Dockerfile Instruction Explainer
Read Dockerfile stages, parser directives, runtime commands, and stage-specific review concerns in context.
Paste a Dockerfile to explain each instruction and find common build or runtime issues.
Explanation Settings
Instruction coverage
Checks
The parser understands Dockerfile continuations, top-of-file parser directives, and a single heredoc delimiter per instruction. It does not run a build or inspect the referenced images and build context.
Output
Dockerfile explanation output will appear here.
A Dockerfile is ordered build state, not just a list of commands
FROM starts a stage, RUN changes image filesystem state during the build, and runtime instructions such as USER, ENTRYPOINT, and CMD affect what happens after the image starts. The explanation therefore tracks stage position instead of treating every occurrence as globally equivalent.
Shell form and exec form behave differently
RUN, CMD, and ENTRYPOINT can use shell or JSON exec form. Exec form avoids an automatic command shell. Shell-form ENTRYPOINT also changes signal and argument behavior, which is why the page calls it out rather than describing both forms as interchangeable.
Parser directives, continuations, and heredocs need their own handling
Top-of-file directives such as # syntax= and # escape= affect parsing without becoming image layers. The selected escape character changes line continuation behavior. Heredoc bodies are kept with their owning instruction so script lines are not misreported as Dockerfile instructions.
A warning is not a build verdict
A missing USER in the final stage is worth reviewing, but the base image may already define one. A missing HEALTHCHECK may be fine for a short-lived job. A tagged base image can still move even when it is not tagged latest. These are review boundaries, not automatic failures.
Secrets need build-specific handling
Explicit secret-looking assignments in ENV or defaulted ARG values are flagged because they can persist in image metadata, history, provenance, or later layers. BuildKit secret mounts are a better fit for credentials needed only during a build.
Confirm exact behavior against Docker's reference
Docker documents the instruction grammar, parser directives, shell/exec forms, heredocs, and last-instruction-wins behavior in the Dockerfile reference. This page deliberately stops short of emulating BuildKit, resolving base-image defaults, or examining .dockerignore.