Quick start - tally

Install tally

Pick your preferred package manager:

brew trust --formula wharflab/tap/tally
brew install --require-sha wharflab/tap/tally

mise use -g github:wharflab/tally@latest

npm install -g tally-cli

bun add -g tally-cli

uv tool install tally-cli

pip install tally-cli

go install github.com/wharflab/tally@latest

See Installation for WinGet, RubyGems, Docker, and from-source options.

Lint a Dockerfile

Run tally against a single file or an entire directory (recursive):

# Single file
tally lint Dockerfile

# All Dockerfiles in the current repo
tally lint .

tally discovers files matching Dockerfile, Dockerfile.*, *.Dockerfile, Containerfile, and Containerfile.*.To make the same lint command available through Docker, register the Docker CLI plugin:

tally register-docker-plugin
docker lint Dockerfile

Lint a Bake or Compose entrypoint

If your build is defined by Docker Buildx Bake or Docker Compose, pass that file directly:

# Lint Bake targets from the default group
tally lint docker-bake.hcl

# Lint Compose services with build sections
tally lint compose.yaml

Use --target for Bake targets or groups and --service for Compose services:

tally lint docker-bake.hcl --target api
tally lint compose.yaml --service api

See Build invocations for context handling, output attribution, and limitations.

Read the output

By default tally prints human-readable output with source snippets:

WARNING: StageNameCasing - https://docs.docker.com/go/dockerfile/rule/stage-name-casing/
Stage name 'Builder' should be lowercase

Dockerfile:2
────────────────────
   1 │ FROM alpine
>>>2 │ FROM ubuntu AS Builder
   3 │ RUN echo "hello"
────────────────────

Exit code 1 means violations were found. Exit code 0 means clean.

Apply safe fixes

Many rules are auto-fixable. Apply all safe fixes with --fix:

tally lint --fix Dockerfile

--fix modifies files in place. Commit your changes before running it, or review the diff afterward.

Add a config file

Create .tally.toml in your project root to set defaults for your whole team:

.tally.toml

[output]
format = "text"
fail-level = "warning"

[rules]
include = ["buildkit/*", "tally/*", "hadolint/*"]

Config is discovered automatically — no --config flag needed.

Enable context-aware rules

In direct Dockerfile mode, pass --context to unlock rules that check .dockerignore interactions:

tally lint --context . Dockerfile

Bake and Compose entrypoints derive the build context from the selected target or service, so they do not use --context.

Suppress a violation inline

Use an inline directive to suppress a specific rule on the next line:

# tally ignore=StageNameCasing
FROM alpine AS Build

Add a reason to document why:

# tally ignore=DL3007;reason=Pinning at CI level via Renovate
FROM ubuntu:latest

Lint from stdin

Pass - as the filename to read from stdin. Useful in pipelines:

cat Dockerfile | tally lint -

With --fix, the fixed content is written to stdout:

cat Dockerfile | tally lint --fix - > Dockerfile.fixed

Next steps

Configuration

Full reference for .tally.toml, environment variables, and CLI flags.

Build invocations

Lint Dockerfiles through Bake targets and Compose services.

Auto-fix

Learn about safe and unsafe fixes, and per-rule fix modes.

Rules reference

Browse all rules across BuildKit, tally, Hadolint, and ShellCheck namespaces.

CI/CD integration

Add tally to GitHub Actions, GitLab CI, and other pipelines.

​Lint from stdin

​Next steps

Configuration

Build invocations

Auto-fix

Rules reference

CI/CD integration

Lint from stdin

Next steps