Dockle checks container images for security and image-building best
practices. It inspects image metadata and filesystem contents rather
than linting a Dockerfile alone. It is not a CVE vulnerability scanner.

Building requires google-go-lang (Go 1.22.10 or newer). The supplied
vendor archive allows offline compilation. Go is not needed at runtime.

Docker is optional. Dockle can scan registry images or a local archive
created with docker save:

  dockle --input image.tar
  dockle --format json --input image.tar

Scanning registry images requires network access and may require
credentials. Scanning a local Docker daemon requires socket access,
which is security-sensitive. See https://docs.docker.com/ for details.

Findings do not change the exit status by default. For CI, use
--exit-code 1 and optionally --exit-level WARN or FATAL. Checkpoints can
be excluded using --ignore or a .dockleignore file.

See CHECKPOINT.md in /usr/doc/dockle-<version>/ for check descriptions.