Loading tool…
About the Dockerfile Checker
Paste a Dockerfile to catch common issues before you build: a base image pinned to latest, no USER instruction (so the container runs as root), missing WORKDIR, and a few other image-hygiene checks. This is a static text check — it doesn’t build the image or verify instructions actually succeed.
How to use the Dockerfile Checker
- Paste your Dockerfile.
- Click Check.
- Results are grouped into ERROR, WARNING, and INFO.
- Fix and re-check as needed — nothing is sent to a server.
Step-by-step walkthrough with examples and the errors people hit: Dockerfile Best Practices Checklist.
Example
Common warning
FROM node:latest→
WARNING: base image uses the "latest" tag — pin a version for reproducible builds
Common errors and how to fix them
Why does root matter inside a container?
A container escape or a vulnerable dependency gives an attacker root on the host namespace. A dedicated user limits the blast radius.
My builds are slow after any code change
COPY . . comes before the dependency install, so every change invalidates the install layer. The checker does not flag ordering; fix it by copying package manifests first, installing, then copying the rest of the source.
More problems and fixes in the tutorial
FAQ
Does this build or run the Dockerfile?
No — it only reads the instructions as text and checks for common mistakes. It doesn’t contact Docker or a registry.
Why does it warn about missing USER?
Without a USER instruction, a container runs as root by default, which is unnecessary privilege for most applications and a real risk if the container is ever compromised.
Is my Dockerfile uploaded anywhere?
No, checks run entirely in your browser.