Public | Automated Build

Last pushed: 7 months ago
Short Description
Dockerfile linter written in Haskell
Full Description

Haskell Dockerfile Linter )

<img align="right" alt="pipecat" width="150" src="" />

A smarter Dockerfile linter that helps you build best practice Docker images.
The linter is parsing the Dockerfile into an AST and performs rules on top of the AST.
It is standing on the shoulders of Shellcheck to lint the Bash
code inside RUN instructions.

:globe_with_meridians: Check the online version on

How to use

You can run hadolint locally to lint your Dockerfile.

hadolint <Dockerfile>
hadolint --ignore DL3003 --ignore DL3006 <Dockerfile> # exclude specific rules

Docker comes to the rescue to provide an easy way how to run hadolint on most platforms.
Just pipe your Dockerfile to docker run:

docker run --rm -i lukasmartinelli/hadolint < Dockerfile


You can download prebuilt binaries for OSX, Windows and Linux from the latest release page. However they may not run on your system configuration since I am not able to provide completely statically linked binaries. Fall back to brew, source installation or Docker if it doesn't work for you.

If you are on OSX you can use brew to install hadolint.

brew install hadolint

You can also build hadolint locally. You need Haskell and
the stack build tool to build the binary.

git clone
cd hadolint
stack build


Incomplete list of implemented rules. Click on the error code to get more detailed information.

  • Rules with the prefix DL originate from hadolint. Take a look into Rules.hs to find the implementation of the rules.
  • Rules with the SC prefix originate from ShellCheck (Only the most common rules are listed, there are dozens more)

Please create an issue if you have an idea for a good rule.

Rule Description
DL3000 Use absolute WORKDIR.
DL3001 For some bash commands it makes no sense running them in a Docker container like ssh, vim, shutdown, service, ps, free, top, kill, mount, ifconfig.
DL3002 Do not switch to root USER.
DL3003 Use WORKDIR to switch to a directory.
DL3004 Do not use sudo as it leads to unpredictable behavior. Use a tool like gosu to enforce root.
DL3005 Do not use apt-get upgrade or dist-upgrade.
DL3007 Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag.
DL3006 Always tag the version of an image explicitly.
DL3008 Pin versions in apt get install.
DL3009 Delete the apt-get lists after installing something.
DL3010 Use ADD for extracting archives into an image.
DL3011 Valid UNIX ports range from 0 to 65535.
DL3012 Provide an email address or URL as maintainer.
DL3013 Pin versions in pip.
DL3014 Use the -y switch.
DL3015 Avoid additional packages by specifying --no-install-recommends.
DL3016 Pin versions in npm.
DL3020 Use COPY instead of ADD for files and folders.
DL4000 Specify a maintainer of the Dockerfile.
DL4001 Either use Wget or Curl but not both.
DL4003 Multiple CMD instructions found.
DL4004 Multiple ENTRYPOINT instructions found.
DL4005 Use SHELL to change the default shell.
SC1000 $ is not used specially and should therefore be escaped.
SC1001 This \c will be a regular 'c' in this context.
SC1007 Remove space after = if trying to assign a value (or for empty string, use var='' ...).
SC1010 Use semicolon or linefeed before done (or quote to make it literal).
SC1018 This is a unicode non-breaking space. Delete it and retype as space.
SC1035 You need a space here
SC1045 It's not foo &; bar, just foo & bar.
SC1065 Trying to declare parameters? Don't. Use () and refer to params as $1, $2 etc.
SC1066 Don't use $ on the left side of assignments.
SC1068 Don't put spaces around the = in assignments.
SC1077 For command expansion, the tick should slant left (` vs ´).
SC1078 Did you forget to close this double quoted string?
SC1079 This is actually an end quote, but due to next char it looks suspect.
SC1081 Scripts are case sensitive. Use if, not If.
SC1083 This {/} is literal. Check expression (missing ;/\n?) or quote it.
SC1086 Don't use $ on the iterator name in for loops.
SC1087 Braces are required when expanding arrays, as in ${array[idx]}.
SC1095 You need a space or linefeed between the function name and body.
SC1097 Unexpected ==. For assignment, use =. For comparison, use [/[[.
SC1098 Quote/escape special characters when using eval, e.g. eval "a=(b)".
SC1099 You need a space before the #.
SC2002 Useless cat. Consider `cmd < file ..orcmd file ..` instead.
SC2015 Note that `A && B C` is not if-then-else. C may run when A is true.
SC2026 This word is outside of quotes. Did you intend to 'nest '"'single quotes'"' instead'?
SC2028 echo won't expand escape sequences. Consider printf.
SC2035 Use ./*glob* or -- *glob* so names with dashes won't become options.
SC2046 Quote this to prevent word splitting
SC2086 Double quote to prevent globbing and word splitting.
SC2140 Word is on the form "A"B"C" (B indicated). Did you mean "ABC" or "A\"B\"C"?
SC2154 var is referenced but not assigned.
SC2164 Use `cd ... exitin casecd` fails.


This is my first Haskell program. If you are an experienced Haskeller I would be really thankful
if you would tear my code apart in a review.


  1. Clone repository
     git clone --recursive
  2. Install the dependencies
     stack install


The easiest way to try out the parser is using the REPL.

# start the repl
stack repl
# parse instruction and look at AST representation
parseString "FROM debian:jessie"


Run unit tests.

stack test

Run integration tests.



The Dockerfile is parsed using Parsec and is using the lexer Lexer.hs and parser Parser.hs.


Dockerfile syntax is fully described in the Dockerfile reference. Just take a look at Syntax.hs to see the AST definition.


Docker Pull Command
Source Repository