CheckOps home

Tools directory

D

CheckOps

Dockle

Dockle is an Apache-2.0 container image linter for security that checks built images against best practices and CIS Docker Benchmark items.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Dockle is a container image linter for security, helping build best-practice Docker images. Unlike a Dockerfile linter, it inspects the built image, checking items such as running as root, sensitive files, missing HEALTHCHECK and other CIS Docker Benchmark points.

The source code is at goodwithtech/dockle on GitHub under the Apache-2.0 licence, with about 3,300 stars; the most recent commit was on 10 August 2026.

Features

  1. Image-level checks: Inspects built images.
  2. CIS benchmark items: Checks drawn from CIS Docker Benchmark.
  3. Exit codes: Fail CI on findings.
  4. Output formats: JSON and SARIF.
  5. Easy start: Single binary or Docker image.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 10 August 2026.
  3. Community: About 3,300 GitHub stars.

Cons

  1. Narrow scope: Not a vulnerability scanner.
  2. Slower updates: Last commit August 2026.
dockle --exit-code 1 myimage:latest

Resources:

Pricing

Dockle is free and open source under the Apache-2.0 licence.

  1. Teams hardening container images.
  2. CI pipelines adding image best-practice checks.
  3. Not a fit for CVE scanning; pair with Trivy or Grype.

Conclusion

Dockle is a simple security linter for built container images.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Dockle side by side.