Run hadolint rules on a Dockerfile in your browser, with no install and no Docker
Runs in your browser. Nothing you type is sent anywhere. Checked against sources on 16 Oct 2026.hadolint is the usual Dockerfile linter in CI, but trying it means installing a binary or pulling its image. This page applies the same 55 DL rules in your browser, with the same codes and levels, so a finding here reads the same as in your pipeline. Inline "# hadolint ignore=DL3008" and "# hadolint global ignore" comments are honoured. ShellCheck's SC checks inside RUN lines are not included.
Paste your Dockerfile, or open it from your computer.
Read the DL codes and levels, which match hadolint 2.12.
Add "# hadolint ignore=CODE" above a line to silence one finding, as you would in CI.
A Dockerfile can build today and break next month: an unpinned base image moves, an apt-get install picks up a new version, a cache left in a layer makes the image hundreds of megabytes larger. A linter catches these before they ship. hadolint is the standard one in CI pipelines; this page applies its Dockerfile rules in your browser.
What it checks. Every finding names its line, its hadolint code, a level and a one-line fix. The rules fall into five groups:
How close it is to hadolint. The rules were written from hadolint 2.12's source, and the tests run the real hadolint binary's answers for more than 80 Dockerfiles: the same codes on the same lines, every time. Multi-stage builds, ONBUILD, continuation lines, the escape directive and inline # hadolint ignore= comments all behave as in hadolint. ShellCheck's SC warnings about the shell code inside RUN lines are not included.
The rest of the article, and all 6 questions about Dockerfile Linter, are on the Dockerfile Linter page.
DL3008 says an apt-get install line names packages without versions, so each build may install something different. Write package=version, such as curl=7.88.1-10+deb12u5, and find the current version with apt-cache policy curl inside the base image. Pinning makes the image reproducible; update the pins on purpose, not by accident.
Write a comment directly above the instruction: # hadolint ignore=DL3008, or several codes separated by commas. To switch a rule off for the whole file, write # hadolint global ignore=DL3059 anywhere. Both work in hadolint itself and on this page, and the summary counts what was switched off.
For the Dockerfile rules, yes: the 55 DL codes, their levels and their conditions follow hadolint 2.12, and the tests compare against the real hadolint binary on more than 80 files. Not included are ShellCheck's SC warnings about the shell code inside RUN lines, and the rules that need a configuration file, such as allowed registries.
Use COPY for files and folders. ADD also downloads URLs and unpacks local tar archives, which is useful when you want exactly that and surprising when you do not. hadolint flags ADD for a plain file as DL3020, and flags a COPY followed by tar -x of the same archive as DL3010, where ADD would do it in one step.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about Dockerfile Linter and anybody who knows can answer. No account needed.
On the related tools: Readability Checker – Flesch reading ease and grade level, with what to change · JSONPath Evaluator – Evaluate a JSONPath expression and get the matching values and their paths.