Skip to main content
STOPSIGNAL should use canonical signal names for clarity and consistency.
PropertyValue
SeverityInfo
CategoryStyle
DefaultEnabled
Auto-fixYes (safe)

​
Description

STOPSIGNAL accepts signal names in many formats: numeric values (9, 15), names without the SIG prefix (TERM, QUIT), quoted strings ("SIGINT"), mixed case (sigterm), and non-standard real-time signal names (RTMIN+3). While Docker accepts all of these, canonical signal names are easier to read and easier to connect to upstream daemon documentation. This rule suggests the canonical form:
  • Ordinary signals: SIGTERM, SIGINT, SIGQUIT, SIGKILL, etc.
  • Real-time signals: SIGRTMIN+3
Environment variable references (e.g. STOPSIGNAL $MY_SIGNAL) are skipped because the signal value cannot be determined statically. Windows stages are skipped because STOPSIGNAL has no effect on Windows containers — POSIX signals are not delivered to Windows processes.

​
References

​
Examples

​
Bad

FROM alpine:3.20
# Numeric signal value
STOPSIGNAL 15
CMD ["/app"]

FROM nginx:1.27
# Missing SIG prefix
STOPSIGNAL QUIT
CMD ["nginx", "-g", "daemon off;"]

FROM postgres:16
# Quoted signal name
STOPSIGNAL "SIGINT"
CMD ["postgres"]

FROM fedora:40
# Non-canonical real-time signal
STOPSIGNAL RTMIN+3
CMD ["/sbin/init"]

​
Good

FROM alpine:3.20
STOPSIGNAL SIGTERM
CMD ["/app"]

FROM nginx:1.27
STOPSIGNAL SIGQUIT
CMD ["nginx", "-g", "daemon off;"]

FROM postgres:16
STOPSIGNAL SIGINT
CMD ["postgres"]

FROM fedora:40
STOPSIGNAL SIGRTMIN+3
CMD ["/sbin/init"]

​
Auto-fix

The fix replaces the non-canonical signal token with its canonical form: 
tally lint --fix Dockerfile
The fix uses FixSafe safety because the canonical form is semantically identical to the original — Docker normalizes signal names internally, so no runtime behavior changes.

​
Configuration

[rules.tally.prefer-canonical-stopsignal]
severity = "info"  # Options: "off", "error", "warning", "info", "style"