rudolint

rudolint is a fast Dockerfile linter built for modern BuildKit and Buildx workflows.

Features

Feature	What is implemented
Dockerfile parsing	Source-aware parsing for instructions, flags, heredocs, comments, and stage aliases.
BuildKit support	Frontend syntax directives, cache mounts, secret mounts, SSH mounts, insecure entitlements, and Buildx platform checks.
Rule profiles	default runs every implemented rule. hadolint-compat keeps Hadolint-style Dockerfile and shell checks. correctness, performance, and hardening focus the output by signal.
CI output	Text output for terminals, JSON for automation, and SARIF for GitHub code scanning.
Configuration	.rudolint.yaml supports ignored rules, severity overrides, per-file ignores, selected rule prefixes, and trusted registries.
GitHub Action	A Marketplace action downloads checksummed release binaries and runs rudolint without compiling Rust in user workflows.
Language server	rudolint-lsp speaks LSP over stdio for editor diagnostics.
Rule documentation	Implemented rules are documented under docs/rules, with compatibility and BuildKit roadmap notes in docs/rule-roadmap.md.

Install

curl -LsSf https://kubeply.com/rudolint/install.sh | sh

To install a specific release, include the tag in the URL:

curl -LsSf https://kubeply.com/rudolint/<tag>/install.sh | sh

Upgrade an existing install to the latest release:

rudolint upgrade

Tip

Migrating from Hadolint? Start with hadolint-compat and see the Hadolint migration guide for profile, config, and inline-ignore conversion notes.

To upgrade to a specific release tag:

rudolint upgrade --tag <tag>

Container Image

Run the published GHCR image without installing rudolint locally:

docker run --rm -v "$PWD:/workspace" ghcr.io/kubeply/rudolint check /workspace

Release images are published as ghcr.io/kubeply/rudolint:<release-tag>, ghcr.io/kubeply/rudolint:v1, and ghcr.io/kubeply/rudolint:latest. See docs/docker.md for tag, platform, config, and CI examples.

Usage

Check one Dockerfile:

rudolint check Dockerfile

Check a repository:

rudolint check .

Migrate Hadolint inline suppression syntax:

The first command previews conversion of # hadolint ignore=... comments to # rudolint ignore=... without writing files. The second command applies the same migration.

rudolint check . --fix --migrate-hadolint-ignores --dry-run
rudolint check . --fix --migrate-hadolint-ignores

Default text output is grouped by rule and shows up to three example locations per rule. Use --group-by file when fixing one Dockerfile at a time, and --color never when plain text is preferred.

Write SARIF for CI:

rudolint check . --format sarif > rudolint.sarif

Exit codes:

Code	Meaning
0	No findings at or above the failure threshold.
1	Findings met or exceeded the failure threshold.
2	Usage, config, or input error.
3	Unexpected internal error.

GitHub Action

Use the stable major action tag for normal CI. By default, the action downloads the latest released rudolint binary, so the wrapper and linter stay aligned across stable releases:

name: Dockerfile lint

on:
  pull_request:
  push:
    branches: [main]

jobs:
  rudolint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: kubeply/rudolint@v1

Set version only when you want to pin a specific linter release:

- uses: kubeply/rudolint@v1
  with:
    version: <release-tag>

For monorepos, pass one path per line:

- uses: kubeply/rudolint@v1
  with:
    paths: |
      services/api
      services/worker/Dockerfile

Upload SARIF to GitHub code scanning:

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v4
  - uses: kubeply/rudolint@v1
    with:
      upload-sarif: "true"
      sarif-output: rudolint.sarif

Use profile: hadolint-compat when you want Hadolint-style Dockerfile and shell-style checks without BuildKit-native RDK diagnostics. This is useful while migrating from Hadolint or when a project is not ready for BuildKit recommendations yet. Use profile: correctness, profile: performance, or profile: hardening to run only one signal category. See docs/action.md for the full action contract.

- uses: kubeply/rudolint@v1
  with:
    profile: hadolint-compat
    failure-threshold: error

Configuration

.rudolint.yaml is documented in docs/config.md, including the v1 JSON Schema for editor validation.

ignore:
  - RDK1003

select:
  - DL
  - RDK1008

severity:
  DL3007: error
  RDK1000: warning

per-file-ignores:
  # Patterns are matched relative to this config file's directory.
  fixtures/**:
    - DL3000

trusted-registries:
  - docker.io
  - ghcr.io

Run with:

rudolint check . --config .rudolint.yaml

For repositories with rendered Dockerfile templates, use:

rudolint config ignore-templates

Rule Families

Prefix	Scope
DL	Hadolint-compatible Dockerfile diagnostics.
RDK	Rudolint-native BuildKit diagnostics such as frontend directives, mounts, entitlements, and Buildx platform behavior.
RUD	Rudolint-native migration and project policy diagnostics.
SC	ShellCheck-compatible diagnostics extracted from RUN bodies.

More Docs

• GitHub Action usage
• Configuration
• Rule roadmap
• Architecture
• Completed implementation plan
• Release automation

Development

See CONTRIBUTING.md for setup, repository layout, validation, testing, and contribution guidelines.