LABEL instructions in the same stage are easier to review when they
are written as a single multi-line LABEL block.
Description
Modern Docker no longer needs separateLABEL instructions to keep image
layers small, so scattered LABELs serve no build purpose. Grouping them into
one multi-line block keeps related image metadata together, makes diffs easier
to read, and reduces the chance that two unrelated edits land on different
lines of the same logical metadata block.
The rule reports when a stage has at least min-labels label key/value pairs
spread across two or more adjacent LABEL instructions. Two LABEL
instructions are considered adjacent only when no other Dockerfile
instruction (such as ARG, ENV, or RUN) and no comment line appears
between them. Comments are treated as deliberate section breaks and never
crossed by the auto-fix.
This rule does not reorder labels. Stable ordering is left to a separate rule.
Auto-fix
The fix replaces the firstLABEL instruction in the run with one multi-line
LABEL containing every pair from the run, and deletes the remaining LABEL
instructions in the run. Pairs are emitted in source order so that Docker’s
“last value wins” rule still produces the same effective image label map.
The fix is suppressed when:
- a key in the run is dynamic (for example
LABEL "$PREFIX.name"=...) - a pair uses the legacy
LABEL key valueform - the run contains a duplicate key (let
tally/labels/no-duplicate-keysrewrite the duplicate first)
tally/newline-per-chained-call produces
for split LABELs, so the two rules agree on a single canonical form and a
re-lint after fixing is clean.
Examples
Bad
Good
Configuration
Related Rules
tally/labels/no-duplicate-keys— runs first when a duplicate key would otherwise be merged.tally/newline-per-chained-call— splits multi-pairLABELinstructions onto separate continuation lines; together with this rule it produces a canonical multi-lineLABELshape.tally/labels/no-buildx-git-overlaptally/labels/no-stale-base-digesttally/labels/valid-key