Seven Dockerfile mistakes to catch before your image build

Dockerfile errors often surface only in production, such as images running as root or pulling a drifting :latest tag. The author demonstrates a small Dockerfile that builds successfully yet contains seven problems, including unpinned and latest base images, piping a remote script into a shell, and leftover apt caches. An offline linter flagged all seven findings, with the download-to-shell issue rated critical enough to block a build. A corrected version pins the base image, combines apt steps, uses COPY instead of ADD, and drops to a non-root user. The tool checks files without building or pulling images, making it practical to run on every commit, though it cannot verify that images or packages exist.