Hadolint

Hadolint is a free linter for Dockerfiles, best suited to developers and teams who want to catch build-file and embedded-shell issues in their local or CI workflow. Its narrow scope is an advantage for container work, but it will not replace language-specific analysis elsewhere in a project.

Overview

Hadolint parses Dockerfiles into an abstract syntax tree and applies its own rules alongside ShellCheck analysis for Bash inside RUN instructions. In practice, that pairing lets a single focused check cover both Dockerfile conventions and the shell commands used to build an image.

The project is open source under GPL-3.0, and its plan costs free. An online version is also linked from the project, alongside options for running Hadolint locally. The clear tradeoff is scope: teams looking for broad application-code analysis will need additional tools.

Key features

Rules carry either a DL prefix for Hadolint checks or an SC prefix for ShellCheck checks. Users can ignore rules, override severity, set failure thresholds, configure label schemas, and define trusted registries. These controls let teams adapt linting to their conventions and decide which findings should block a build, but they also leave the enforcement policy for each project to configure.

Reports can be produced as terminal output or in JSON, Checkstyle, Code Climate, GitLab Code Climate, GNU, Codacy, SonarQube, SARIF, and JUnit formats. That breadth is useful when a CI or reporting system expects a particular format; teams still need to choose and wire the output into their workflow.

Hadolint can run from Docker or Podman images published on Docker Hub and GitHub Container Registry. It is also offered as a pre-commit hook, including a Docker-based option. These routes make it possible to add checks at different points in development without requiring one installation approach.

Documented CI integrations include GitHub Actions, GitLab CI, Azure DevOps Pipelines, Bitbucket Pipelines, CircleCI, Drone CI, Jenkins, and Travis CI. Editor integrations cover VS Code, Atom, Emacs, Geany, Sublime Text, Vim, and NeoVim. The project offers prebuilt binaries for OSX, Windows, and Linux, and describes installation through Homebrew, Scoop, Nix, containers, or source builds.

Pricing

Hadolint is free, with a plan priced at free. The plan is an open-source Dockerfile linter under GPL-3.0, so it fits individual developers and teams that want linting without a subscription or trial decision. There is no free trial because the tool is free; no paid tier or per-seat pricing is part of this offer.

Platforms

Hadolint supports Linux, macOS, Windows, and web access through its online version. Prebuilt binaries cover OSX, Windows, and Linux, with additional installation paths through package managers, containers, or source builds. Editor integrations and CI options provide further ways to bring checks into a development workflow, though the linter itself remains focused on Dockerfiles.

Who it's for

Hadolint is the right fit for developers maintaining Dockerfiles who want consistent checks for both image instructions and Bash embedded in build commands. Teams can use its configurable severities and failure thresholds to make selected findings actionable in CI, while pre-commit and editor integrations support earlier feedback.

It is not the right primary choice for someone seeking a general code checker, or for projects whose main linting needs lie outside Dockerfiles and embedded shell. Its focus is useful precisely because it avoids trying to cover every language.

Pros and cons

• Dockerfile and embedded-shell checks together: AST-based Dockerfile rules and ShellCheck analysis cover two relevant layers of container builds in one tool.
• Flexible reporting and enforcement: Multiple report formats and configurable severities and thresholds can suit varied CI workflows.
• Several adoption paths: Binaries, package managers, containers, source builds, pre-commit, editor integrations, and documented CI integrations offer choices for fitting it into an existing process.
• Specialist scope: It checks Dockerfiles and shell within RUN instructions, so it cannot stand in for analysis of the rest of an application.
• Policy needs configuration: Teams must decide which rules to ignore, how to set severities, and what threshold should fail a build.

Alternatives

For other tools in this category, see Linters. Choose among these alternatives according to the language or workflow you need to check:

• SwiftLint is a free, open-source option for Swift linting; choose it when Swift code, rather than Dockerfiles, is the target.
• Biome is a free, open-source toolchain for web projects; it is the better fit when the project is web-focused.
• Cppcheck offers free core static analysis and a Project plan with custom pricing; consider it for static analysis needs outside Hadolint's Dockerfile scope.
• JSHint is a free tool with no paid plans stated; choose it when a project needs a different linting tool.
• PMD is a free downloadable static code analyzer under a BSD-style license; it is an option for general static analysis rather than Dockerfile-specific checks.
• Ruff is an open-source, permissively licensed tool from a maker focused on Python developer tools; it is the alternative to consider for Python projects.
• ShellCheck is free, open-source static analysis for shell scripts that can be used on the web, in a terminal, or in editors; pick it when shell scripts themselves are the focus rather than Dockerfiles.
• actionlint is a free, MIT-licensed static checker with a command-line tool and browser playground; consider it for its own checking workflow.

Verdict

Choose Hadolint if Dockerfiles are a regular part of your work and you want Dockerfile rules plus ShellCheck checks for embedded build commands, with no license fee and enough integration options to fit local and CI routines. Look elsewhere if you need one analyzer for application code across languages; Hadolint's strongest case is its focused coverage of container build definitions.