timothyswan/hadolint repository overview

hadolint⁠ is a Dockerfile linter that parses Dockerfiles into an AST and applies a set of best-practice rules. It catches issues like missing image tags, unpinned package versions, and apt-get / yum hygiene problems before they reach production.

This image rebases the upstream static Linux binary onto hi/core-runtime (Red Hat Hardened Image). The binary is SHA256-verified at fetch time; the built image is cosign-signed with a CycloneDX SBOM and SLSA Level 3 provenance attestation attached.

⁠Usage

# Lint a Dockerfile
podman run --rm -v "$(pwd):/work:ro,Z" hadolint:<version>-rhhi /work/Dockerfile

# JSON output for machine parsing
podman run --rm -v "$(pwd):/work:ro,Z" hadolint:<version>-rhhi --format json /work/Dockerfile

# Ignore specific rules
podman run --rm -v "$(pwd):/work:ro,Z" hadolint:<version>-rhhi --ignore DL3008 /work/Dockerfile

⁠Supply chain

• Base image: registry.access.redhat.com/hi/core-runtime (Red Hat Hardened)
• Binary: upstream static release, SHA256-verified
• Tier: 2 (prebuilt binary)
• Signed: cosign key-only signature (no Rekor transparency log)
• SBOM: CycloneDX JSON attached as OCI attestation
• Provenance: SLSA Level 3 attached as OCI attestation