> ## Documentation Index > Fetch the complete documentation index at: https://docs.iotools.cloud/llms.txt > Use this file to discover all available pages before exploring further. # Dockerfile Linter > Lint a Dockerfile against 18 Hadolint-style best-practice rules (unpinned base images, running as root, secrets in ENV, layer bloat, and more) and auto-format it — combining RUN layers and sorting package lists. Runs entirely in your browser. [Try Dockerfile Linter in your browser →](https://iotools.cloud/tool/dockerfile-linter/) ## OpenAPI ````yaml https://api.iotools.cloud/v1/openapi post /v1/tool/dockerfile-linter openapi: 3.1.0 info: title: iotools.cloud API version: 1.0.0 description: >- Run any iotools.cloud tool over HTTP. Authenticate with `Authorization: Bearer iot_live_…`. **Only `POST /v1/tool/{slug}` costs credits.** Every GET here — the catalog, a tool's schema, your balance — is free. A tool call is charged its own weight or your plan's per-call minimum, whichever is larger; `x-iotools-credit-cost` on each operation is quoted at the free-tier minimum, and `GET /v1/tools/list` returns the exact figure for your key. `GET /v1/me/credits` reports what you have left, and `GET /v1/me/usage` reports what it went on. Failures are RFC 9457 problem documents — branch on `code`. servers: - url: https://api.iotools.cloud description: Production security: - bearerAuth: [] tags: - name: Catalog description: Find a tool and read its contract. Free. - name: Converters description: >- Convert between formats, encodings, and units — Base64, CSV and JSON, timestamps, and more. Fast, free, and processed right in your browser. - name: Formatters description: >- Format, beautify, minify, and validate code and data — JSON, HTML, CSS, SQL, and regex. Clean up messy input in one click, with nothing to upload. - name: Generators description: >- Generate exactly what you need and on demand — passwords, UUIDs, QR codes, hashes, random numbers, and more. Secure, instant, and free. - name: Calculators description: >- Crunch the numbers fast — from everyday math to specialized conversions and unit work. Free online calculators that run entirely in your browser. - name: Editors description: >- Edit and transform text, code, and images with quick, focused editors that run entirely in your browser — nothing to install, and no sign-up needed. - name: Utilities description: >- Everyday developer and web utilities — DNS and IP lookups, redirect and certificate checkers, and other quick diagnostics. Free and privacy-friendly. - name: Account description: Your key's allowance, limits and usage history. paths: /v1/tool/dockerfile-linter: post: tags: - Utilities summary: Dockerfile Linter description: >- Lint a Dockerfile against 18 Hadolint-style best-practice rules (unpinned base images, running as root, secrets in ENV, layer bloat, and more) and auto-format it — combining RUN layers and sorting package lists. Runs entirely in your browser. [Try Dockerfile Linter in your browser →](https://iotools.cloud/tool/dockerfile-linter/) operationId: run_dockerfile_linter requestBody: required: false content: application/json: schema: type: object properties: dockerfile: type: string description: Dockerfile required: [] examples: problematic_dockerfile: summary: Problematic Dockerfile value: dockerfile: |- FROM ubuntu:latest MAINTAINER john@example.com RUN apt-get update RUN apt-get install -y curl wget git RUN cd /app && npm install ADD ./config.txt /app/config.txt ENV DB_PASSWORD=mysecretpass123 ENV API_KEY=sk-1234567890abcdef EXPOSE 8080 EXPOSE 99999 COPY . /app RUN chmod +x /app/start.sh CMD node server.js clean_dockerfile_no_issues: summary: Clean Dockerfile (no issues) value: dockerfile: >- FROM node:20-alpine WORKDIR /app COPY package.json ./ RUN npm ci COPY . . USER node HEALTHCHECK CMD wget -q -O /dev/null http://localhost:3000/ || exit 1 CMD ["node", "server.js"] responses: '200': description: Tool output content: application/json: examples: problematic_dockerfile: summary: Problematic Dockerfile value: tool: dockerfile-linter tool_version: 1.0.1 outputs: summary: - severity: Errors count: '1' - severity: Warnings count: '9' - severity: Info count: '3' - severity: Total count: '13' issues: - line: '1' severity: Warning rule: DL3007 message: Using the :latest tag is not recommended explanation: >- Pin to a specific version for reproducible builds (e.g., node:18-alpine instead of node:latest). - line: '3' severity: Warning rule: DL4000 message: >- MAINTAINER is deprecated — use LABEL maintainer="..." explanation: >- The MAINTAINER instruction is deprecated. Use LABEL maintainer="name" instead. - line: '5' severity: Warning rule: DL3059 message: 3 consecutive RUN instructions — consider combining explanation: >- Each RUN creates a new layer. Combine with && \ to reduce layers and image size. - line: '6' severity: Warning rule: DL3009 message: Delete the apt-get lists after installing packages explanation: >- Run "rm -rf /var/lib/apt/lists/*" after apt-get install to reduce image size. - line: '6' severity: Info rule: DL3015 message: Use --no-install-recommends with apt-get install explanation: >- Avoids installing unnecessary recommended packages, reducing image size. - line: '7' severity: Warning rule: DL3003 message: >- Use WORKDIR to switch directories instead of cd in RUN explanation: >- Using cd in RUN does not persist across instructions. Use WORKDIR instead. - line: '9' severity: Warning rule: DL3020 message: Use COPY instead of ADD for files and folders explanation: >- ADD has extra features (auto-extraction, URLs) that make it less predictable. Use COPY unless you need ADD features. - line: '11' severity: Warning rule: DL3060 message: Possible secret or credential in ENV explanation: >- Avoid hardcoding secrets in Dockerfiles. Use --build-arg, Docker secrets, or runtime environment variables. - line: '12' severity: Warning rule: DL3060 message: Possible secret or credential in ENV explanation: >- Avoid hardcoding secrets in Dockerfiles. Use --build-arg, Docker secrets, or runtime environment variables. - line: '15' severity: Error rule: DL3011 message: 'Invalid EXPOSE port: 99999' explanation: Port numbers must be between 0 and 65535. - line: '21' severity: Warning rule: DL3002 message: >- No USER instruction found — container will run as root explanation: >- Running containers as root is a security risk. Add a USER instruction to run as a non-root user. - line: '21' severity: Info rule: DL3025 message: Use JSON notation for CMD explanation: >- Use CMD ["executable", "param1"] to avoid shell processing issues. - line: '21' severity: Info rule: DL3048 message: Missing HEALTHCHECK instruction explanation: >- Add a HEALTHCHECK to let Docker know how to check if the container is still working. formatted: | FROM ubuntu:latest MAINTAINER john@example.com RUN apt-get update && \ apt-get install -y curl git wget && \ cd /app && \ npm install ADD ./config.txt /app/config.txt ENV DB_PASSWORD=mysecretpass123 ENV API_KEY=sk-1234567890abcdef EXPOSE 8080 EXPOSE 99999 COPY . /app RUN chmod +x /app/start.sh CMD node server.js credits_used: 3 credits_remaining: null clean_dockerfile_no_issues: summary: Clean Dockerfile (no issues) value: tool: dockerfile-linter tool_version: 1.0.1 outputs: summary: - severity: Errors count: '0' - severity: Warnings count: '0' - severity: Info count: '0' - severity: Total count: '0' issues: [] formatted: > FROM node:20-alpine WORKDIR /app COPY package.json ./ RUN npm ci COPY . . USER node HEALTHCHECK CMD wget -q -O /dev/null http://localhost:3000/ || exit 1 CMD ["node", "server.js"] credits_used: 3 credits_remaining: null schema: type: object required: - tool - tool_version - outputs - credits_used - credits_remaining properties: outputs: type: object properties: summary: type: array items: type: object properties: severity: type: string description: Severity count: type: string description: Count x-iotools-columns: - severity - count issues: type: array items: type: object properties: line: type: string description: Line severity: type: string description: Severity rule: type: string description: Rule message: type: string description: Message explanation: type: string description: Explanation x-iotools-columns: - line - severity - rule - message - explanation formatted: type: string description: Formatted Dockerfile tool: type: string description: The tool's slug, echoing the {slug} in the request path. tool_version: type: string description: Output-contract version for this tool. credits_used: type: integer description: >- Credits this call consumed, after any settlement refund. 0 when metering is disabled. credits_remaining: type: - integer - 'null' description: >- Credits left in the current monthly allowance, or null when metering is disabled. request_id: type: string description: Correlation id, also sent as x-request-id. '400': $ref: '#/components/responses/ValidationError' '401': $ref: '#/components/responses/Unauthorized' '402': $ref: '#/components/responses/InsufficientCredits' '403': $ref: '#/components/responses/ToolNotAllowed' '404': $ref: '#/components/responses/ToolNotFound' '413': $ref: '#/components/responses/PayloadTooLarge' '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/ToolFailed' '503': $ref: '#/components/responses/ToolDisabled' security: - bearerAuth: [] components: responses: ValidationError: description: Invalid request. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/validation_error title: type: string description: Short human-readable summary of the failure. examples: - Invalid request status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - validation_error detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. fields: type: - object - string additionalProperties: type: string description: >- What failed: a map of field name → message. Absent when the body itself is malformed; a single string when the failure isn't tied to one field. example: type: https://iotools.cloud/docs/errors/validation_error title: Invalid request status: 400 code: validation_error detail: One or more inputs are invalid — see `fields`. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 fields: inputString: Required Unauthorized: description: Missing or invalid API key. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/invalid_api_key title: type: string description: Short human-readable summary of the failure. examples: - Invalid API key status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - invalid_api_key detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/invalid_api_key title: Invalid API key status: 401 code: invalid_api_key detail: 'Provide ''Authorization: Bearer ''.' request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 InsufficientCredits: description: Monthly credit allowance exhausted. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/insufficient_credits title: type: string description: Short human-readable summary of the failure. examples: - Insufficient credits status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - insufficient_credits detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. credits_used: type: integer description: Always 0 — a refused call charges nothing. credits_remaining: type: integer description: Credits left in the allowance — fewer than this call costs. example: type: https://iotools.cloud/docs/errors/insufficient_credits title: Insufficient credits status: 402 code: insufficient_credits detail: This call costs 1 credit and 0 remain in this month's allowance. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 credits_used: 0 credits_remaining: 0 ToolNotAllowed: description: Tool exists but has no API surface. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/tool_not_allowed title: type: string description: Short human-readable summary of the failure. examples: - Tool not available over the API status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - tool_not_allowed detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/tool_not_allowed title: Tool not available over the API status: 403 code: tool_not_allowed detail: >- "Background Remover" is available on iotools.cloud but has no API endpoint. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 ToolNotFound: description: No such tool. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/tool_not_found title: type: string description: Short human-readable summary of the failure. examples: - Tool not found status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - tool_not_found detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/tool_not_found title: Tool not found status: 404 code: tool_not_found detail: No tool with that slug. See GET /v1/tools/list. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 PayloadTooLarge: description: Body too large. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/payload_too_large title: type: string description: Short human-readable summary of the failure. examples: - Payload too large status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - payload_too_large detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/payload_too_large title: Payload too large status: 413 code: payload_too_large detail: Request body exceeds this tool's size limit. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 RateLimited: description: Per-minute rate limit exceeded. headers: Retry-After: description: Seconds to wait before retrying (RFC 9110 delta-seconds). schema: type: integer content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/rate_limited title: type: string description: Short human-readable summary of the failure. examples: - Rate limit exceeded status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - rate_limited detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. retry_after: type: integer description: >- Seconds until the window resets — the same value as the `Retry-After` header. example: type: https://iotools.cloud/docs/errors/rate_limited title: Rate limit exceeded status: 429 code: rate_limited detail: Too many requests. Retry in 30s. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 retry_after: 30 ToolFailed: description: Tool failed to run. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/processing_error - https://iotools.cloud/docs/errors/internal_error title: type: string description: Short human-readable summary of the failure. examples: - Tool failed to run - Internal error status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - processing_error - internal_error detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. credits_used: type: integer description: >- Always 0 on `processing_error` — a failed run is refunded, floor included. credits_remaining: type: integer description: >- Credits left after the refund. Absent when metering is disabled. example: type: https://iotools.cloud/docs/errors/processing_error title: Tool failed to run status: 500 code: processing_error detail: The tool failed to run. Please try again. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 credits_used: 0 ToolDisabled: description: Tool temporarily disabled. content: application/problem+json: schema: type: object description: >- RFC 9457 problem document, served as application/problem+json. Branch on `code`; `title` is human prose and may be reworded without notice. Some failures add extension members — `fields` on validation errors, `retry_after` on 429s, `credits_used`/`credits_remaining` on billing-adjacent failures — documented on the responses that carry them. required: - type - title - status - code properties: type: type: string format: uri description: Stable documentation URI for this failure. examples: - https://iotools.cloud/docs/errors/tool_disabled - https://iotools.cloud/docs/errors/api_unconfigured title: type: string description: Short human-readable summary of the failure. examples: - Tool temporarily disabled - API not configured status: type: integer description: HTTP status code, matching the response's own status. code: type: string description: >- Stable machine-readable error code — branch on this, not `title`. enum: - tool_disabled - api_unconfigured detail: type: string description: Human explanation of this occurrence. request_id: type: string description: Correlation id, also sent as x-request-id. example: type: https://iotools.cloud/docs/errors/tool_disabled title: Tool temporarily disabled status: 503 code: tool_disabled detail: This tool is temporarily unavailable. Try again shortly. request_id: e4042b29-8f1e-4c7a-9b52-6f0d1a3c7e11 securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: iot_live_… ````