Dockle
What it is
Dockle is a free, open-source container image linter for security on Linux, macOS, and Windows. It scans images for vulnerabilities and checks Docker image practices, including CIS Docker Image Benchmark checkpoints. Additional checks cover Docker- and Linux-specific settings such as empty passwords and duplicate user or group IDs. Results can be displayed or saved in JSON and SARIF formats. Users can change the exit level or ignore selected checkpoints through command options, environment variables, or a .dockleignore file. The project documents CI usage, provides a GitHub Action, and shows examples for Travis CI, CircleCI, and GitLab CI. Dockle can access private images in Docker Hub, Amazon ECR, Google Container Registry, and self-hosted registries. It can also scan an image archive made with docker save using the --input option. Installation routes include Homebrew, Linux distribution packages, Windows binaries, version managers, source builds, and Docker. Dockle is self-hosted and licensed under Apache-2.0.
For and against
For
- Free Apache-2.0 open-source license
- Runs on Linux, macOS, and Windows
- JSON and SARIF output
- CI integrations and GitHub Action
- Private registry and image-archive scanning
Against
- Self-hosted deployment is required
- Private registry credentials use environment variables
- Checks require configuration for ignored checkpoints
The verdict
Dockle is a practical option for teams wanting repeatable container-image checks without a subscription. Its platform support, CI documentation, configurable checkpoints, and multiple output formats suit varied development environments.
Who it suits
It suits developers and security teams checking container images in local or CI workflows. Teams run the self-hosted linter in their own environments.
Plans and prices
Dockle
Open-source container image linter
Read 8 Oct 2026 · github.com
On the record
- CIS benchmarks
- Its security checkpoints include CIS Docker Image Benchmarks.github.com · read 8 Oct 2026
- CI support
- The project documents CI usage and provides a GitHub Action, with examples for Travis CI, CircleCI, and GitLab CI.github.com · read 8 Oct 2026
- Configurable checks
- Users can change the exit level and ignore selected checkpoints using command options, environment variables, or a .dockleignore file.github.com · read 8 Oct 2026
- Image checks
- It checks container images for vulnerabilities and Docker image best practices.github.com · read 8 Oct 2026
- Image files
- Dockle can scan an image archive created with docker save by using its --input option.github.com · read 8 Oct 2026
- Installation
- Installation options include Homebrew, RHEL/CentOS, Debian/Ubuntu, Arch Linux, Windows binaries, version managers, source builds, and Docker.github.com · read 8 Oct 2026
- License
- The repository lists the project under the Apache-2.0 license.github.com · read 8 Oct 2026
- Other checkpoints
- Dockle also checks Docker-specific and Linux-specific image settings, including empty passwords and duplicate UIDs or groups.github.com · read 8 Oct 2026
- Output formats
- It can display or save results in JSON and SARIF formats.github.com · read 8 Oct 2026
- Private registry credentials
- For private registry access, the documentation describes configuring credentials through environment variables and advises against using them on a local machine.github.com · read 8 Oct 2026
- Purpose
- Dockle is a container image linter for security that helps build best-practice Docker images.github.com · read 8 Oct 2026
- Registry integrations
- Dockle documents access to private images in Docker Hub, Amazon ECR, Google Container Registry, and self-hosted registries.github.com · read 8 Oct 2026
