Hadolint

---

title: hadolint type: tool created: 2026-05-26 last_updated: 2026-05-26 related: ["radar/tools/ContainerStructureTest", "radar/techniques/ContinuousIntegration"] sources: ["https://github.com/hadolint/hadolint"] radar_quadrant: Tools radar_ring: Assess radar_position: inner

hadolint

A static linter for Dockerfiles that validates syntax, enforces best practices, and checks inline bash commands via shellcheck integration. Written in Haskell; distributed as a single static binary with no dependencies.

What It Catches

hadolint applies rules from the official Dockerfile best practices guide and community knowledge. Common violations it flags:

• Using ADD instead of COPY for local files
• Running apt-get install without --no-install-recommends
• Missing apt-get clean or cache cleanup after package installation
• Pinning package versions to avoid non-deterministic builds
• Using latest tag in FROM statements
• Running as root without explicitly setting a non-root user

The shellcheck integration parses multi-line RUN commands as shell scripts and applies shellcheck rules — catching unquoted variables, missing set -e, and other bash anti-patterns that a Dockerfile-only linter would miss.

CI Integration

Runs as a single command against a Dockerfile path:

hadolint Dockerfile

Exits non-zero on violations, making it a natural CI gate. Rules can be ignored inline or via a .hadolint.yaml config file for project-specific exceptions.

Radar Assessment

hadolint sits in the Assess ring of the Tools quadrant, at inner position. First studied via GitHub (2024-09-23). Dockerfile quality is rarely enforced systematically — teams rely on code review to catch anti-patterns. hadolint automates this as a pre-build CI step. The shellcheck integration makes it more valuable than a simple rule checker, catching shell bugs that would only surface at container runtime. Pairs with container-structure-test (see radar/tools/ContainerStructureTest) for full image quality coverage: hadolint before build, container-structure-test after. Remaining gate before Trial is adoption in an active CI pipeline with confirmed violation catches.