Dockle

Dockle is a command-line linter for container images. It flags Dockerfile and image issues so you can build images that follow best practices and security checks, including CIS Benchmarks.

Dockle scans images by name or from an image file, outputs SARIF, and can exit non-zero when WARN or FATAL alerts appear. Checkpoints cover trusted base images, unnecessary packages, secrets baked into images, avoiding sudo, and rejecting suspicious environment variables, files, and extensions.

A single static binary handles the work, with no runtime dependencies, and it can read private Docker registries through environment variables without extra tooling. Installation options include Homebrew, Linux packages, Windows, and an asdf plugin, and it fits cleanly into CI pipelines.