diff --git a/.github/workflows/lint-jsonnet.yml b/.github/workflows/lint.yml
similarity index 53%
rename from .github/workflows/lint-jsonnet.yml
rename to .github/workflows/lint.yml
index ddb508f1efc6b..68e2541dd7836 100644
--- a/.github/workflows/lint-jsonnet.yml
+++ b/.github/workflows/lint.yml
@@ -1,32 +1,49 @@
 ---
-name: lint-jsonnet
+name: lint
 on: [pull_request]
   # pull_request:
   #   paths: "production/**"
 
 jobs:
-  check-mixin:
-    name: Check mixin jsonnet files
+  lint-jsonnet:
+    name: Lint jsonnet files
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
-      - name: setup go
+      - name: Setup Go
         uses: actions/setup-go@v5
         with:
           go-version: '1.24.2'
-      - name: setup jsonnet
+      - name: Setup jsonnet
         run: |
           go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
           go install github.com/google/go-jsonnet/cmd/jsonnetfmt@v0.20.0
           go install github.com/google/go-jsonnet/cmd/jsonnet-lint@v0.20.0
           go install github.com/monitoring-mixins/mixtool/cmd/mixtool@16dc166166d91e93475b86b9355a4faed2400c18
           go install github.com/jsonnet-bundler/jsonnet-bundler/cmd/jb@v0.5.1
-      - name: run linting
+      - name: Run jsonnet linter
         run: make BUILD_IN_CONTAINER=false lint-jsonnet
-      - name: check compiled mixin has been updated
+      - name: Check mixin
         run: |
           make BUILD_IN_CONTAINER=false loki-mixin-check
-      
-
 
+  lint-dockerfile:
+    name: Lint Docker files
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.24.2'
+      - name: Setup dockerfmt
+        run: |
+          go install github.com/reteps/dockerfmt@0.3.4
+      - name: Run dockerfmt
+        run: make BUILD_IN_CONTAINER=false fmt-dockerfile
+      - name: Check drift
+        run: |
+          git diff
+          git diff-index --quiet HEAD --
diff --git a/Makefile b/Makefile
index 5465096cb58e2..af5bb357aebd4 100644
--- a/Makefile
+++ b/Makefile
@@ -698,17 +698,21 @@ lint-jsonnet:
 	exit $$RESULT
 
 fmt-jsonnet:
-	@find . -name 'vendor' -prune -o -name '*.libsonnet' -print -o -name '*.jsonnet' -print | \
-		xargs -n 1 -- jsonnetfmt -i
+	@find . -name 'vendor' -prune -o -name '*.libsonnet' -print -o -name '*.jsonnet' -print | xargs -n 1 -- jsonnetfmt -i
 
-fmt-proto:
+fmt-dockerfile:
 ifeq ($(BUILD_IN_CONTAINER),true)
 	$(run_in_container)
 else
-	echo '$(PROTO_DEFS)' | \
-		xargs -n 1 -- buf format -w
+	@find . -name 'vendor' -prune -o -name 'Dockerfile*' -print | xargs -n 1 -- dockerfmt -w
 endif
 
+fmt-proto:
+ifeq ($(BUILD_IN_CONTAINER),true)
+	$(run_in_container)
+else
+	@echo '$(PROTO_DEFS)' | xargs -n 1 -- buf format -w
+endif
 
 lint-scripts:
     # Ignore https://github.com/koalaman/shellcheck/wiki/SC2312
diff --git a/clients/cmd/docker-driver/Dockerfile b/clients/cmd/docker-driver/Dockerfile
index a839f570b6a25..b0fdc14ae54a5 100644
--- a/clients/cmd/docker-driver/Dockerfile
+++ b/clients/cmd/docker-driver/Dockerfile
@@ -26,4 +26,4 @@ COPY --from=temp /usr/share/zoneinfo /usr/share/zoneinfo
 COPY --from=build /src/loki/clients/cmd/docker-driver/docker-driver /bin/docker-driver
 
 WORKDIR /bin/
-ENTRYPOINT [ "/bin/docker-driver" ]
+ENTRYPOINT ["/bin/docker-driver"]
\ No newline at end of file
diff --git a/clients/cmd/fluent-bit/Dockerfile b/clients/cmd/fluent-bit/Dockerfile
index 7aee41ee37776..ca71ff528d2af 100644
--- a/clients/cmd/fluent-bit/Dockerfile
+++ b/clients/cmd/fluent-bit/Dockerfile
@@ -21,4 +21,4 @@ COPY clients/cmd/fluent-bit/fluent-bit.conf /fluent-bit/etc/fluent-bit.conf
 
 EXPOSE 2020
 
-CMD ["/fluent-bit/bin/fluent-bit", "-e","/fluent-bit/bin/out_grafana_loki.so", "-c", "/fluent-bit/etc/fluent-bit.conf"]
+CMD ["/fluent-bit/bin/fluent-bit", "-e", "/fluent-bit/bin/out_grafana_loki.so", "-c", "/fluent-bit/etc/fluent-bit.conf"]
\ No newline at end of file
diff --git a/clients/cmd/fluentd/Dockerfile b/clients/cmd/fluentd/Dockerfile
index 6cc5c28e30c9e..ff68f61588619 100644
--- a/clients/cmd/fluentd/Dockerfile
+++ b/clients/cmd/fluentd/Dockerfile
@@ -19,4 +19,4 @@ COPY clients/cmd/fluentd/docker/conf/loki.conf /fluentd/etc/loki.conf
 
 USER root
 RUN sed -i '$i''  @include loki.conf' /fluentd/etc/fluent.conf
-USER fluent
+USER fluent
\ No newline at end of file
diff --git a/clients/cmd/logstash/Dockerfile b/clients/cmd/logstash/Dockerfile
index 83c482fc3ccc6..dd94bf70d82c9 100644
--- a/clients/cmd/logstash/Dockerfile
+++ b/clients/cmd/logstash/Dockerfile
@@ -1,10 +1,10 @@
 FROM logstash:8.17.4
 
 USER logstash
-ENV PATH /usr/share/logstash/vendor/jruby/bin:/usr/share/logstash/vendor/bundle/jruby/2.5.0/bin:/usr/share/logstash/jdk/bin:$PATH
-ENV LOGSTASH_PATH /usr/share/logstash
-ENV GEM_PATH /usr/share/logstash/vendor/bundle/jruby/2.5.0
-ENV GEM_HOME /usr/share/logstash/vendor/bundle/jruby/2.5.0
+ENV PATH=/usr/share/logstash/vendor/jruby/bin:/usr/share/logstash/vendor/bundle/jruby/2.5.0/bin:/usr/share/logstash/jdk/bin:$PATH
+ENV LOGSTASH_PATH=/usr/share/logstash
+ENV GEM_PATH=/usr/share/logstash/vendor/bundle/jruby/2.5.0
+ENV GEM_HOME=/usr/share/logstash/vendor/bundle/jruby/2.5.0
 
 RUN gem install bundler:2.3.6
 
@@ -12,14 +12,14 @@ COPY --chown=logstash:logstash ./clients/cmd/logstash/ /home/logstash/
 WORKDIR /home/logstash/
 
 # don't run 'bundle update'. It causes a transitive dependency error
-RUN bundle config set --local path /usr/share/logstash/vendor/bundle && \
-    bundle install && \
-    bundle exec rake vendor && \
-    bundle exec rspec
+RUN bundle config set --local path /usr/share/logstash/vendor/bundle \
+    && bundle install \
+    && bundle exec rake vendor \
+    && bundle exec rspec
 
-RUN cat logstash-output-loki.gemspec | grep s.version | awk '{print $3}' |  cut -d "'" -f 2 > VERSION
+RUN cat logstash-output-loki.gemspec | grep s.version | awk '{print $3}' | cut -d "'" -f 2 >VERSION
 
 RUN gem build logstash-output-loki.gemspec && \
     PLUGIN_VERSION=$(cat VERSION); /usr/share/logstash/bin/logstash-plugin install logstash-output-loki-${PLUGIN_VERSION}.gem
 
-EXPOSE 5044
+EXPOSE 5044
\ No newline at end of file
diff --git a/clients/cmd/promtail/Dockerfile b/clients/cmd/promtail/Dockerfile
index 9d9837aa2da7b..4e4ed7ba420d6 100644
--- a/clients/cmd/promtail/Dockerfile
+++ b/clients/cmd/promtail/Dockerfile
@@ -12,10 +12,10 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true IM
 FROM public.ecr.aws/ubuntu/ubuntu:noble
 # tzdata required for the timestamp stage to work
 # Install dependencies needed at runtime.
-RUN  apt-get update \
- &&  apt-get install -qy libsystemd-dev tzdata ca-certificates \
- &&  rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+RUN apt-get update \
+    && apt-get install -qy libsystemd-dev tzdata ca-certificates \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail
 COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml
 ENTRYPOINT ["/usr/bin/promtail"]
-CMD ["-config.file=/etc/promtail/config.yml"]
+CMD ["-config.file=/etc/promtail/config.yml"]
\ No newline at end of file
diff --git a/clients/cmd/promtail/Dockerfile.arm32 b/clients/cmd/promtail/Dockerfile.arm32
index f1230ae322ae5..c0b72f7b02573 100644
--- a/clients/cmd/promtail/Dockerfile.arm32
+++ b/clients/cmd/promtail/Dockerfile.arm32
@@ -8,9 +8,9 @@ RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true pr
 # Promtail requires debian or ubuntu as the base image to support systemd journal reading
 FROM public.ecr.aws/ubuntu/ubuntu:noble
 # tzdata required for the timestamp stage to work
-RUN apt-get update && \
-  apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \
-  rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+RUN apt-get update \
+    && apt-get install -qy tzdata ca-certificates wget libsystemd-dev \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail
 COPY clients/cmd/promtail/promtail-local-config.yaml /etc/promtail/local-config.yaml
 COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml
@@ -25,4 +25,4 @@ COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml
 RUN sh -c '[ ! -f /lib/ld-linux-armhf.so.3 ] && echo RE-LINKING LD-LINUX-ARMHF.SO.3 && ln -s /lib/ld-linux.so.3 /lib/ld-linux-armhf.so.3'
 
 ENTRYPOINT ["/usr/bin/promtail"]
-CMD ["-config.file=/etc/promtail/config.yml"]
+CMD ["-config.file=/etc/promtail/config.yml"]
\ No newline at end of file
diff --git a/clients/cmd/promtail/Dockerfile.cross b/clients/cmd/promtail/Dockerfile.cross
index 0f515b55ac19b..8b6b1ab84f368 100644
--- a/clients/cmd/promtail/Dockerfile.cross
+++ b/clients/cmd/promtail/Dockerfile.cross
@@ -4,8 +4,8 @@ ARG GO_VERSION=1.24
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f clients/cmd/promtail/Dockerfile .
 FROM golang:${GO_VERSION}-alpine as goenv
-RUN go env GOARCH > /goarch && \
-  go env GOARM > /goarm
+RUN go env GOARCH >/goarch \
+    && go env GOARM >/goarm
 
 FROM --platform=linux/amd64 $BUILD_IMAGE as build
 COPY --from=goenv /goarch /goarm /
@@ -16,11 +16,11 @@ RUN make clean && GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAI
 # Promtail requires debian or ubuntu as the base image to support systemd journal reading
 FROM public.ecr.aws/ubuntu/ubuntu:noble
 # tzdata required for the timestamp stage to work
-RUN apt-get update && \
-  apt-get install -qy tzdata ca-certificates wget libsystemd-dev && \
-  rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+RUN apt-get update \
+    && apt-get install -qy tzdata ca-certificates wget libsystemd-dev \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 COPY --from=build /src/loki/clients/cmd/promtail/promtail /usr/bin/promtail
 COPY clients/cmd/promtail/promtail-local-config.yaml /etc/promtail/local-config.yaml
 COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml
 ENTRYPOINT ["/usr/bin/promtail"]
-CMD ["-config.file=/etc/promtail/config.yml"]
+CMD ["-config.file=/etc/promtail/config.yml"]
\ No newline at end of file
diff --git a/clients/cmd/promtail/Dockerfile.debug b/clients/cmd/promtail/Dockerfile.debug
index d309c0550d4c0..0be65dcc8d6d8 100644
--- a/clients/cmd/promtail/Dockerfile.debug
+++ b/clients/cmd/promtail/Dockerfile.debug
@@ -9,12 +9,12 @@ WORKDIR /src/loki
 RUN make clean && make BUILD_IN_CONTAINER=false PROMTAIL_JOURNAL_ENABLED=true promtail-debug
 
 
-FROM       alpine:3.21.3
-RUN        apk add --update --no-cache ca-certificates tzdata
-COPY       --from=build /src/loki/clients/cmd/promtail/promtail-debug /usr/bin/promtail-debug
-COPY       --from=build /usr/bin/dlv /usr/bin/dlv
-COPY       clients/cmd/promtail/promtail-local-config.yaml /etc/promtail/local-config.yaml
-COPY       clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml
+FROM alpine:3.21.3
+RUN apk add --update --no-cache ca-certificates tzdata
+COPY --from=build /src/loki/clients/cmd/promtail/promtail-debug /usr/bin/promtail-debug
+COPY --from=build /usr/bin/dlv /usr/bin/dlv
+COPY clients/cmd/promtail/promtail-local-config.yaml /etc/promtail/local-config.yaml
+COPY clients/cmd/promtail/promtail-docker-config.yaml /etc/promtail/config.yml
 
 # Expose 40000 for delve
 EXPOSE 40000
@@ -26,4 +26,4 @@ RUN apk add --no-cache libc6-compat
 #   Pass flags to the program you are debugging using --, for example:`
 #   dlv exec ./hello -- server --config conf/config.toml`
 ENTRYPOINT ["/usr/bin/dlv", "--listen=:40000", "--headless=true", "--continue", "--accept-multiclient", "--api-version=2", "exec", "/usr/bin/promtail-debug", "--"]
-CMD ["-config.file=/etc/promtail/config.yml"]
+CMD ["-config.file=/etc/promtail/config.yml"]
\ No newline at end of file
diff --git a/cmd/logcli/Dockerfile b/cmd/logcli/Dockerfile
index e6edb1b944945..2da7a757d38e8 100644
--- a/cmd/logcli/Dockerfile
+++ b/cmd/logcli/Dockerfile
@@ -10,7 +10,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false IMAGE_TAG=${IMAGE_TAG} logcli
 FROM gcr.io/distroless/static:debug
 
 COPY --from=build /src/loki/cmd/logcli/logcli /usr/bin/logcli
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-ENTRYPOINT [ "/usr/bin/logcli" ]
+ENTRYPOINT ["/usr/bin/logcli"]
\ No newline at end of file
diff --git a/cmd/logql-analyzer/Dockerfile b/cmd/logql-analyzer/Dockerfile
index 163635f37a251..c8b6dba3eab3e 100644
--- a/cmd/logql-analyzer/Dockerfile
+++ b/cmd/logql-analyzer/Dockerfile
@@ -8,7 +8,7 @@ RUN make clean && CGO_ENABLED=0 go build ./cmd/logql-analyzer/
 FROM gcr.io/distroless/static:debug
 
 COPY --from=build /src/loki/logql-analyzer /usr/bin/logql-analyzer
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-ENTRYPOINT [ "/usr/bin/logql-analyzer" ]
+ENTRYPOINT ["/usr/bin/logql-analyzer"]
\ No newline at end of file
diff --git a/cmd/loki-canary-boringcrypto/Dockerfile b/cmd/loki-canary-boringcrypto/Dockerfile
index 08df7d7726e66..e18c807f6029a 100644
--- a/cmd/loki-canary-boringcrypto/Dockerfile
+++ b/cmd/loki-canary-boringcrypto/Dockerfile
@@ -4,11 +4,11 @@ ARG IMAGE_TAG
 
 COPY . /src/loki
 WORKDIR /src/loki
-RUN go env GOARCH > /goarch
+RUN go env GOARCH >/goarch
 RUN make clean && make GOARCH=$(cat /goarch) BUILD_IN_CONTAINER=true GOEXPERIMENT=boringcrypto IMAGE_TAG=${IMAGE_TAG} loki-canary-boringcrypto
 
 FROM gcr.io/distroless/base-nossl:debug
 COPY --from=build /src/loki/cmd/loki-canary-boringcrypto/loki-canary-boringcrypto /usr/bin/loki-canary
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
-ENTRYPOINT [ "/usr/bin/loki-canary" ]
+ENTRYPOINT ["/usr/bin/loki-canary"]
\ No newline at end of file
diff --git a/cmd/loki-canary/Dockerfile b/cmd/loki-canary/Dockerfile
index bbf9d12d1052c..213d23cbcfc65 100644
--- a/cmd/loki-canary/Dockerfile
+++ b/cmd/loki-canary/Dockerfile
@@ -9,6 +9,6 @@ RUN make clean && make BUILD_IN_CONTAINER=false IMAGE_TAG=${IMAGE_TAG} loki-cana
 FROM gcr.io/distroless/static:debug
 
 COPY --from=build /src/loki/cmd/loki-canary/loki-canary /usr/bin/loki-canary
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
-ENTRYPOINT [ "/usr/bin/loki-canary" ]
+ENTRYPOINT ["/usr/bin/loki-canary"]
\ No newline at end of file
diff --git a/cmd/loki-canary/Dockerfile.cross b/cmd/loki-canary/Dockerfile.cross
index ea73c62ed7f69..7a88e432c131a 100644
--- a/cmd/loki-canary/Dockerfile.cross
+++ b/cmd/loki-canary/Dockerfile.cross
@@ -4,8 +4,8 @@ ARG GO_VERSION=1.24
 # This file is intended to be called from the root like so:
 # docker build -t grafana/promtail -f cmd/promtail/Dockerfile .
 FROM golang:${GO_VERSION} AS goenv
-RUN go env GOARCH > /goarch && \
-  go env GOARM > /goarm
+RUN go env GOARCH >/goarch \
+    && go env GOARM >/goarm
 
 FROM $BUILD_IMAGE as build
 COPY --from=goenv /goarch /goarm /
@@ -15,6 +15,6 @@ RUN make clean && GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAI
 
 FROM gcr.io/distroless/static:debug
 COPY --from=build /src/loki/cmd/loki-canary/loki-canary /usr/bin/loki-canary
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
-ENTRYPOINT [ "/usr/bin/loki-canary" ]
+ENTRYPOINT ["/usr/bin/loki-canary"]
\ No newline at end of file
diff --git a/cmd/loki/Dockerfile b/cmd/loki/Dockerfile
index 09ad0190bae01..da5e0fab8e96f 100644
--- a/cmd/loki/Dockerfile
+++ b/cmd/loki/Dockerfile
@@ -21,15 +21,15 @@ FROM gcr.io/distroless/static:debug
 COPY --from=build /src/loki/cmd/loki/loki /usr/bin/loki
 COPY cmd/loki/loki-docker-config.yaml /etc/loki/local-config.yaml
 
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 
-RUN addgroup -g 10001 -S loki && \
-    adduser -u 10001 -S loki -G loki
-RUN mkdir -p /loki/rules && \
-    mkdir -p /loki/rules-temp && \
-    chown -R loki:loki /etc/loki /loki && \
-    ln -s /busybox/sh /bin/sh
+RUN addgroup -g 10001 -S loki \
+    && adduser -u 10001 -S loki -G loki
+RUN mkdir -p /loki/rules \
+    && mkdir -p /loki/rules-temp \
+    && chown -R loki:loki /etc/loki /loki \
+    && ln -s /busybox/sh /bin/sh
 USER 10001
 EXPOSE 3100
-ENTRYPOINT [ "/usr/bin/loki" ]
-CMD ["-config.file=/etc/loki/local-config.yaml"]
+ENTRYPOINT ["/usr/bin/loki"]
+CMD [ "-config.file=/etc/loki/local-config.yaml" ]
diff --git a/cmd/loki/Dockerfile.cross b/cmd/loki/Dockerfile.cross
index e292d0b594ece..5f8c27c0aae04 100644
--- a/cmd/loki/Dockerfile.cross
+++ b/cmd/loki/Dockerfile.cross
@@ -3,8 +3,8 @@ ARG GO_VERSION=1.24
 # This file is intended to be called from the root like so:
 # docker build -t grafana/loki -f cmd/loki/Dockerfile .
 FROM golang:${GO_VERSION} AS goenv
-RUN go env GOARCH > /goarch && \
-    go env GOARM > /goarm
+RUN go env GOARCH >/goarch \
+    && go env GOARM >/goarm
 
 COPY . /src/loki
 WORKDIR /src/loki
@@ -15,15 +15,15 @@ FROM gcr.io/distroless/static:debug
 COPY --from=goenv /src/loki/cmd/loki/loki /usr/bin/loki
 COPY cmd/loki/loki-local-config.yaml /etc/loki/local-config.yaml
 
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 
-RUN addgroup -g 10001 -S loki && \
-    adduser -u 10001 -S loki -G loki
-RUN mkdir -p /loki && \
-    chown -R loki:loki /etc/loki /loki && \
-    ln -s /busybox/sh /bin/sh
+RUN addgroup -g 10001 -S loki \
+    && adduser -u 10001 -S loki -G loki
+RUN mkdir -p /loki \
+    && chown -R loki:loki /etc/loki /loki \
+    && ln -s /busybox/sh /bin/sh
 
 USER 10001
 EXPOSE 3100
-ENTRYPOINT [ "/usr/bin/loki" ]
-CMD ["-config.file=/etc/loki/local-config.yaml"]
+ENTRYPOINT ["/usr/bin/loki"]
+CMD ["-config.file=/etc/loki/local-config.yaml"]
\ No newline at end of file
diff --git a/cmd/loki/Dockerfile.debug b/cmd/loki/Dockerfile.debug
index d5057951d001c..55f5cdde69f9e 100644
--- a/cmd/loki/Dockerfile.debug
+++ b/cmd/loki/Dockerfile.debug
@@ -5,32 +5,32 @@ ARG GO_VERSION=1.24
 # docker build -t grafana/loki -f cmd/loki/Dockerfile.debug .
 
 FROM golang:${GO_VERSION} as goenv
-RUN go env GOARCH > /goarch && \
-    go env GOARM > /goarm && \
-    go install github.com/go-delve/delve/cmd/dlv@latest
+RUN go env GOARCH >/goarch \
+    && go env GOARM >/goarm \
+    && go install github.com/go-delve/delve/cmd/dlv@latest
 
 FROM $BUILD_IMAGE as build
 COPY --from=goenv /goarch /goarm /
 COPY . /src/loki
 WORKDIR /src/loki
-RUN make clean && \
-    GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAINER=false loki-debug
+RUN make clean \
+    && GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAINER=false loki-debug
 
-FROM       gcr.io/distroless/base-nossl:debug
-COPY       --from=build /src/loki/cmd/loki/loki-debug /usr/bin/loki-debug
-COPY       --from=goenv /go/bin/dlv /usr/bin/dlv
-COPY       cmd/loki/loki-docker-config.yaml /etc/loki/local-config.yaml
-EXPOSE     3100
+FROM gcr.io/distroless/base-nossl:debug
+COPY --from=build /src/loki/cmd/loki/loki-debug /usr/bin/loki-debug
+COPY --from=goenv /go/bin/dlv /usr/bin/dlv
+COPY cmd/loki/loki-docker-config.yaml /etc/loki/local-config.yaml
+EXPOSE 3100
 
 # Expose 40000 for delve
 EXPOSE 40000
 
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
 
 # Run delve, ending with -- because we pass params via kubernetes, per the docs:
 #   Pass flags to the program you are debugging using --, for example:`
 #   dlv exec ./hello -- server --config conf/config.toml`
-ENTRYPOINT ["/usr/bin/dlv", "--listen=:40000", "--headless=true", "--log", "--continue", "--accept-multiclient" , "--api-version=2", "exec", "/usr/bin/loki-debug", "--"]
-CMD        ["-config.file=/etc/loki/local-config.yaml"]
+ENTRYPOINT ["/usr/bin/dlv", "--listen=:40000", "--headless=true", "--log", "--continue", "--accept-multiclient", "--api-version=2", "exec", "/usr/bin/loki-debug", "--"]
+CMD ["-config.file=/etc/loki/local-config.yaml"]
\ No newline at end of file
diff --git a/cmd/migrate/Dockerfile b/cmd/migrate/Dockerfile
index 2a6dfecfc8d35..a21f21996ac78 100644
--- a/cmd/migrate/Dockerfile
+++ b/cmd/migrate/Dockerfile
@@ -7,6 +7,6 @@ RUN make clean && make BUILD_IN_CONTAINER=false migrate
 FROM gcr.io/distroless/static:debug
 
 COPY --from=build /src/loki/cmd/migrate/migrate /usr/bin/migrate
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
-ENTRYPOINT [ "/busybox/tail", "-f", "/dev/null" ]
+ENTRYPOINT ["/busybox/tail", "-f", "/dev/null"]
\ No newline at end of file
diff --git a/cmd/querytee/Dockerfile b/cmd/querytee/Dockerfile
index 963d122e072f2..3a3bb99a32770 100644
--- a/cmd/querytee/Dockerfile
+++ b/cmd/querytee/Dockerfile
@@ -9,7 +9,7 @@ RUN make clean && make BUILD_IN_CONTAINER=false IMAGE_TAG=${IMAGE_TAG} loki-quer
 FROM gcr.io/distroless/static:debug
 COPY --from=build /src/loki/cmd/querytee/querytee /usr/bin/querytee
 
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
 
-ENTRYPOINT [ "/usr/bin/querytee" ]
+ENTRYPOINT ["/usr/bin/querytee"]
\ No newline at end of file
diff --git a/cmd/querytee/Dockerfile.cross b/cmd/querytee/Dockerfile.cross
index 9782b9a796f35..1bd4df640526f 100644
--- a/cmd/querytee/Dockerfile.cross
+++ b/cmd/querytee/Dockerfile.cross
@@ -4,8 +4,8 @@ ARG BUILD_IMAGE=grafana/loki-build-image:0.34.0
 # docker build -t grafana/promtail -f cmd/promtail/Dockerfile .
 ARG GO_VERSION=1.24
 FROM golang:${GO_VERSION} AS goenv
-RUN go env GOARCH > /goarch && \
-  go env GOARM > /goarm
+RUN go env GOARCH >/goarch \
+    && go env GOARM >/goarm
 
 FROM $BUILD_IMAGE as build
 COPY --from=goenv /goarch /goarm /
@@ -15,6 +15,6 @@ RUN make clean && GOARCH=$(cat /goarch) GOARM=$(cat /goarm) make BUILD_IN_CONTAI
 
 FROM gcr.io/distroless/static:debug
 COPY --from=build /src/loki/cmd/querytee/querytee /usr/bin/querytee
-SHELL [ "/busybox/sh", "-c" ]
+SHELL ["/busybox/sh", "-c"]
 RUN ln -s /busybox/sh /bin/sh
-ENTRYPOINT [ "/usr/bin/querytee" ]
+ENTRYPOINT ["/usr/bin/querytee"]
\ No newline at end of file
diff --git a/examples/promtail-heroku/Dockerfile b/examples/promtail-heroku/Dockerfile
index 1e9085fd58ec4..891a7da2f5b96 100644
--- a/examples/promtail-heroku/Dockerfile
+++ b/examples/promtail-heroku/Dockerfile
@@ -1,6 +1,6 @@
-from grafana/promtail:main-c9ef062
+FROM grafana/promtail:main-c9ef062
 
-# Copy the config.yml file we created in the step above, inside the container itself. This simplifies the 
+# Copy the config.yml file we created in the step above, inside the container itself. This simplifies the
 # configuration of the Promtail instance.
 COPY config.yml /etc/promtail/config.yml
 
diff --git a/loki-build-image/Dockerfile b/loki-build-image/Dockerfile
index 817519a437972..1fcf9da5f8614 100644
--- a/loki-build-image/Dockerfile
+++ b/loki-build-image/Dockerfile
@@ -11,39 +11,39 @@ ARG GOLANG_BASE_IMAGE=golang:${GO_VERSION}-bullseye
 FROM ${GOLANG_BASE_IMAGE} AS helm
 ARG TARGETARCH
 ARG HELM_VER="v3.2.3"
-RUN curl -L "https://get.helm.sh/helm-${HELM_VER}-linux-$TARGETARCH.tar.gz" | tar zx && \
-    install -t /usr/local/bin "linux-$TARGETARCH/helm"
-RUN BIN=$([ "$TARGETARCH" = "arm64" ] && echo "helm-docs_Linux_arm64" || echo "helm-docs_Linux_x86_64") &&  \
-    curl -L "https://github.com/norwoodj/helm-docs/releases/download/v1.11.2/$BIN.tar.gz" | tar zx && \
-    install -t /usr/local/bin helm-docs
+RUN curl -L "https://get.helm.sh/helm-${HELM_VER}-linux-$TARGETARCH.tar.gz" | tar zx \
+    && install -t /usr/local/bin "linux-$TARGETARCH/helm"
+RUN BIN=$([ "$TARGETARCH" = "arm64" ] && echo "helm-docs_Linux_arm64" || echo "helm-docs_Linux_x86_64") \
+    && curl -L "https://github.com/norwoodj/helm-docs/releases/download/v1.11.2/$BIN.tar.gz" | tar zx \
+    && install -t /usr/local/bin helm-docs
 
 FROM alpine:3.21.3 AS lychee
 ARG TARGETARCH
 ARG LYCHEE_VER="0.7.0"
-RUN apk add --no-cache curl && \
-    curl -L -o /tmp/lychee-$LYCHEE_VER.tgz https://github.com/lycheeverse/lychee/releases/download/${LYCHEE_VER}/lychee-${LYCHEE_VER}-x86_64-unknown-linux-gnu.tar.gz && \
-    tar -xz -C /tmp -f /tmp/lychee-$LYCHEE_VER.tgz && \
-    mv /tmp/lychee /usr/bin/lychee && \
-    rm -rf "/tmp/linux-$TARGETARCH" /tmp/lychee-$LYCHEE_VER.tgz
+RUN apk add --no-cache curl \
+    && curl -L -o /tmp/lychee-$LYCHEE_VER.tgz https://github.com/lycheeverse/lychee/releases/download/${LYCHEE_VER}/lychee-${LYCHEE_VER}-x86_64-unknown-linux-gnu.tar.gz \
+    && tar -xz -C /tmp -f /tmp/lychee-$LYCHEE_VER.tgz \
+    && mv /tmp/lychee /usr/bin/lychee \
+    && rm -rf "/tmp/linux-$TARGETARCH" /tmp/lychee-$LYCHEE_VER.tgz
 
 FROM alpine:3.21.3 AS golangci
-RUN apk add --no-cache curl && \
-    cd / && \
-    curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.64.5
+RUN apk add --no-cache curl \
+    && cd / \
+    && curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.64.5
 
 FROM alpine:3.21.3 AS buf
 ARG TARGETOS
-RUN apk add --no-cache curl && \
-    curl -sSL "https://github.com/bufbuild/buf/releases/download/v1.4.0/buf-$TARGETOS-$(uname -m)" -o "/usr/bin/buf" && \
-    chmod +x "/usr/bin/buf"
+RUN apk add --no-cache curl \
+    && curl -sSL "https://github.com/bufbuild/buf/releases/download/v1.4.0/buf-$TARGETOS-$(uname -m)" -o "/usr/bin/buf" \
+    && chmod +x "/usr/bin/buf"
 
 FROM alpine:3.21.3 AS docker
 RUN apk add --no-cache docker-cli docker-cli-buildx
 
 FROM ${GOLANG_BASE_IMAGE} AS drone
 ARG TARGETARCH
-RUN curl -L "https://github.com/drone/drone-cli/releases/download/v1.7.0/drone_linux_$TARGETARCH".tar.gz | tar zx && \
-    install -t /usr/local/bin drone
+RUN curl -L "https://github.com/drone/drone-cli/releases/download/v1.7.0/drone_linux_$TARGETARCH".tar.gz | tar zx \
+    && install -t /usr/local/bin drone
 
 # Install faillint used to lint go imports in CI.
 # This collisions with the version of go tools used in the base image, thus we install it in its own image and copy it over.
@@ -79,23 +79,22 @@ RUN GO111MODULE=on go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
 FROM aquasec/trivy AS trivy
 
 FROM ${GOLANG_BASE_IMAGE}
-RUN apt-get update && \
-    apt-get install -qy \
-    musl gnupg ragel \
-    file zip unzip jq gettext\
-    protobuf-compiler libprotobuf-dev \
-    libsystemd-dev jq && \
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+RUN apt-get update \
+    && apt-get install -qy \
+        musl gnupg ragel \
+        file zip unzip jq gettext protobuf-compiler libprotobuf-dev \
+        libsystemd-dev jq \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 # Install dependencies to cross build Promtail to ARM and ARM64.
-RUN dpkg --add-architecture armhf && \
-    dpkg --add-architecture arm64 && \
-    apt-get update && \
-    apt-get install -y --no-install-recommends \
-    pkg-config \
-    gcc-aarch64-linux-gnu libc6-dev-arm64-cross libsystemd-dev:arm64 \
-    gcc-arm-linux-gnueabihf libc6-dev-armhf-cross libsystemd-dev:armhf && \
-    rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+RUN dpkg --add-architecture armhf \
+    && dpkg --add-architecture arm64 \
+    && apt-get update \
+    && apt-get install -y --no-install-recommends \
+        pkg-config \
+        gcc-aarch64-linux-gnu libc6-dev-arm64-cross libsystemd-dev:arm64 \
+        gcc-arm-linux-gnueabihf libc6-dev-armhf-cross libsystemd-dev:armhf \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
 
 COPY --from=docker /usr/bin/docker /usr/bin/docker
 COPY --from=docker /usr/libexec/docker/cli-plugins/docker-buildx /usr/libexec/docker/cli-plugins/docker-buildx
@@ -132,4 +131,4 @@ ENV GOTEST="gotestsum --format testname --"
 
 COPY build.sh /
 RUN chmod +x /build.sh
-ENTRYPOINT ["/build.sh"]
+ENTRYPOINT ["/build.sh"]
\ No newline at end of file
diff --git a/operator/Dockerfile b/operator/Dockerfile
index 7c62810556ea3..0fcc208c9c868 100644
--- a/operator/Dockerfile
+++ b/operator/Dockerfile
@@ -24,4 +24,4 @@ WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532
 
-ENTRYPOINT ["/manager"]
+ENTRYPOINT ["/manager"]
\ No newline at end of file
diff --git a/operator/Dockerfile.cross b/operator/Dockerfile.cross
index 792f93d67ab3c..4bec02bb11cd9 100644
--- a/operator/Dockerfile.cross
+++ b/operator/Dockerfile.cross
@@ -1,8 +1,8 @@
 ARG BUILD_IMAGE=grafana/loki-build-image:0.33.6
 
 FROM golang:1.23.6-alpine as goenv
-RUN go env GOARCH > /goarch && \
-  go env GOARM > /goarm
+RUN go env GOARCH >/goarch \
+    && go env GOARM >/goarm
 
 FROM --platform=linux/amd64 $BUILD_IMAGE as builder
 COPY --from=goenv /goarch /goarm /
@@ -29,4 +29,4 @@ WORKDIR /
 COPY --from=builder /workspace/manager .
 USER 65532:65532
 
-ENTRYPOINT ["/manager"]
+ENTRYPOINT ["/manager"]
\ No newline at end of file
diff --git a/production/helm/loki/src/helm-test/Dockerfile b/production/helm/loki/src/helm-test/Dockerfile
index c831329eda321..981db6037cecd 100644
--- a/production/helm/loki/src/helm-test/Dockerfile
+++ b/production/helm/loki/src/helm-test/Dockerfile
@@ -10,4 +10,4 @@ RUN make clean && make BUILD_IN_CONTAINER=false helm-test
 
 FROM gcr.io/distroless/static:debug
 COPY --from=build /src/loki/production/helm/loki/src/helm-test/helm-test /usr/bin/helm-test
-ENTRYPOINT [ "/usr/bin/helm-test" ]
+ENTRYPOINT ["/usr/bin/helm-test"]
\ No newline at end of file
diff --git a/tools/bigtable-backup/Dockerfile b/tools/bigtable-backup/Dockerfile
index 0368a103035c0..4dc3e466d8d99 100644
--- a/tools/bigtable-backup/Dockerfile
+++ b/tools/bigtable-backup/Dockerfile
@@ -1,7 +1,7 @@
-FROM       grafana/bigtable-backup:master-18e7589
-RUN        apk add --update --no-cache python3 python3-dev git \
-            && pip3 install --no-cache-dir --upgrade pip
-COPY       bigtable-backup.py bigtable-backup.py
-COPY       requirements.txt requirements.txt
-RUN        pip3 install -r requirements.txt
-ENTRYPOINT ["usr/bin/python3", "bigtable-backup.py"]
+FROM grafana/bigtable-backup:master-18e7589
+RUN apk add --update --no-cache python3 python3-dev git \
+    && pip3 install --no-cache-dir --upgrade pip
+COPY bigtable-backup.py bigtable-backup.py
+COPY requirements.txt requirements.txt
+RUN pip3 install -r requirements.txt
+ENTRYPOINT ["usr/bin/python3", "bigtable-backup.py"]
\ No newline at end of file
diff --git a/tools/lambda-promtail/Dockerfile b/tools/lambda-promtail/Dockerfile
index d59fdf59cfb8c..4a9eb56b824a6 100644
--- a/tools/lambda-promtail/Dockerfile
+++ b/tools/lambda-promtail/Dockerfile
@@ -5,8 +5,8 @@ WORKDIR /src/lambda-promtail
 
 RUN go version
 
-RUN apk update && apk upgrade && \
-    apk add --no-cache bash git
+RUN apk update && apk upgrade \
+    && apk add --no-cache bash git
 RUN go version
 
 RUN ls -al
@@ -16,4 +16,4 @@ RUN go build -o /main -tags lambda.norpc -ldflags="-s -w" lambda-promtail/*.go
 FROM public.ecr.aws/lambda/provided:al2
 RUN yum -y update openssl-libs ca-certificates krb5-libs
 COPY --from=build-image /main /main
-ENTRYPOINT [ "/main" ]
+ENTRYPOINT ["/main"]
\ No newline at end of file