Dockerfile Linter & Size Analyzer

Analyze Dockerfiles for security risks, layer cache invalidation, and image size bloat

Dockerfile Presets

Load common container recipes and anti-pattern examples

Paste or edit your container definition

3 layers

Dockerfile Health Score

5 of 8 best-practice rules verified

56/100

Missing Non-Root USER

error

Container runs as root by default. Create and switch to a non-root user (e.g., USER node or USER 1001) to prevent privilege escalation.

Suggested Fix:

RUN addgroup -S appgroup && adduser -S appuser -G appgroup
USER appuser

Unpinned Base Image Tag

warning

Base image "node:latest" uses the :latest or untagged version. Pin to a specific version or SHA digest for reproducible builds.

Suggested Fix:

Pin to specific tag like "node:22-alpine"

Layer Cache Invalidation (COPY . . before lockfiles)

error

Copying the full workspace before installing dependencies breaks Docker caching on any code edit.

Suggested Fix:

COPY package.json package-lock.json ./ 
RUN npm ci
COPY . .

FROM node:latest
WORKDIR /app
COPY . .
RUN npm install
EXPOSE 3000
CMD ["npm", "start"]

# Best practice: run as non-root user
USER node