Hadolint

Hadolint is a free, open-source linter for developers who want focused checks on Dockerfiles and the shell commands inside them. It is a strong fit for container-build workflows, but not for teams looking for analysis across an application’s programming languages.

Overview

Hadolint parses Dockerfiles into an abstract syntax tree and applies its own DL-prefixed rules. It also uses ShellCheck to check Bash inside RUN instructions, so a single tool can flag both Dockerfile issues and problems in embedded shell. That combination is useful when container definitions are part of the code a team reviews; its deliberately narrow scope means other code still needs its own analyzers.

The project is free under the GPL-3.0 license, with a published free plan at no cost. It also has an online version, alongside options for local use and integration into development workflows.

Key features

Users can ignore rules, override their severity, set failure thresholds, and configure label schemas and trusted registries. These controls let teams adapt checks to their policies and decide which findings should block a build. The tradeoff is that teams need to choose and maintain those settings rather than rely on a single fixed enforcement policy.

Output options include terminal display and formats such as JSON, Checkstyle, Code Climate, GitLab Code Climate, GNU, Codacy, SonarQube, SARIF, and JUnit. The range suits teams that need to feed findings into different reporting workflows, while still requiring them to choose an appropriate format and connect it to their process.

Hadolint can run in Docker or Podman containers, with images published on Docker Hub and GitHub Container Registry. Prebuilt binaries are offered for OSX, Windows, and Linux; installation is also described through Homebrew, Scoop, Nix, containers, or source builds. The project documents CI integrations for GitHub Actions, GitLab CI, Azure DevOps Pipelines, Bitbucket Pipelines, CircleCI, Drone CI, Jenkins, and Travis CI. Editor integrations include VS Code, Atom, Emacs, Geany, Sublime Text, Vim, and NeoVim, and a pre-commit hook is available, including a Docker-based option. This breadth makes it easier to fit Hadolint into an existing workflow, though it does not expand what the linter analyzes.

Pricing

Hadolint has one free plan, priced at $0, and no free trial. The plan is an open-source Dockerfile linter under GPL-3.0; there are no paid tiers described, so there is no higher plan with additional capabilities or a different usage allowance to weigh. It suits individual developers and teams who want Dockerfile linting without a software charge and are comfortable with the project’s open-source license.

Platforms

Hadolint is listed for Linux, macOS, web, and Windows. Its documented installation routes include prebuilt binaries for OSX, Windows, and Linux, package managers, containers, and source builds; its README also links to an online version. That mix accommodates both local development and browser access, while container and CI options support automated checks.

Who it's for

Hadolint is best for developers and teams maintaining Dockerfiles who want repeatable checks in an editor, pre-commit hook, or CI pipeline. Its embedded Bash analysis is especially useful when shell commands in RUN instructions are an important part of the build. It is not the right standalone choice for broad code-quality coverage: projects need additional tools for languages and files outside its Dockerfile-and-Bash remit.

Pros and cons

• Pro: Combines Dockerfile rules with ShellCheck analysis of Bash in RUN instructions, covering two relevant parts of a container build in one linter.
• Pro: Offers configurable rule handling and numerous report formats, letting teams tune enforcement and fit findings into existing reporting flows.
• Pro: Has documented integrations across major CI systems, editors, and pre-commit, with a free, open-source plan.
• Con: Its scope is limited to Dockerfiles and Bash inside RUN instructions, so it cannot replace analyzers for application code.
• Con: The many configuration controls require teams to settle on their own rule and failure policies.

Alternatives

For other tools in this category, browse Linters. Choose actionlint instead for a free, MIT-licensed static checker with a command-line tool and browser playground. Biome is a free, open-source toolchain for web projects, so it fits a different focus than Hadolint’s container-build checks.

Cppcheck is worth considering for core static analysis functionality, with a free-to-download Open-source plan and a Project plan with custom pricing. JSHint is another free option for readers looking for a publicly available tool with no paid plans stated. For a downloadable static code analyzer under a BSD-style license, consider PMD.

Ruff is the alternative to consider for a tool in the Python ecosystem; its maker says its developer tools are open source and permissively licensed. Choose ShellCheck instead when the priority is static analysis for shell scripts across web, terminal, and editor use, rather than Dockerfile linting. SwiftLint is a free, MIT-licensed option for Swift linting.

Verdict

Choose Hadolint if Dockerfiles are a regular part of your build workflow and you want configurable checks that cover embedded Bash as well as Dockerfile rules, at no software cost. Its editor, pre-commit, container, and CI integrations make it a practical specialist. Look elsewhere—or pair it with other analyzers—if your priority is code-quality coverage beyond Dockerfiles and their RUN commands.