# docker/hadolint

> Lints every Dockerfile, and runs ShellCheck over its RUN lines.

Lints every Dockerfile, and runs ShellCheck over its RUN lines.

Part of the [`docker`](/reference/configurations/docker/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), per file. It runs hadolint.

## Why

An unpinned base image makes a build nobody can repeat, and a cache left in a layer bloats the result.

## What to do

Change the instruction the way the rule says. Turn one rule off with `gspot ignore docker/hadolint --rule <id> --reason "<why>"`.

## Example

`FROM node:latest` reports DL3007, because that tag moves. Pin an explicit version tag or a digest.

## Turn it off

Turn it off for some files, or one of its lint rules, with a reason:

```shell
gspot ignore docker/hadolint --paths "<glob>" --reason "<why>"
gspot ignore docker/hadolint --rule <rule> --reason "<why>"
```