docker/hadolint
Lints every Dockerfile, and runs ShellCheck over its RUN lines.
Part of the docker configuration, at the recommended level. It runs at the commit stage, per file. It runs hadolint.
An unpinned base image makes a build nobody can repeat, and a cache left in a layer bloats the result.
What to do
Section titled “What to do”Change the instruction the way the rule says. Turn one rule off with gspot ignore docker/hadolint --rule <id> --reason "<why>".
Example
Section titled “Example”FROM node:latest reports DL3007, because that tag moves. Pin an explicit version tag or a digest.
Turn it off
Section titled “Turn it off”Turn it off for some files, or one of its lint rules, with a reason:
gspot ignore docker/hadolint --paths "<glob>" --reason "<why>"gspot ignore docker/hadolint --rule <rule> --reason "<why>"