diff --git a/README.md b/README.md --- a/README.md +++ b/README.md @@ -1,5 +1,4 @@ -[![Linux/OSX Build Status][travis-img]][travis] -[![Windows Build status][appveyor-img]][appveyor] +[![Build Status][github-actions-img]][github-actions] [![GPL-3 licensed][license-img]][license] [![GitHub release][release-img]][release] [![Github downloads][downloads-img]]() @@ -32,7 +31,9 @@ Just pipe your `Dockerfile` to `docker run`: ```bash -docker run --rm -i hadolint/hadolint < Dockerfile +$ docker run --rm -i hadolint/hadolint < Dockerfile +# or +$ docker run --rm -i ghcr.io/hadolint/hadolint < Dockerfile ``` ## Install @@ -56,15 +57,20 @@ As shown before, `hadolint` is available as a Docker container: ```bash -docker pull hadolint/hadolint +$ docker pull hadolint/hadolint +# or +$ docker pull ghcr.io/hadolint/hadolint ``` If you need a Docker container with shell access, use the Debian or Alpine variants of the Docker image: ```bash -docker pull hadolint/hadolint:latest-debian -docker pull hadolint/hadolint:latest-alpine +$ docker pull hadolint/hadolint:latest-debian +$ docker pull hadolint/hadolint:latest-alpine +# or +$ docker pull ghcr.io/hadolint/hadolint:latest-debian +$ docker pull ghcr.io/hadolint/hadolint:latest-alpine ``` You can also build `hadolint` locally. You need [Haskell][] and the [stack][] @@ -125,7 +131,9 @@ use the following command: ```bash -docker run --rm -i -v ./your/path/to/hadolint.yaml:/root/.config/hadolint.yaml hadolint/hadolint < Dockerfile +$ docker run --rm -i -v ./your/path/to/hadolint.yaml:/root/.config/hadolint.yaml hadolint/hadolint < Dockerfile +# or +$ docker run --rm -i -v ./your/path/to/hadolint.yaml:/root/.config/hadolint.yaml ghcr.io/hadolint/hadolint < Dockerfile ``` ## Inline ignores @@ -211,6 +219,7 @@ | [DL3039](https://github.com/hadolint/hadolint/wiki/DL3039) | Do not use `dnf update` | | [DL3040](https://github.com/hadolint/hadolint/wiki/DL3040) | `dnf clean all` missing after dnf command. | | [DL3041](https://github.com/hadolint/hadolint/wiki/DL3041) | Specify version with `dnf install -y -` | +| [DL3042](https://github.com/hadolint/hadolint/wiki/DL3042) | Avoid cache directory with `pip install --no-cache-dir `. | | [DL4000](https://github.com/hadolint/hadolint/wiki/DL4000) | MAINTAINER is deprecated. | | [DL4001](https://github.com/hadolint/hadolint/wiki/DL4001) | Either use Wget or Curl but not both. | | [DL4003](https://github.com/hadolint/hadolint/wiki/DL4003) | Multiple `CMD` instructions found. | @@ -310,10 +319,8 @@ - projectatomic/[dockerfile_lint](https://github.com/projectatomic/dockerfile_lint/) -[travis-img]: https://travis-ci.org/hadolint/hadolint.svg?branch=master -[travis]: https://travis-ci.org/hadolint/hadolint -[appveyor-img]: https://ci.appveyor.com/api/projects/status//github/hadolint/hadolint?svg=true&branch=master -[appveyor]: https://ci.appveyor.com/project/hadolint/hadolint/branch/master +[github-actions-img]: https://github.com/hadolint/hadolint/workflows/Haskell%20Tests/badge.svg?branch=master +[github-actions]: https://travis-ci.org/hadolint/hadolint/actions [license-img]: https://img.shields.io/badge/license-GPL--3-blue.svg [license]: https://tldrlegal.com/l/gpl-3.0 [release-img]: https://img.shields.io/github/release/hadolint/hadolint.svg diff --git a/hadolint.cabal b/hadolint.cabal --- a/hadolint.cabal +++ b/hadolint.cabal @@ -4,10 +4,10 @@ -- -- see: https://github.com/sol/hpack -- --- hash: afee9524ce1aad80f4f3a651eef3a68c327005e1f97e965b5a82d3cd36afa09e +-- hash: 196183dccc95114462aa7b27a5c15b007a0aa09fdddf2c00d154df003854e6ad name: hadolint -version: 1.19.0 +version: 1.20.0 synopsis: Dockerfile Linter JavaScript API description: A smarter Dockerfile linter that helps you build best practice Docker images. category: Development diff --git a/src/Hadolint/Formatter/TTY.hs b/src/Hadolint/Formatter/TTY.hs --- a/src/Hadolint/Formatter/TTY.hs +++ b/src/Hadolint/Formatter/TTY.hs @@ -27,7 +27,7 @@ formatChecks = fmap formatCheck where formatCheck (RuleCheck meta source line _) = - formatPos source line <> code meta <> " " <> message meta + formatPos source line <> code meta <> " " <> Text.pack (severityText (severity meta)) <> ": " <> message meta formatPos :: Filename -> Linenumber -> Text.Text formatPos source line = source <> ":" <> Text.pack (show line) <> " " diff --git a/src/Hadolint/Rules.hs b/src/Hadolint/Rules.hs --- a/src/Hadolint/Rules.hs +++ b/src/Hadolint/Rules.hs @@ -7,7 +7,6 @@ import Data.List (foldl', isInfixOf, isPrefixOf, mapAccumL, nub) import Data.List.NonEmpty (toList) import qualified Data.Map as Map -import Data.Semigroup (Semigroup, (<>)) import qualified Data.Set as Set import qualified Data.Text as Text import Data.Void (Void) @@ -218,7 +217,8 @@ dnfYes, noDnfUpdate, dnfCleanup, - dnfVersionPinned + dnfVersionPinned, + pipNoCacheDir ] optionalRules :: RulesConfig -> [Rule] @@ -428,7 +428,7 @@ severity = ErrorC message = "Do not use apt-get upgrade or dist-upgrade" check (Run (RunArgs args _)) = - argumentsRule (Shell.noCommands (Shell.cmdHasArgs "apt-get" ["upgrade"])) args + argumentsRule (Shell.noCommands (Shell.cmdHasArgs "apt-get" ["upgrade", "dist-upgrade"])) args check _ = True noUntagged :: Rule @@ -599,17 +599,14 @@ severity = WarningC message = "Pin versions in pip. Instead of `pip install ` use `pip install \ - \==`" + \==` or `pip install --requirement `" check (Run (RunArgs args _)) = argumentsRule (Shell.noCommands forgotToPinVersion) args check _ = True forgotToPinVersion cmd = - isPipInstall cmd && not (hasBuildConstraint cmd) && not (all versionFixed (packages cmd)) + isPipInstall' cmd && not (hasBuildConstraint cmd) && not (all versionFixed (packages cmd)) -- Check if the command is a pip* install command, and that specific packages are being listed - isPipInstall cmd = (isStdPipInstall cmd || isPythonPipInstall cmd) && not (requirementInstall cmd) - isStdPipInstall cmd@(Shell.Command name _ _) = "pip" `Text.isPrefixOf` name && ["install"] `isInfixOf` Shell.getArgs cmd - isPythonPipInstall cmd@(Shell.Command name _ _) = - "python" `Text.isPrefixOf` name - && ["-m", "pip", "install"] `isInfixOf` Shell.getArgs cmd + isPipInstall' cmd = + (isPipInstall cmd && not (hasBuildConstraint cmd) && not (all versionFixed (packages cmd))) && not (requirementInstall cmd) -- If the user is installing requirements from a file or just the local module, then we are not interested -- in running this rule requirementInstall cmd = @@ -1040,6 +1037,7 @@ || "<" `Text.isInfixOf` package || ".rpm" `Text.isSuffixOf` package + zypperPackages :: Shell.ParsedShell -> [Text.Text] zypperPackages args = [ arg | cmd <- Shell.presentCommands args, Shell.cmdHasArgs "zypper" ["install", "in"] cmd, arg <- Shell.getArgsNoFlags cmd, arg /= "install", arg /= "in" @@ -1107,6 +1105,26 @@ dnfPackages args = [ arg | cmd <- Shell.presentCommands args, Shell.cmdHasArgs "dnf" ["install"] cmd, arg <- Shell.getArgsNoFlags cmd, arg /= "install" ] + +pipNoCacheDir :: Rule +pipNoCacheDir = instructionRule code severity message check + where + code = "DL3042" + severity = WarningC + message = + "Avoid use of cache directory with pip. Use `pip install --no-cache-dir `" + check (Run (RunArgs args _)) = argumentsRule (Shell.noCommands forgotNoCacheDir) args + check _ = True + forgotNoCacheDir cmd = + isPipInstall cmd && not(usesNoCacheDir cmd) + usesNoCacheDir cmd = "--no-cache-dir" `elem` Shell.getArgs cmd + +isPipInstall :: Shell.Command -> Bool +isPipInstall cmd@(Shell.Command name _ _) = isStdPipInstall || isPythonPipInstall + where + isStdPipInstall = "pip" `Text.isPrefixOf` name && ["install"] `isInfixOf` Shell.getArgs cmd + isPythonPipInstall = "python" `Text.isPrefixOf` name + && ["-m", "pip", "install"] `isInfixOf` Shell.getArgs cmd gems :: Shell.ParsedShell -> [Text.Text] gems shell = diff --git a/test/Spec.hs b/test/Spec.hs --- a/test/Spec.hs +++ b/test/Spec.hs @@ -323,6 +323,9 @@ it "apt-get upgrade" $ do ruleCatches noAptGetUpgrade "RUN apt-get update && apt-get upgrade" onBuildRuleCatches noAptGetUpgrade "RUN apt-get update && apt-get upgrade" + it "apt-get dist-upgrade" $ do + ruleCatches noAptGetUpgrade "RUN apt-get update && apt-get dist-upgrade" + onBuildRuleCatches noAptGetUpgrade "RUN apt-get update && apt-get dist-upgrade" it "apt-get version pinning" $ do ruleCatches aptGetVersionPinned "RUN apt-get update && apt-get install python" onBuildRuleCatches aptGetVersionPinned "RUN apt-get update && apt-get install python" @@ -638,6 +641,28 @@ onBuildRuleCatchesNot pipVersionPinned "RUN pip install --index-url https://user:pass@eg.com/foo --extra-index-url https://user:pass@ex-eg.io/foo foobar==1.0.0" + + -- + describe "pip cache dir" $ do + it "pip2 --no-cache-dir not used" $ do + ruleCatches pipNoCacheDir "RUN pip2 install MySQL_python" + onBuildRuleCatches pipNoCacheDir "RUN pip2 install MySQL_python" + it "pip3 --no-cache-dir not used" $ do + ruleCatches pipNoCacheDir "RUN pip3 install MySQL_python" + onBuildRuleCatches pipNoCacheDir "RUN pip3 install MySQL_python" + it "pip --no-cache-dir not used" $ do + ruleCatches pipNoCacheDir "RUN pip install MySQL_python" + onBuildRuleCatches pipNoCacheDir "RUN pip install MySQL_python" + it "pip2 --no-cache-dir used" $ do + ruleCatchesNot pipNoCacheDir "RUN pip2 install MySQL_python --no-cache-dir" + onBuildRuleCatchesNot pipNoCacheDir "RUN pip2 install MySQL_python --no-cache-dir" + it "pip3 --no-cache-dir used" $ do + ruleCatchesNot pipNoCacheDir "RUN pip3 install --no-cache-dir MySQL_python" + onBuildRuleCatchesNot pipNoCacheDir "RUN pip3 install --no-cache-dir MySQL_python" + it "pip --no-cache-dir used" $ do + ruleCatchesNot pipNoCacheDir "RUN pip install MySQL_python --no-cache-dir" + onBuildRuleCatchesNot pipNoCacheDir "RUN pip install MySQL_python --no-cache-dir" + -- describe "npm pinning" $ do it "version pinned in package.json" $ do