日本語English

Dockerfile Studio

Paste a Dockerfile to check its syntax, stages and common mistakes. Secret-looking values and points to confirm, such as curl | sh, are listed with line numbers. You can also format it or generate starter files for Node.js, Python, Go, a static site or Java. Nothing is built, and your input never leaves your device.

On-device・No uploadMobile friendlyWorks offlineBeta

Your files and input are processed only inside your browser on this device and are never uploaded to our servers.

Nothing is run. No build, image pull or vulnerability check is done. Your input never leaves your device.

Dockerfile (paste or file)
0 characters0 lines
Result
Enter a Dockerfile on the left and the result appears here. Use “Sample” to try it.

Enter a Dockerfile on the left and the result appears here. Use “Sample” to try it.

How to use

  1. Dockerfile

    Paste a Dockerfile

  2. Syntax and common mistakes
    ENV secrets, curl | shFlagged as points to check

    Check for mistakes and secrets

  3. Tidied Dockerfile
    For Node.js or Python

    Tidy up, or generate per language

Paste a Dockerfile to check for common mistakes and tidy it up

  1. Pick “Check”, “Format” or “Generate” at the top.

  2. For “Check” and “Format”, paste a Dockerfile into the input pane or use “Open file”. The sample button lets you try it.

  3. Findings lists syntax, common mistakes and points to confirm with line numbers. “Result” shows the stage outline (Check) or the formatted Dockerfile (Format).

  4. For “Generate”, enter the template, base image, port and user ID. The Dockerfile appears on the right; read the notes too.

  5. Copy the result or download it, then confirm it with docker build.

What it does

Syntax reading

Reads line continuations (\ or `), heredocs (<<EOF), the # syntax= and escape= parser directives, ARG expansion and multi-stage FROM ... AS. Also reports EXPOSE ranges and unknown instructions.

Common mistake checks

Covers FROM without a tag or with latest, pinned apt-get and apk versions, apt cache cleanup and --no-install-recommends, COPY instead of ADD, JSON form for CMD and ENTRYPOINT, pipefail, whether the last USER is root, consecutive RUN, relative WORKDIR and HEALTHCHECK.

Security points to confirm

Lists secret-looking values in ENV, ARG and RUN (values are not shown), COPY . with .dockerignore, curl | sh, sudo, running as root, operations that may need --privileged, http:// downloads and ADD URLs as points to confirm. No verdicts are given.

Formatting

Upper-cases instructions, indents continuation lines and collapses extra blank lines. Secret-looking values are replaced with *** by default (this can be turned off).

Generation from templates

Starter files for Node.js, Python, Go, a static site (nginx) and Java (Maven), with multi-stage builds, a numeric user ID, cache-friendly COPY order and an optional HEALTHCHECK. The start command is written as a JSON array so line breaks or quotes cannot add instructions.

Shows where each finding comes from

Each finding names its rule and line. The DL numbers borrow hadolint’s rule numbers as labels, but the rules are this tool’s own implementation.

Use cases

  • See whether a README’s Dockerfile follows current practice
  • Check a Dockerfile before publishing for secrets in ENV, curl | sh or running as root
  • Confirm FROM tags, pinned apt and apk versions and cache cleanup
  • Start a Node.js or Python Dockerfile with multi-stage builds and a non-root user
  • Format a file so continuation indents and instruction case are consistent

Supported formats

Input

Dockerfile.dockerfileContainerfile (when it contains Dockerfile syntax).txt

Output

Dockerfile (formatted or generated)Findings (shown and copyable)

Capability matrix

FeatureSupportNotes
Reading syntax (continuations, heredocs, ARG expansion, multi-stage)SupportedFollows the documented Docker rules; it may differ from BuildKit’s internals in edge cases
Common mistake findings (part of hadolint’s main rules)PartialOur own rules, labelled with DL numbers. Not all of hadolint’s rules and not a full equivalent
Detecting secret-looking values in ENV, ARG and RUNPartialCovers KEY=value style and known formats only. Some are missed or flagged wrongly; values are not shown
Points to confirm (curl | sh, sudo, root, privileged-looking operations)PartialLists what is written; does not judge whether something is safe
Formatting (instruction case and indentation)SupportedDoes not change the meaning of instructions
Generation from templatesPartialFive starter templates; you may need to adapt them to your app
Building (docker build) and runningNot supportedNothing is built or run. Use docker build to check
Pulling images, vulnerability scanning, inspecting base image contentsNot supportedNo connection to any image; vulnerabilities are not checked
Offline useSupportedWorks without a connection once loaded

Limits & notes

  • Input is limited to 200,000 characters and 3,000 instructions.
  • Up to 300 findings are shown. Processing is stopped after 20 seconds.
  • Secret detection mainly covers KEY=value and KEY: value. The “KEY value” form may be missed.
  • Shell syntax inside RUN is not fully parsed (for example, a | inside quotes is handled simply).
  • Heredocs are read only for RUN, COPY and ADD. Input with several Dockerfiles is treated as one file.
  • The default image names and versions in generation are examples. Check the latest before use.

Privacy & safety

Pasted Dockerfiles and loaded files are processed only inside your browser. Nothing is sent to or stored on any server. Secret-looking values in ENV and ARG are not shown on screen, and formatting replaces them with *** by default. Values in RUN are flagged but not masked by formatting.

FAQ

How do I check a Dockerfile against best practices?
Paste it into “Check”. It lists FROM tags, pinned apt and apk versions, cache cleanup, running as root, COPY . and more, with line numbers. Decide for yourself which points fit your use.
How do I generate a starter Dockerfile?
Choose a template under “Generate” and enter the base image, port, working directory and start command. Multi-stage builds and HEALTHCHECK can be selected too. Save the output and confirm it with docker build.
Will the results match hadolint?
No. The DL numbers are used only as labels. The rules are this tool’s own implementation, not all of hadolint’s rules. Use hadolint separately for a strict check.
What happens to a password written in ENV?
ENV and ARG values can stay in the image configuration and history. Pass secrets needed only at build time with a mechanism such as RUN --mount=type=secret. The tool flags such lines and hides the value on screen.
Can it build the Dockerfile to test it?
No. It does not build, pull base images or check vulnerabilities. Use docker build for that.
Is my Dockerfile sent to a server?
No. Checking, formatting and generating all run in your browser. Your input is never sent to LIBRA Works or any third party.

Docker Compose Studio

Convert docker run commands to compose.yaml, or compose.yaml back to docker run. A compose file is checked for syntax, the Compose Specification and common mistakes, and security points worth confirming are listed. Nothing is started or pulled, and your input never leaves your device.

No uploadBeta

Secret Scanner

Paste text or drop config and code files to list likely secrets with file, line and rule before you publish or share them. Values are masked by default and you can save a copy with them replaced by ***. A helper only — it cannot guarantee that nothing is missed.

No upload

YAML / TOML Studio — Validate, Format & Convert

Paste YAML, TOML or JSON to validate, format or convert it. Errors show the exact line and column, and type traps such as “no becomes false” and anything lost in conversion are flagged up front. Your data never leaves your device.

No uploadBeta

curl Converter

Paste “Copy as cURL” from Chrome or Firefox to see the method, URL, headers, cookies and body in tables, then convert to 12 kinds of code. The request is never sent and everything runs in your browser. Authorization and cookies can be hidden before you share.

No uploadBeta

nginx Config Studio

Build a reverse proxy, SPA, PHP-FPM or HTTP-to-HTTPS redirect config from a form, or paste your nginx.conf to list syntax errors and easy-to-miss points. Everything runs in your browser and nginx is never executed.

No uploadBeta

Last updated: