hadolint

hadolint Dockerfile

Analyze the Dockerfile with hadolint, detecting bad practices in the file (insecure instructions, layers, versions) before the build.

Run it in the pipeline (or locally) when you want to lint the Dockerfile before the build: hadolint analyzes the file and reports findings — insecure instructions (ADD from URLs, curl | bash, secrets in layers), version pinning, unnecessary layers, exposed ports — with checks (DL) and severity. It is the reference Dockerfile linter (from Hadolint/Hadley): static analysis of the file without building the image. In DevSecOps, hadolint is the first check in the container pipeline: the Dockerfile fixed before the build (and image scanning, 033).

Do not use it as image analysis: hadolint covers the file — the built image is covered by scanners (trivy, dockle). Generic checks generate false positives (legitimate context): they are triaged and configured (the .hadolint.yaml). And note: hadolint analyzes the static Dockerfile — it does not see the build result; the combination hadolint (file) + dockle (image) covers the cycle. Check severity is configured in the pipeline.