tally/invalid-json-form

​

Description

CMD ["executable", "param1", "param2"]

• CMD [bash, -lc, "echo hi"] is treated as the shell command [bash, -lc, "echo hi"] rather than exec-form ["bash", "-lc", "echo hi"].
• SHELL [/bin/bash, -c] causes a build error because SHELL requires valid JSON.

​

Related Rules

• buildkit/JSONArgsRecommended — recommends JSON exec-form for CMD and ENTRYPOINT. Because BuildKit falls back to shell-form when JSON is invalid, JSONArgsRecommended (info severity) also fires on the same instruction. tally’s supersession processor automatically suppresses the lower-severity JSONArgsRecommended violation when this rule (error severity) is present at the same line — so users see only the more actionable invalid-json-form error.

​

References

• Dockerfile reference — CMD
• Dockerfile reference — ENTRYPOINT
• Dockerfile reference — SHELL

​

Examples

​

Bad

FROM alpine:3.20

# Unquoted strings -- treated as shell form
CMD [bash, -lc, "echo hello"]

# Single quotes -- not valid JSON
ENTRYPOINT ['/usr/bin/app', '--serve']

# Trailing comma -- invalid JSON
RUN ["echo", "hello",]

​

Good

FROM alpine:3.20

CMD ["bash", "-lc", "echo hello"]
ENTRYPOINT ["/usr/bin/app", "--serve"]
RUN ["echo", "hello"]

​

Configuration

[rules.tally.invalid-json-form]
severity = "error"  # Options: "off", "error", "warning", "info", "style"