarjs.md) — 2.9M weekly downloads - [eslint-config-expo](https://npm.io/package/eslint-config-expo.md) — 1.5M weekly downloads - [@matter/protocol](https://npm.io/package/@matter/protocol.md) — 63.5K weekly downloads - [@eventcatalog/linter](https://npm.io/package/@eventcatalog/linter.md) — 24.8K weekly downloads - [@inrupt/eslint-config-base](https://npm.io/package/@inrupt/eslint-config-base.md) — 4.5K weekly downloads ## Recent versions - 1.8.0 (latest) — 2020-08-10 - 1.7.0 — 2020-08-10 - 1.5.0 — 2019-02-04 - 1.4.0 — 2017-09-13 - 1.3.0 — 2017-09-12 - 1.2.0 — 2017-07-03 - 1.1.3 — 2017-01-31 - 1.1.2 — 2016-06-18 - 1.1.1 — 2016-04-27 - 1.0.0 — 2016-03-03 - 0.0.9 — 2016-02-12 - 0.0.8 — 2016-02-11 - 0.0.7 — 2016-02-11 - 0.0.6 — 2016-02-11 - 0.0.5 — 2016-02-10 - … 4 more at https://npm.io/package/dockerfilelint/versions ## README # Linter and validator for Dockerfile [![Coverage Status](https://coveralls.io/repos/github/replicatedhq/dockerfilelint/badge.svg?branch=master)](https://coveralls.io/github/replicatedhq/dockerfilelint?branch=master) [![Build Status](https://travis-ci.org/replicatedhq/dockerfilelint.svg?branch=master)](https://travis-ci.org/replicatedhq/dockerfilelint) `dockerfilelint` is an node module that analyzes a Dockerfile and looks for common traps, mistakes and helps enforce best practices. ## Installation Global installation with npm package manager. ```shell npm install -g dockerfilelint ``` ## Testing Start unit tests with `npm test`, `yarn run test`, or `docker-compose -f docker-compose.test.yml up` ## Running #### From the command line: ```shell ./bin/dockerfilelint ``` #### Command Line options ```shell Usage: dockerfilelint [files | content..] [options] Options: -o, --output Specify the format to use for output of linting results. Valid values are `json` or `cli` (default). [string] -j, --json Output linting results as JSON, equivalent to `-o json`. [boolean] -v, --version Show version number [boolean] -h, --help Show help [boolean] Examples: dockerfilelint Dockerfile Lint a Dockerfile in the current working directory dockerfilelint test/example/* -j Lint all files in the test/example directory and output results in JSON dockerfilelint 'FROM latest' Lint the contents given as a string on the command line dockerfilelint < Dockerfile Lint the contents of Dockerfile via stdin ``` #### Configuring You can configure the linter by creating a `.dockerfilelintrc` with the following syntax: ```yaml rules: uppercase_commands: off ``` The keys for the rules can be any file in the /lib/reference.js file. At this time, it's only possible to disable rules. They are all enabled by default. The following rules are supported: ``` required_params uppercase_commands from_first invalid_line sudo_usage apt-get_missing_param apt-get_recommends apt-get-upgrade apt-get-dist-upgrade apt-get-update_require_install apkadd-missing_nocache_or_updaterm apkadd-missing-virtual invalid_port invalid_command expose_host_port label_invalid missing_tag latest_tag extra_args missing_args add_src_invalid add_dest_invalid invalid_workdir invalid_format apt-get_missing_rm deprecated_in_1.13 ``` #### From a Docker container (Replace the ``pwd``/Dockerfile with the path to your local Dockerfile) ```shell docker run -v `pwd`/Dockerfile:/Dockerfile replicated/dockerfilelint /Dockerfile ``` #### Online If you don't want to install this locally you can try it out on [https://fromlatest.io](https://www.fromlatest.io/#/). ## Checks performed ### `FROM` - [x] This should be the first command in the Dockerfile - [x] Base image should specify a tag - [x] Base image should not use latest tag - [x] Support `FROM scratch` without a tag - [x] Support the `FROM @` syntax - [ ] Allow config to specify "allowed" base layers ### `MAINTAINER` - [x] Should be followed by exactly 1 parameter (@ sign) ### `RUN` - [x] sudo is not included in the command - [x] apt-get [install | upgrade | remove] should include a -y flag - [x] apt-get install commands should include a `--no-install-recommends` flag - [x] apt-get install commands should be paired with a `rm -rf /var/lib/apt/lists/*` in the same layer - [x] Avoid running `apt-get upgrade` or `apt-get dist-upgrade` - [x] Never run `apt-get update` without `apt-get install` on the same line - [x] apk add commands should include a `--no-cache` flag or be paired with an `--update` flag with `rm -rf /var/cache/apk/*` in the same layer - [x] apk add support for --virtual flag - [ ] handle best practices for yum operations and cleanup ### `CMD` - [x] Only a single `CMD` layer is allowed - [ ] Better handling of escaped quotes - [ ] Detect exec format with expected variable substitution ### `LABEL` - [x] Format should be key=value ### `EXPOSE` - [x] Only the container port should be listed - [ ] All ports should be exposed in a single cache layer (line) - [ ] The same port number should not be exposed multiple times - [x] Exposed ports should be numeric and in the accepted range ### `ENV` - [x] Format of `ENV` - [ ] Best practice of only using a single `ENV` line to reduce cache layer count ### `ADD` - [x] Command should have at least 2 parameters - [x] Source command(s) cannot be absolute or relative paths that exist outside of the current build context - [x] Commands with wildcards or multiple sources require that destination is a directory, not a file - [ ] If an `ADD` command could be a `COPY`, then `COPY` is preferred - [ ] Using `ADD` to fetch remote files is discouraged because they cannot be removed from the layer ### `COPY` - [ ] Implement checking (similar to ADD) - [ ] Do not `COPY` multiple files on a single command to best use cache ### `ENTRYPOINT` - [ ] Support ### `VOLUME` - [ ] Format - [ ] Any build steps after VOLUME is declare should not change VOLUME contents - [ ] If JSON format, double quotes are required ### `USER` - [x] Should be followed by exactly 1 parameter ### `WORKDIR` - [x] Validate that it has exactly 1 parameter - [x] `WORKDIR` can only expand variables previously set in `ENV` commands ### `ARG` - [ ] Support - [ ] Prevent redefining the built in ARGs (proxy) ### `ONBUILD` - [ ] Support ### `STOPSIGNAL` - [ ] Validate input - [ ] Only present one time ### `HEALTHCHECK` - [x] No additional parameters when only parameter is `NONE` - [x] Options before `CMD` are valid - [x] Options before `CMD` have additional arguments ### Misc - [x] Only valid Dockerfile commands are present - [x] All commands should have at least 1 parameter - [x] Check that commands are written as upper case commands --- _Source: https://npm.io/package/dockerfilelint · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._