Agent skill · security · aiskillstore
container-hadolint
Dockerfile security linting and best practice validation using Hadolint with 100+ built-in rules aligned to CIS Docker Benchmark. Use when: (1) Analyzing Dockerfiles for security misconfigurations and anti-patterns, (2) Enforcing container image security best practices in CI/CD pipelines, (3) Detecting hardcoded secrets and credentials in container builds, (4) Validating compliance with CIS Docker Benchmark requirements, (5) Integrating shift-left container security into developer workflows, (6) Providing remediation guidance for insecure Dockerfile instructions.
Why this skill is useful
Provides domain-specific knowledge for Dockerfile security linting and compliance with CIS Docker Benchmark that the AI wouldn't reliably generate on its own.
What it needs
Requires docker, hadolint installed locally. About 8k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Dockerfile Security Linting with Hadolint Overview Hadolint is a Dockerfile linter that validates container build files against security best practices and the CIS Docker Benchmark. It analyzes Dockerfile instructions to identify misconfigurations, anti-patterns, and security vulnerabilities before images are built and deployed. Hadolint integrates ShellCheck to validate RUN instructions, ensuring shell commands follow security best practices. With 100+ built-in rules mapped to CIS Docker Benchmark controls, Hadolint provides comprehensive security validation for container images. Quick Start Install Hadolint Scan Dockerfile Generate Report Core Workflows 1. Local Development Scanning Validate Dockerfiles during development: Output Format: When to use: Developer workstation, pre-commit validation, iterative Dockerfile development. 2. CI/CD Pipeline Integration Automate Dockerfile validation in build pipelines: GitHub Actions GitLab CI When to use: Automated security gates, pull request checks, deployment validation. 3. Configuration Customization Create .hadolint.yaml to customize rules: Use bundled templates in assets/: assets/hadolint-strict.yaml - Strict security enforcement (CRITICAL/HIGH only) assets/hadolint-balanced.yaml - Balanced validation (recommended) assets/hadolint-permissive.yaml - Permissive for legacy Dockerfiles When to use: Reducing false positives, organizational standards, legacy Dockerfile migration. 4. Security-Focused Validation Enforce critical security rules: Critical Security Rules: DL3000: Use absolute WORKDIR (prevents directory traversal) DL3001: Always use version pinning for package managers DL3002: Never switch to root USER in Dockerfile DL3020: Use COPY instead of ADD (prevents arbitrary URL fetching) DL3025: Use JSON notation for CMD/ENTRYPOINT (prevents shell injection) See references/securityrules.md for complete security rule catalog with CIS mappings. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/container-hadolint