> ## Documentation Index
> Fetch the complete documentation index at: https://tally.wharflab.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auto-fix

> Apply safe and unsafe auto-fixes to Dockerfiles using tally lint --fix.

tally can apply fixes automatically. Fixes are designed to be:

* **Atomic** — a fix applies fully or not at all.
* **Conflict-aware** — overlapping edits are skipped rather than producing a corrupted file.
* **Configurable** — per-rule fix modes let you control exactly which fixes run and when.

## Basic usage

Apply all safe fixes:

```bash theme={null}
tally lint --fix Dockerfile
```

Apply unsafe fixes too (includes AI-powered fixes when enabled):

```bash theme={null}
tally lint --fix --fix-unsafe Dockerfile
```

<Warning>
  `--fix` is not supported when the lint entrypoint is a Bake or Compose file. Lint the Dockerfile directly when you want tally to modify files.
</Warning>

Limit fixes to specific rules:

```bash theme={null}
tally lint --fix --fix-unsafe \
  --fix-rule hadolint/DL3008 \
  --fix-rule tally/prefer-copy-heredoc \
  Dockerfile
```

<Tip>
  Use `--fix-rule` to limit the blast radius when applying fixes for the first time. Start with one rule at a time to review changes before committing.
</Tip>

## Safe vs. unsafe fixes

| Mode | Flag | Description |
| - | - | - |
| Safe | `--fix` | Applies mechanical rewrites with high confidence (🔧 in the rules reference) |
| Unsafe | `--fix` + `--fix-unsafe` | Also applies riskier fixes that may change semantics, including AI-powered fixes |

The 🔧 marker in the rules reference indicates a rule has auto-fix support. Safe fixes are things like adding a missing newline, reordering
instructions, or converting `RUN echo` to a `COPY` heredoc. Unsafe fixes may restructure stages or change command arguments.

## Per-rule fix modes

Control when fixes are allowed per rule in `.tally.toml`:

```toml theme={null}
[rules.tally.prefer-copy-heredoc]
fix = "always"          # Apply whenever --fix is set (default)

[rules.tally.prefer-multi-stage-build]
fix = "explicit"        # Only when --fix-rule includes this rule explicitly

[rules.tally.no-trailing-spaces]
fix = "unsafe-only"     # Only when --fix-unsafe is also set

[rules.tally.eol-last]
fix = "never"           # Never auto-fix this rule
```

Valid fix mode values:

| Value | Behavior |
| - | - |
| `always` | Apply whenever `--fix` is passed (default) |
| `never` | Never auto-fix, even when `--fix` is set |
| `explicit` | Only when `--fix-rule <this-rule>` is explicitly specified |
| `unsafe-only` | Only when `--fix-unsafe` is also set |

## How conflict resolution works

When two fixes would modify overlapping lines, tally skips the conflicting fix rather than applying a partial or corrupted change. The skipped fix is
reported to stderr:

```text theme={null}
Skipped 1 fixes
note: skipped fix tally/prefer-copy-heredoc (Dockerfile): overlapping edit at line 14
```

Fix skips are informational — linting continues and the violation is still reported so you can address it manually.

## Examples of fixable rules

Rules marked 🔧 in the rules reference support auto-fix. Some notable examples:

| Rule | Fix type | What it does |
| - | - | - |
| `tally/prefer-copy-heredoc` | Safe | Converts `RUN echo`/`cat`/`printf` to `COPY` heredoc |
| `tally/prefer-copy-chmod` | Safe | Converts `COPY` + `RUN chmod` to `COPY --chmod` |
| `tally/no-trailing-spaces` | Safe | Removes trailing whitespace |
| `tally/eol-last` | Safe | Adds missing newline at end of file |
| `tally/sort-packages` | Safe | Sorts package lists alphabetically |
| `tally/epilogue-order` | Safe | Reorders `STOPSIGNAL`, `HEALTHCHECK`, `ENTRYPOINT`, `CMD` |
| `tally/curl-should-follow-redirects` | Safe | Adds `-L` to `curl` commands |
| `tally/prefer-multi-stage-build` | Unsafe (AI) | Converts single-stage builds to multi-stage |
| `tally/prefer-package-cache-mounts` | Unsafe (AI) | Adds BuildKit cache mounts for package installs |

## AI AutoFix

Some fixes are too complex to implement deterministically. For those, tally supports an opt-in AI resolver via ACP (Agent Client Protocol).

AI fixes are marked unsafe and require both `--fix` and `--fix-unsafe`. See the [AI AutoFix (ACP)](/guides/ai-autofix) guide for setup instructions.


## Related topics

- [hadolint/DL4001](/rules/hadolint/DL4001.md)
- [tally/gpu/prefer-uv-over-conda](/rules/tally/gpu/prefer-uv-over-conda.md)
- [`tally/prefer-multi-stage-build`](/rules/tally/prefer-multi-stage-build.md)
- [tally/ruby/jemalloc-installed-but-not-preloaded](/rules/tally/ruby/jemalloc-installed-but-not-preloaded.md)
- [tally/user-created-but-never-used](/rules/tally/user-created-but-never-used.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.