Hadolint
GPL-3.0 AST Dockerfile linter + ShellCheck on RUN
DevOps / Security · GPL-3.0 · 12.5k
Reviewed 2026-09-14 · last push 2026-10-14 · repo checked 2026-10-19
What's Good
GPL-3.0. hadolint/hadolint. Parses Dockerfiles into an AST, applies DL#### rules, and runs ShellCheck on `RUN` shell. Online try-out at hadolint.github.io/hadolint; source github.com/hadolint/hadolint.
The Catch
GPL-3.0 copyleft — same class as ShellCheck; not MIT. Vs Docker (the engine), dive (*layer/size forensics*), and lazydocker (Docker/Compose *TUI*): Hadolint is the *Dockerfile linter*, not a runtime, not layer diffs, not a container dashboard.
Verdict
GPL-3.0 Dockerfile linter. Free forever; lint the recipe, dive the layers, lazydocker the running boxes.
Embed
Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.
Markdown
[](https://stackgems.com/gems/hadolint)
HTML
<a href="https://stackgems.com/gems/hadolint"><img src="https://stackgems.com/badge/hadolint.svg" alt="Hadolint reviewed on Stack Gems" height="20"></a>
Related
DevOps →- TrivyApache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier
- CosignApache-2.0 Sigstore keyless container/artifact signing CLI
- GitleaksMIT secret scanner for git/dirs/stdin; CLI free, org Action needs free key
- GrypeApache-2.0 SBOM-first vulnerability scanner from Anchore; free CLI
- AnubisMIT PoW challenge layer vs AI scrapers in front of Caddy/Traefik