Dockerfile Optimizer
Scan a Dockerfile for common size, caching, and security anti-patterns, runs entirely in your browser.
About this tool
Paste an existing Dockerfile and get a list of common issues it might have: an unpinned or ":latest" base image tag, apt-get usage that leaves package caches behind, ADD used where COPY would do, no non-root USER, npm install where npm ci would give a reproducible build, or build tooling that looks like it belongs in a separate build stage.
This is a lightweight heuristic checker, the kind of pattern-matching pass a reviewer might do by eye, not a full Dockerfile parser or a replacement for a dedicated linter like hadolint. It catches a handful of well-known, high-value issues; a clean result means "these specific checks found nothing," not "this Dockerfile is optimal."
Frequently asked questions
- Why does it flag my base image even though I specified a tag?
- Only a tag of exactly ":latest" (or no tag at all, which is equivalent) is flagged. ":latest" resolves to whatever the newest published image happens to be at build time, which makes builds non-reproducible; pinning a specific version like "node:20-alpine" avoids that.
- What is wrong with using ADD instead of COPY?
- ADD has two extra behaviors COPY does not: it can fetch a remote URL, and it automatically extracts local tar archives. For an ordinary local file copy, neither behavior is wanted, and COPY’s more limited, more explicit behavior is the generally recommended default. The checker only flags ADD when it does not look like a URL fetch.
- Is this a complete Dockerfile linter?
- No, it checks for a small, deliberately chosen set of common issues via text pattern matching. For comprehensive linting, a dedicated tool like hadolint understands Dockerfile syntax properly and checks far more rules; this tool is meant as a quick, dependency-free first pass.
- Is my Dockerfile sent anywhere?
- No. Analysis runs entirely in your browser, no network request is made.
Continue learning
- DocumentationDocker FundamentalsHow images, containers, volumes, and networks fit together in Docker's runtime model, and the shift from installing software to running images.
- BlogWhy Every Container in Your Rolling Deploy Takes an Extra 10 Seconds to StopWhy npm as PID 1 can prevent Node.js from receiving SIGTERM, trigger Docker's ten-second timeout, and end container shutdown with SIGKILL.
- ToolDockerfile GeneratorGenerate a working Dockerfile for Node.js, Python, Go, or a static site, runs entirely in your browser.
- DocumentationBash FundamentalsBash scripting from variables to functions, plus the quoting and exit-status habits that separate a script that looks right from one that fails safely.
- BlogTerraform Troubleshooting Guide: Fix the Errors Engineers Actually HitDiagnose Terraform initialization, validation, provider, authentication, state, drift, import, replacement, timeout, and CI failures with a safe workflow.
- ToolDocker Compose GeneratorBuild a multi-service docker-compose.yml from a simple form, runs entirely in your browser.