hadolint
hadolint [--failure-threshold <level>] <Dockerfile>
Risk: Safe
What it does
Proofreads a Dockerfile and lists risky lines, like a latest base image.
When to use it
Before every build, on every pull request.
Example
$ hadolint DockerfileCheck the recipe. A finding exits with code 1.
$ hadolint --failure-threshold error DockerfileOnly errors fail; warnings are just printed.
Learn it in: Lint with hadolint and actionlint · Official docs