hadolint: Ignore Rules (DL and SC codes)
hadolint suppresses a rule with --ignore on the command line, an inline # hadolint ignore=DLxxxx comment, or an ignored list in the config file.
When a Dockerfile rule does not apply, silence that specific DL or SC code, ideally inline above the instruction so the reason is visible.
What it does
hadolint rules use DLxxxx codes (and SCxxxx for embedded shell). --ignore=DL3008 skips a rule for the run; # hadolint ignore=DL3008,DL3009 on the line above an instruction skips it there; and a ignored: list in .hadolint.yaml skips it project-wide.
Common usage
# inline, just for the next instruction
# hadolint ignore=DL3008,DL3015
RUN apt-get install -y curl
# on the command line
hadolint --ignore DL3008 --ignore DL4006 DockerfileOptions
| Mechanism | What it does |
|---|---|
| --ignore <code> | Skip a DL/SC rule for the run (repeatable) |
| # hadolint ignore=<codes> | Inline suppression for the next instruction |
| ignored: (.hadolint.yaml) | Project-wide list of rules to skip |
| --failure-threshold | Alternative: stop low-severity rules failing |
In CI
Inline # hadolint ignore=DLxxxx comments keep suppressions next to the instruction they excuse, which survives review better than a growing --ignore list in the workflow. Put shared, intentional exceptions in .hadolint.yaml so every run agrees.
Common errors in CI
An inline ignore that does nothing is usually on the wrong line; it must be the line immediately before the instruction. Ignoring DL3008 hides unpinned apt versions, so do it only when you pin elsewhere or pull a digest-pinned base, or the suppression masks a real supply-chain risk.