No. This page does not send it. The JSON API checks a Dockerfile for a script and then discards it.

Does a clean result mean the image is safe?

No. It flags a short list of mistakes. It does not scan packages or run the build.

Why is latest a problem?

The tag moves. A rebuild can pick up a different image without a change in the Dockerfile.

Tools · DevOps

Dockerfile checker

Paste a Dockerfile. The check runs in this browser and looks for a latest tag, a missing user, a piped installer and secret-looking environment names.

The file stays in this browser. A script can POST it to the JSON API; that copy is not stored either.

How to use it

Paste the Dockerfile. It stays in the browser.
Fix high-severity lines first: pin the image, set a non-root USER, and remove secrets from ENV.
Treat the notes as review comments. This does not build the image.

Questions

Is the file stored?: No. This page does not send it. The JSON API checks a Dockerfile for a script and then discards it.
Does a clean result mean the image is safe?: No. It flags a short list of mistakes. It does not scan packages or run the build.
Why is latest a problem?: The tag moves. A rebuild can pick up a different image without a change in the Dockerfile.

An automated client can POST JSON to /api/tools/dockerfile with the fields listed in the OpenAPI document. The OpenAPI document is at /api/tools, with a short guide at /llms.txt. Nothing submitted is stored.