diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -184,6 +184,8 @@
 | [DL3024](https://github.com/hadolint/hadolint/wiki/DL3024)   | `FROM` aliases (stage names) must be unique                                                                                                         |
 | [DL3025](https://github.com/hadolint/hadolint/wiki/DL3025)   | Use arguments JSON notation for CMD and ENTRYPOINT arguments                                                                                        |
 | [DL3026](https://github.com/hadolint/hadolint/wiki/DL3026)   | Use only an allowed registry in the FROM image                                                                                                      |
+| [DL3027](https://github.com/hadolint/hadolint/wiki/DL3027)   | Do not use `apt` as it is meant to be a end-user tool, use `apt-get` or `apt-cache` instead                                                         |
+| [DL3028](https://github.com/hadolint/hadolint/wiki/DL3028)   | Pin versions in gem install. Instead of `gem install <gem>` use `gem install <gem>:<version>`                                                       |
 | [DL4000](https://github.com/hadolint/hadolint/wiki/DL4000)   | MAINTAINER is deprecated.                                                                                                                           |
 | [DL4001](https://github.com/hadolint/hadolint/wiki/DL4001)   | Either use Wget or Curl but not both.                                                                                                               |
 | [DL4003](https://github.com/hadolint/hadolint/wiki/DL4003)   | Multiple `CMD` instructions found.                                                                                                                  |
diff --git a/hadolint.cabal b/hadolint.cabal
--- a/hadolint.cabal
+++ b/hadolint.cabal
@@ -1,13 +1,13 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.31.1.
+-- This file has been generated from package.yaml by hpack version 0.31.2.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 3c30762ee08b64a04b23f367726e5419091b765813f6e17bfff3ff8095ec57ca
+-- hash: ad3384cc7d2f156af93ef1a394947b12be4d8ca81081af3f44fe90c9c2e0bf94
 
 name:           hadolint
-version:        1.16.3
+version:        1.17.0
 synopsis:       Dockerfile Linter JavaScript API
 description:    A smarter Dockerfile linter that helps you build best practice Docker images.
 category:       Development
diff --git a/src/Hadolint/Rules.hs b/src/Hadolint/Rules.hs
--- a/src/Hadolint/Rules.hs
+++ b/src/Hadolint/Rules.hs
@@ -202,6 +202,8 @@
     , useShell
     , useJsonArgs
     , usePipefail
+    , noApt
+    , gemVersionPinned
     ]
 
 optionalRules :: RulesConfig -> [Rule]
@@ -757,6 +759,16 @@
     check (Entrypoint (ArgumentsText _)) = False
     check _ = True
 
+noApt :: Rule
+noApt = instructionRule code severity message check
+  where
+    code = "DL3027"
+    severity = WarningC
+    message =
+        "Do not use apt as it is meant to be a end-user tool, use apt-get or apt-cache instead"
+    check (Run args) = argumentsRule (not . usingProgram "apt") args
+    check _ = True
+
 usePipefail :: Rule
 usePipefail = instructionRuleState code severity message check False
   where
@@ -800,3 +812,25 @@
     isAllowed Image {registryName = Nothing, imageName} =
         imageName == "scratch" ||
         Set.member "docker.io" allowed || Set.member "hub.docker.com" allowed
+
+gemVersionPinned :: Rule
+gemVersionPinned = instructionRule code severity message check
+  where
+    code = "DL3028"
+    severity = WarningC
+    message =
+        "Pin versions in gem install. Instead of `gem install <gem>` use `gem \
+        \install <gem>:<version>`"
+    check (Run args) = argumentsRule (all versionFixed . gems) args
+    check _ = True
+    versionFixed package = ":" `isInfixOf` package
+
+gems :: Shell.ParsedShell -> [String]
+gems args =
+    [ arg
+    | cmd <- Shell.findCommands args
+    , Shell.cmdHasArgs "gem" ["install", "i"] cmd
+    , arg <- Shell.getArgsNoFlags cmd
+    , arg /= "install"
+    , arg /= "i"
+    ]
diff --git a/test/Spec.hs b/test/Spec.hs
--- a/test/Spec.hs
+++ b/test/Spec.hs
@@ -152,8 +152,38 @@
                 ruleCatchesNot invalidCmd "RUN apt-get install ssh"
                 onBuildRuleCatchesNot invalidCmd "RUN apt-get install ssh"
         --
+        describe "gem" $
+          describe "version pinning" $ do
+            describe "i" $ do
+              it "unpinned" $ do
+                ruleCatches gemVersionPinned "RUN gem i bundler"
+                onBuildRuleCatches gemVersionPinned "RUN gem i bundler"
+              it "pinned" $ do
+                ruleCatchesNot gemVersionPinned "RUN gem i bundler:1"
+                onBuildRuleCatchesNot gemVersionPinned "RUN gem i bundler:1"
+              it "multi" $ do
+                ruleCatches gemVersionPinned "RUN gem i bunlder:1 nokogiri"
+                onBuildRuleCatches gemVersionPinned "RUN gem i bunlder:1 nokogiri"
+                ruleCatchesNot gemVersionPinned "RUN gem i bunlder:1 nokogirii:1"
+                onBuildRuleCatchesNot gemVersionPinned "RUN gem i bunlder:1 nokogiri:1"
+            describe "install" $ do
+              it "unpinned" $ do
+                ruleCatches gemVersionPinned "RUN gem install bundler"
+                onBuildRuleCatches gemVersionPinned "RUN gem install bundler"
+              it "pinned" $ do
+                ruleCatchesNot gemVersionPinned "RUN gem install bundler:1"
+                onBuildRuleCatchesNot gemVersionPinned "RUN gem install bundler:1"
+        --
         describe "apt-get rules" $ do
-            it "apt upgrade" $ do
+            it "apt" $
+                let dockerFile =
+                        [ "FROM ubuntu"
+                        , "RUN apt install python"
+                        ]
+                in do
+                  ruleCatches noApt $ Text.unlines dockerFile
+                  onBuildRuleCatches noApt $ Text.unlines dockerFile
+            it "apt-get upgrade" $ do
                 ruleCatches noAptGetUpgrade "RUN apt-get update && apt-get upgrade"
                 onBuildRuleCatches noAptGetUpgrade "RUN apt-get update && apt-get upgrade"
             it "apt-get version pinning" $ do