A Dockerfile that builds is not necessarily a good one. Running as root, pulling node:latest, and copying the whole source before installing dependencies all work today and cost you later. A checker turns the well-known best practices into a list you can clear in minutes.
What you'll learn
- Pin base images for reproducible builds
- Run as a non-root user and set a WORKDIR
- Order instructions so the layer cache works for you
Step by step
-
Paste the Dockerfile
Open the Dockerfile Checker and paste the file. Try an example loads a typical minimal Node Dockerfile.
-
Click Check
Findings are grouped by severity with the line they refer to.
FROM node:latest → WARNING pin a version, e.g. node:20-alpine ENV API_KEY=sk_live… → WARNING secret baked into an image layer (no USER) → WARNING container runs as root (no WORKDIR) → INFO set a working directory (no HEALTHCHECK) → INFO let orchestrators detect a dead app ADD ./src /app → INFO prefer COPY
-
Apply the fixes
Pin the tag, add a non-root USER near the end, set WORKDIR /app, copy package manifests and install before copying the rest of the source so dependency layers cache.
-
Rebuild and compare
Rebuild and check the image size and build time; correct layer order alone often halves rebuild time.
Common problems
Why does root matter inside a container?
A container escape or a vulnerable dependency gives an attacker root on the host namespace. A dedicated user limits the blast radius.
My builds are slow after any code change
COPY . . comes before the dependency install, so every change invalidates the install layer. The checker does not flag ordering; fix it by copying package manifests first, installing, then copying the rest of the source.
FAQ
Does it build or run the image?
No. It reads the instructions as text and applies static rules; it never contacts Docker or a registry.