Paste a Dockerfile to catch common mistakes before you build — unpinned base images, running as root, cache-busting layer order, leaked secrets, and more. Nothing is ever uploaded.
Findings
How it works
The pasted Dockerfile is parsed line by line in your browser, tracking state like the last USER instruction and whether apt-get update and install landed in the same RUN layer, then matched against a set of regex-based checks for unpinned base images, root execution, ADD misuse, cache-busting COPY order, and credential-looking ENV/ARG/RUN values.
FAQ
Does this catch every Dockerfile mistake?
No — it runs a fixed set of pattern checks (unpinned base images, missing USER, ADD vs COPY, cache-busting COPY order, split apt-get layers, embedded secrets, exposed port 22) rather than a full static analysis. When no issues are found it says so explicitly and still recommends a manual review.
Why does it flag ENV or ARG lines that mention words like 'password' or 'token'?
Because ENV and ARG values get baked permanently into the image's layer history and stay visible via `docker inspect` or `docker history` even after the container is running. Matching common credential-related variable names is a heuristic for catching secrets before they're locked into the image.
Free, unlimited, no account. If this saved you a paid tool, a small thanks is appreciated.