README.md

@@ -831,7 +831,9 @@ and may be invoked directly. The provided entrypoints are:
     copies the repository into the digest-pinned
     `golangci/golangci-lint` image and runs
     `golangci-lint config verify` and `golangci-lint run` as build
-    steps, so a successful build is a clean lint. The linter is never
+    steps, so a successful build is a clean lint. That exit status is
+    all it produces, so it runs with `--output=type=cacheonly` and
+    writes no image; a run leaves only build cache. The linter is never
     run on the host, which makes a working `docker` the one
     prerequisite for linting — and therefore for `make check` and the
     pre-commit hook. Offline machines: the gate steps themselves make

TODO.md

@@ -29,6 +29,9 @@
 
 # Completed Steps
 
+- `script/lint` writes no image, so a run no longer leaves an untagged
+  one behind (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/48)
+
 - tests cover a missing database, `scan` keeping stdout empty, its skip
   warning, the `report` and `trees` summary lines, and every subcommand
   going through `runE` (2026-10-04, https://git.eeqj.de/sneak/sfdupes/issues/16)

script/lint

@@ -14,6 +14,10 @@
 # 0 in well under a second having run no linter. The PID is in the value
 # as well as the epoch because two lint runs land inside the same second
 # easily, and `date +%s` alone would cache the second one.
+#
+# The result is the build's exit status and the image is never used, so
+# --output=type=cacheonly writes none. Without it every run spends
+# seconds exporting an image and leaves it behind untagged.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
@@ -22,6 +26,7 @@ main() {
     cd "$ROOT"
     docker build \
         --build-arg CHECK_EPOCH="$(date +%s)-$$" \
+        --output=type=cacheonly \
         -f Dockerfile.lint \
         .
 }