Dockerfile Linter

Frequently asked

Why should I avoid the :latest tag?

The :latest tag is mutable — it points to a different image every time the upstream maintainer pushes a new build. Using :latest means your image can change between builds without any change to your Dockerfile, breaking reproducibility. Pin to a specific version tag (e.g. nginx:1.27.0) or a digest (e.g. nginx@sha256:...) for reproducible builds.

Why should I add a USER instruction?

By default, Docker containers run as root. If an attacker exploits a vulnerability in your application, they have root access inside the container. Adding a non-root USER reduces the blast radius. Create a dedicated user in your Dockerfile: RUN addgroup -S app && adduser -S app -G app, then USER app.

Why use COPY instead of ADD?

ADD has two implicit behaviours that surprise readers: it can fetch URLs (downloading arbitrary content at build time) and it automatically extracts tar archives. COPY does exactly one thing: copy files from the build context. Use COPY for files and directories; use ADD only when you specifically need the archive extraction feature.

Why should I clean apt-get caches in the same RUN?

Docker layers are immutable. If you run apt-get install in one RUN and rm -rf /var/lib/apt/lists/* in a separate RUN, the cache files are still present in the first layer and contribute to the final image size. Combining them in a single RUN ensures the cache is never committed to any layer.

What is the exec form vs shell form for CMD and ENTRYPOINT?

Shell form (CMD echo hello) runs the command via /bin/sh -c, which means signals like SIGTERM are sent to the shell, not your process. This causes graceful shutdown to fail. Exec form (CMD ["echo", "hello"]) runs the command directly as PID 1, so signals are delivered correctly. Always use exec form for CMD and ENTRYPOINT.