Dockerfile Linter

It checks for 15+ common issues including: using 'latest' tags (breaks reproducibility), missing HEALTHCHECK, not using multi-stage builds for compiled languages, running as root, missing .dockerignore, COPY before RUN (busts cache), ADD instead of COPY, and more.

Multi-stage builds use multiple FROM statements to separate build and runtime environments. Your final image only contains the runtime artifacts, not the build tools (compilers, npm, etc.), resulting in much smaller and more secure images.

Using 'latest' makes builds non-reproducible — the same Dockerfile can produce different images on different days. Pin to a specific version (e.g. node:20.11.1-alpine) to ensure consistency across environments.

HEALTHCHECK tells Docker how to test if the container is still working. Without it, Docker can't detect if your app crashes but the container keeps running. Kubernetes also uses health checks for pod management.

Prefer COPY for simple file copying — it's explicit and predictable. ADD has extra magic (auto-extracts tar files, can fetch URLs) that makes Dockerfiles harder to understand. Only use ADD when you need those specific features.