What causes "dockerfile line greater than max allowed size of %d" in slimtoolkit/slim?

Split the long RUN line into multiple RUN statements or use a heredic/multiline form (RUN <<EOF).

dockerfile line greater than max allowed size of %d

Error message

dockerfile line greater than max allowed size of %d

What it means

When the Dockerfile parser's bufio.Scanner exceeds bufio.MaxScanTokenSize, handleScannerError converts bufio.ErrTooLong into this descriptive error reporting the actual max line size (MaxScanTokenSize-1). It means a single line in the Dockerfile is too long for the scanner to tokenize.

Source

Thrown at pkg/docker/dockerfile/ast/parser.go:396

		line = d.lineContinuationRegex.ReplaceAllString(line, "")
		return line, false
	}
	return line, true
}

// TODO: remove stripLeftWhitespace after deprecation period. It seems silly
// to preserve whitespace on continuation lines. Why is that done?
func processLine(d *Directive, token []byte, stripLeftWhitespace bool) ([]byte, error) {
	if stripLeftWhitespace {
		token = trimWhitespace(token)
	}
	return trimComments(token), d.possibleParserDirective(string(token))
}

func handleScannerError(err error) error {
	switch err {
	case bufio.ErrTooLong:
		return errors.Errorf("dockerfile line greater than max allowed size of %d", bufio.MaxScanTokenSize-1)
	default:
		return err
	}
}

View on GitHub (pinned to 81940d17fa)

Solutions

Split the long RUN line into multiple RUN statements or use a heredic/multiline form (RUN <<EOF).
Move large payloads out of the Dockerfile — use COPY of a file instead of inline content.
Read large blobs from a build context file or remote URL at build time rather than embedding them on one line.
Pre-process the Dockerfile to wrap long lines with backslash continuations before parsing.

Example fix

// before (Dockerfile)
RUN echo "<64KB+ base64 blob>" > /app/payload
// after (Dockerfile)
COPY payload.b64 /tmp/payload.b64
RUN base64 -d /tmp/payload.b64 > /app/payload && rm /tmp/payload.b64

Defensive patterns

Strategy: validation

Validate before calling

func checkDockerfileLineLength(path string, max int) error {
    f, err := os.Open(path)
    if err != nil { return err }
    defer f.Close()
    sc := bufio.NewScanner(f)
    for line := 1; sc.Scan(); line++ {
        if len(sc.Bytes()) > max {
            return fmt.Errorf("line %d exceeds %d bytes", line, max)
        }
    }
    return sc.Err()
}
// call with max = bufio.MaxScanTokenSize-1 before Parse

Try / catch

layers, err := parser.Parse(ctx, dockerfile)
if err != nil {
    if strings.Contains(err.Error(), "dockerfile line greater than max allowed size") {
        return fmt.Errorf("Dockerfile has an over-long line; split RUN commands or COPY payloads: %w", err)
    }
    return err
}

Prevention

Lint Dockerfiles in CI to enforce a per-line length limit.
Prefer COPY of files over inline echo/base64 blobs in RUN lines.
Use multiline continuation or heredocs for long build commands.

When it happens

Trigger: Calling Parse on a Dockerfile that contains one line longer than 64KB (bufio.MaxScanTokenSize-1 = 65535 bytes), e.g. a huge RUN command or a minified payload embedded on one line.

Common situations: Machine-generated Dockerfiles with base64 blobs or curl one-liners piped into sh, minified assets copied inline, or CI scripts concatenating many commands onto one RUN line.

Related errors

AI-assisted analysis of slimtoolkit/slim@81940d17fa (2026-08-31). Data as JSON: /api/errors/b7804829415595e6. Report an issue: GitHub.