Dockerfile
0 linesAnalysis
—Paste your Dockerfile and click Analyze
Paste your Dockerfile and click Analyze
Dockerfile Analyzer parses and analyzes a Dockerfile for best practice violations, security issues, layer optimization opportunities, and common mistakes. Paste a Dockerfile to get a detailed report: instruction-by-instruction analysis, suggestions to reduce image size, security flags (running as root, ADD vs COPY, missing HEALTHCHECK), and layer count optimization tips to reduce build cache invalidation.
A Dockerfile defines how to build a Docker container image. Each instruction (FROM, RUN, COPY, ADD, ENV, ARG, EXPOSE, CMD, ENTRYPOINT, WORKDIR, USER, HEALTHCHECK) creates a layer in the image. Best practices minimize the number of layers, reduce image size, use specific base image tags (never latest), avoid running as root, use COPY instead of ADD for local files, and combine related RUN commands with && to reduce layers.
Security considerations: use a non-root USER instruction (USER 1000:1000). Avoid exposing secrets in ENV or ARG (use Docker secrets or build-kit secrets). Use specific pinned image tags (FROM ubuntu:22.04 not FROM ubuntu:latest). Scan images with docker scout or trivy. Multi-stage builds reduce attack surface by excluding build tools from the final image — the builder stage has compilers, the final stage has only the binary.
Detect missing non-root user
Result: No USER instruction → WARNING: Container runs as root. Add 'USER 1001:1001' before CMD
Spot using :latest tag
Result: FROM node:latest → WARNING: Pin to specific version: FROM node:20.15-alpine
Multiple RUN → single layer
Result: RUN apt-get update / RUN apt-get install / RUN apt-get clean → merge into one RUN
What is a Docker layer and why do they matter?
Each Dockerfile instruction creates a new read-only layer added to the image. Layers are cached — if a layer hasn't changed, Docker reuses the cached version. Layer order matters: put instructions that change frequently (COPY code, npm install with package.json changes) after instructions that change rarely (FROM, installing system packages). Place COPY for package.json before COPY for all source code to maximize cache hits on dependency installation.
What is the difference between CMD and ENTRYPOINT?
CMD provides default arguments to the container. ENTRYPOINT sets the command that always runs. Together: ENTRYPOINT ["node", "server.js"] with CMD ["--port", "3000"] means docker run myimage uses port 3000, but docker run myimage --port 8080 overrides to port 8080 — ENTRYPOINT stays, CMD is replaced. CMD alone: docker run myimage sh replaces the CMD entirely. Use ENTRYPOINT for the main process; CMD for default arguments.
What is a multi-stage build?
Multi-stage builds use multiple FROM instructions in one Dockerfile. The first stage (builder) compiles code and installs build tools. The final stage copies only the compiled output from the builder. This dramatically reduces image size: a Go binary builder image might be 1 GB, but the final image with just the binary is 10 MB (using FROM scratch or FROM alpine). Example: FROM golang:1.22 AS builder; RUN go build; FROM alpine; COPY --from=builder /app/binary /app/binary.
Why should I use COPY instead of ADD?
ADD has two extra features: it can extract tar archives automatically and fetch URLs. These implicit behaviors make builds unpredictable — ADD http://example.com/file downloads at build time (breaks offline builds, URL can change). For local files, always use COPY — it's explicit, predictable, and the Dockerfile linting tools will warn you about ADD for local files. Only use ADD when you specifically need tar extraction.
What is the principle of least privilege in Docker containers?
Containers should run with the minimum permissions needed. Avoid running as root (UID 0) — if an attacker escapes the container, they have root on the host. Best practices: USER 1001:1001 (non-root UID:GID), --read-only filesystem with tmpfs for writable paths, --cap-drop ALL --cap-add NET_BIND_SERVICE (for web servers that need port 80), no privileged mode unless absolutely necessary, and use seccomp profiles to limit system calls.