dockle

dockle <image>

Audit the image with dockle, detecting Dockerfile bad practices (root user, credentials, ports, healthcheck).

Run it in the build pipeline when you want the image lint: dockle analyzes the image and reports findings — root user, credentials in layers, exposed ports, missing healthcheck, unnecessary packages — with the checks (CIS Docker). It is the linter of reference images (from GoodwithTech): the image configuration audited against best practices. In container DevSecOps, dockle complements the CVE scanner (029): the image configuration validated in the build.

Do not use it as vulnerability analysis: dockle covers configuration (lint) — image CVEs are covered with trivy/grype. Generic checks generate false positives (the legitimate context of the image): they are triaged and configured (the --ignore). And note: dockle analyzes the built image — the Dockerfile lint in the build (after build); for file lint (without build), hadolint (034). The dockle + hadolint combination covers the file and the image.