hadolint 2.6.1 → 2.7.0
raw patch · 18 files changed
+294/−328 lines, 18 filesdep ~language-dockerPVP ok
version bump matches the API change (PVP)
Dependency ranges changed: language-docker
API changes (from Hackage documentation)
- Hadolint.Rule.DL3017: rule :: Rule ParsedShell
- Hadolint.Rule.DL3031: rule :: Rule ParsedShell
- Hadolint.Rule.DL3039: rule :: Rule ParsedShell
+ Hadolint.Rule: archiveFileFormatExtensions :: [Text]
+ Hadolint.Shell: hasUnsupportedShebang :: Text -> Bool
Files
- README.md +250/−141
- hadolint.cabal +4/−10
- src/Hadolint/Process.hs +0/−6
- src/Hadolint/Rule.hs +19/−0
- src/Hadolint/Rule/DL3010.hs +2/−19
- src/Hadolint/Rule/DL3017.hs +0/−16
- src/Hadolint/Rule/DL3020.hs +1/−17
- src/Hadolint/Rule/DL3031.hs +0/−27
- src/Hadolint/Rule/DL3035.hs +2/−4
- src/Hadolint/Rule/DL3039.hs +0/−26
- src/Hadolint/Shell.hs +14/−1
- test/DL3010.hs +1/−0
- test/DL3017.hs +0/−13
- test/DL3020.hs +1/−1
- test/DL3031.hs +0/−18
- test/DL3035.hs +0/−5
- test/DL3039.hs +0/−18
- test/Spec.hs +0/−6
README.md view
@@ -1,12 +1,12 @@+# Haskell Dockerfile Linter+ [![Build Status][github-actions-img]][github-actions] [![GPL-3 licensed][license-img]][license] [![GitHub release][release-img]][release]-[![Github downloads][downloads-img]]()+![Github downloads][downloads-img] <img align="right" alt="pipecat" width="150" src="https://hadolint.github.io/hadolint/img/cat_container.png" /> -# Haskell Dockerfile Linter- A smarter Dockerfile linter that helps you build [best practice][] Docker images. The linter is parsing the Dockerfile into an AST and performs rules on top of the AST. It is standing on the shoulders of [ShellCheck][] to lint@@ -32,14 +32,16 @@ ```bash $ docker run --rm -i hadolint/hadolint < Dockerfile-# or+# OR $ docker run --rm -i ghcr.io/hadolint/hadolint < Dockerfile ``` or if you are using Windows PowerShell:+ ```powershell > cat .\Dockerfile | docker run --rm -i hadolint/hadolint ```+ ## Install You can download prebuilt binaries for OSX, Windows and Linux from the latest@@ -52,7 +54,8 @@ brew install hadolint ``` -On Windows you can use [scoop](https://github.com/lukesampson/scoop) to install `hadolint`.+On Windows you can use [scoop](https://github.com/lukesampson/scoop) to+install `hadolint`. ```batch scoop install hadolint@@ -61,45 +64,129 @@ As shown before, `hadolint` is available as a Docker container: ```bash-$ docker pull hadolint/hadolint-# or-$ docker pull ghcr.io/hadolint/hadolint+docker pull hadolint/hadolint+# OR+docker pull ghcr.io/hadolint/hadolint ``` If you need a Docker container with shell access, use the Debian or Alpine variants of the Docker image: ```bash-$ docker pull hadolint/hadolint:latest-debian-$ docker pull hadolint/hadolint:latest-alpine-# or-$ docker pull ghcr.io/hadolint/hadolint:latest-debian-$ docker pull ghcr.io/hadolint/hadolint:latest-alpine+docker pull hadolint/hadolint:latest-debian+# OR +docker pull hadolint/hadolint:latest-alpine+# OR+docker pull ghcr.io/hadolint/hadolint:latest-debian+# OR+docker pull ghcr.io/hadolint/hadolint:latest-alpine ``` You can also build `hadolint` locally. You need [Haskell][] and the [stack][] build tool to build the binary. ```bash-git clone https://github.com/hadolint/hadolint-cd hadolint-stack install+git clone https://github.com/hadolint/hadolint \+&& cd hadolint \+&& stack install ``` +## CLI++```bash+hadolint --help+```++```text+hadolint - Dockerfile Linter written in Haskell++Usage: hadolint [-v|--version] [--no-fail] [--no-color] [-c|--config FILENAME] + [-V|--verbose] [-f|--format ARG] [DOCKERFILE...] + [--error RULECODE] [--warning RULECODE] [--info RULECODE] + [--style RULECODE] [--ignore RULECODE] + [--trusted-registry REGISTRY (e.g. docker.io)] + [--require-label LABELSCHEMA (e.g. maintainer:text)] + [--strict-labels] [-t|--failure-theshold THRESHOLD]+ Lint Dockerfile for errors and best practices++Available options:+ -h,--help Show this help text+ -v,--version Show version+ --no-fail Don't exit with a failure status code when any rule+ is violated+ --no-color Don't colorize output+ -c,--config FILENAME Path to the configuration file+ -V,--verbose Enables verbose logging of hadolint's output to+ stderr+ -f,--format ARG The output format for the results [tty | json |+ checkstyle | codeclimate | gitlab_codeclimate |+ codacy] (default: tty)+ --error RULECODE Make the rule `RULECODE` have the level `error`+ --warning RULECODE Make the rule `RULECODE` have the level `warning`+ --info RULECODE Make the rule `RULECODE` have the level `info`+ --style RULECODE Make the rule `RULECODE` have the level `style`+ --ignore RULECODE A rule to ignore. If present, the ignore list in the+ config file is ignored+ --trusted-registry REGISTRY (e.g. docker.io)+ A docker registry to allow to appear in FROM+ instructions+ --require-label LABELSCHEMA (e.g. maintainer:text)+ The option --require-label=label:format makes+ Hadolint check that the label `label` conforms to+ format requirement `format`+ --strict-labels Do not permit labels other than specified in+ `label-schema`+ -t,--failure-theshold THRESHOLD+ Exit with failure code only when rules with a+ severity above THRESHOLD are violated. Accepted+ values: [error | warning | info | style | ignore |+ none] (default: info)+```+ ## Configure -`hadolint` supports specifying the ignored rules using a configuration file. The configuration-file should be in `yaml` format. This is one valid configuration file as an example:+Configuration files can be used globally or per project. By default,+`hadolint` will look for a configuration file in the current directory+with the name `.hadolint.yaml` or `.hadolint.yml` +`hadolint` full `yaml` config file schema+ ```yaml+failure-threshold: string # name of threshold level (error | warning | info | style | ignore | none) +format: string # Output format (tty | json | checkstyle | codeclimate | gitlab_codeclimate | codacy)+ignored: [string] # list of rules+label-schema: # See Linting Labels below for specific label-schema details+ author: string # Your name+ contact: string # email address+ created: timestamp # rfc3339 datetime+ version: string # semver+ documentation: string # url+ git-revision: string # hash+ license: string # spdx+no-color: boolean # true | false+no-fail: boolean # true | false+override:+ error: [string] # list of rules+ warning: [string] # list of rules+ info: [string] # list of rules+ style: [string] # list of rules+strict-labels: boolean # true | false+trustedRegistries: string | [string] # registry or list of registries+```++`hadolint` supports specifying the ignored rules using a configuration+file. The configuration file should be in `yaml` format. This is one+valid configuration file as an example:++```yaml ignored: - DL3000 - SC1010 ``` -Additionally, `hadolint` can warn you when images from untrusted repositories are being-used in Dockerfiles, you can append the `trustedRegistries` keys to the configuration-file as shown below:+Additionally, `hadolint` can warn you when images from untrusted+repositories are being used in Dockerfiles, you can append the+`trustedRegistries` keys to the configuration file as shown below: ```yaml ignored:@@ -112,6 +199,7 @@ ``` If you want to override the severity of specific rules, you can do that too:+ ```yaml override: error:@@ -126,14 +214,24 @@ - DL3015 ``` -Configuration files can be used globally or per project. By default, `hadolint` will look for-a configuration file in the current directory with the name `.hadolint.yaml` or-`.hadolint.yml`+`failure-threshold` Exit with failure code only when rules with a+severity above THRESHOLD are violated (Available in v2.6.0+) -The global configuration file should be placed in the folder specified by `XDG_CONFIG_HOME`,-with the name `hadolint.yaml` or `hadolint.yml`. In summary, the following locations are valid-for the configuration file, in order or preference:+```yaml+failure-threshold: info+warning:+ - DL3042+ - DL3033+ info:+ - DL3032+``` +The global configuration file should be placed in the folder+specified by `XDG_CONFIG_HOME`,+with the name `hadolint.yaml` or `hadolint.yml`. In summary, the+following locations are valid for the configuration file, in order+or preference:+ - `$PWD/.hadolint.yaml` - `$XDG_CONFIG_HOME/hadolint.yaml` - `~/.config/hadolint.yaml`@@ -147,19 +245,20 @@ hadolint --config /path/to/config.yaml Dockerfile ``` -To pass a custom configuration file (using relative or absolute path) to a container,-use the following command:+To pass a custom configuration file (using relative or absolute path) to +a container, use the following command: ```bash-$ docker run --rm -i -v /your/path/to/hadolint.yaml:/.config/hadolint.yaml hadolint/hadolint < Dockerfile-# or-$ docker run --rm -i -v /your/path/to/hadolint.yaml:/.config/hadolint.yaml ghcr.io/hadolint/hadolint < Dockerfile+docker run --rm -i -v /your/path/to/hadolint.yaml:/.config/hadolint.yaml hadolint/hadolint < Dockerfile+# OR+docker run --rm -i -v /your/path/to/hadolint.yaml:/.config/hadolint.yaml ghcr.io/hadolint/hadolint < Dockerfile ``` ## Inline ignores -It is also possible to ignore rules by using a special comment directly above the Dockerfile-instruction you want to make an exception for. Ignore rule comments look like+It is also possible to ignore rules by using a special comment directly+above the Dockerfile instruction you want to make an exception for.+Ignore rule comments look like `# hadolint ignore=DL3001,SC1081`. For example: ```dockerfile@@ -177,9 +276,11 @@ Hadolint has the ability to check that specific labels be present and conform to a predefined label schema. First a label schema must be defined either via commandline:+ ```bash-$ hadolint --require-label author:text --require-label version:semver Dockerfile+hadolint --require-label author:text --require-label version:semver Dockerfile ```+ or via config file: ```yaml@@ -192,6 +293,7 @@ git-revision: hash license: spdx ```+ The value of a label can be either of `text`, `url`, `semver`, `hash` or `rfc3339`: | Schema | Description |@@ -206,25 +308,33 @@ By default, Hadolint ignores any label not specified in the label schema. To warn on such additional labels, turn on strict labels:+ ```bash-$ hadolint --strict-labels --require-label version:semver Dockerfile+hadolint --strict-labels --require-label version:semver Dockerfile ```+ or in the config file:+ ```yaml strict-labels: true ```+ When strict labels is enabled, but no label schema has been specified, Hadolint will warn if any label is present. ### Note on dealing with variables in labels+ It is a common pattern to fill the value of a label not statically, but rather dynamically at build time by using a variable:+ ```dockerfile FROM debian:buster ARG VERSION="du-jour" LABEL version="${VERSION}" ```+ To allow this, the label schema must specify `text` as value for that label:+ ```yaml label-schema: version: text@@ -253,109 +363,107 @@ common rules are listed, there are dozens more) Please [create an issue][] if you have an idea for a good rule.--| Rule | Description |-|:-------------------------------------------------------------|:----------------------------------------------------------------------------------------------------------------------------------------------------|-| [DL3000](https://github.com/hadolint/hadolint/wiki/DL3000) | Use absolute WORKDIR. |-| [DL3001](https://github.com/hadolint/hadolint/wiki/DL3001) | For some bash commands it makes no sense running them in a Docker container like ssh, vim, shutdown, service, ps, free, top, kill, mount, ifconfig. |-| [DL3002](https://github.com/hadolint/hadolint/wiki/DL3002) | Last user should not be root. |-| [DL3003](https://github.com/hadolint/hadolint/wiki/DL3003) | Use WORKDIR to switch to a directory. |-| [DL3004](https://github.com/hadolint/hadolint/wiki/DL3004) | Do not use sudo as it leads to unpredictable behavior. Use a tool like gosu to enforce root. |-| [DL3005](https://github.com/hadolint/hadolint/wiki/DL3005) | Do not use apt-get dist-upgrade. |-| [DL3006](https://github.com/hadolint/hadolint/wiki/DL3006) | Always tag the version of an image explicitly. |-| [DL3007](https://github.com/hadolint/hadolint/wiki/DL3007) | Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag. |-| [DL3008](https://github.com/hadolint/hadolint/wiki/DL3008) | Pin versions in apt-get install. |-| [DL3009](https://github.com/hadolint/hadolint/wiki/DL3009) | Delete the apt-get lists after installing something. |-| [DL3010](https://github.com/hadolint/hadolint/wiki/DL3010) | Use ADD for extracting archives into an image. |-| [DL3011](https://github.com/hadolint/hadolint/wiki/DL3011) | Valid UNIX ports range from 0 to 65535. |-| [DL3012](https://github.com/hadolint/hadolint/wiki/DL3012) | Multiple `HEALTHCHECK` instructions. |-| [DL3013](https://github.com/hadolint/hadolint/wiki/DL3013) | Pin versions in pip. |-| [DL3014](https://github.com/hadolint/hadolint/wiki/DL3014) | Use the `-y` switch. |-| [DL3015](https://github.com/hadolint/hadolint/wiki/DL3015) | Avoid additional packages by specifying --no-install-recommends. |-| [DL3016](https://github.com/hadolint/hadolint/wiki/DL3016) | Pin versions in `npm`. |-| [DL3017](https://github.com/hadolint/hadolint/wiki/DL3017) | Do not use `apk upgrade`. |-| [DL3018](https://github.com/hadolint/hadolint/wiki/DL3018) | Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`. |-| [DL3019](https://github.com/hadolint/hadolint/wiki/DL3019) | Use the `--no-cache` switch to avoid the need to use `--update` and remove `/var/cache/apk/*` when done installing packages. |-| [DL3020](https://github.com/hadolint/hadolint/wiki/DL3020) | Use `COPY` instead of `ADD` for files and folders. |-| [DL3021](https://github.com/hadolint/hadolint/wiki/DL3021) | `COPY` with more than 2 arguments requires the last argument to end with `/` |-| [DL3022](https://github.com/hadolint/hadolint/wiki/DL3022) | `COPY --from` should reference a previously defined `FROM` alias |-| [DL3023](https://github.com/hadolint/hadolint/wiki/DL3023) | `COPY --from` cannot reference its own `FROM` alias |-| [DL3024](https://github.com/hadolint/hadolint/wiki/DL3024) | `FROM` aliases (stage names) must be unique |-| [DL3025](https://github.com/hadolint/hadolint/wiki/DL3025) | Use arguments JSON notation for CMD and ENTRYPOINT arguments |-| [DL3026](https://github.com/hadolint/hadolint/wiki/DL3026) | Use only an allowed registry in the FROM image |-| [DL3027](https://github.com/hadolint/hadolint/wiki/DL3027) | Do not use `apt` as it is meant to be a end-user tool, use `apt-get` or `apt-cache` instead |-| [DL3028](https://github.com/hadolint/hadolint/wiki/DL3028) | Pin versions in gem install. Instead of `gem install <gem>` use `gem install <gem>:<version>` |-| [DL3029](https://github.com/hadolint/hadolint/wiki/DL3029) | Do not use --platform flag with FROM. |-| [DL3030](https://github.com/hadolint/hadolint/wiki/DL3030) | Use the `-y` switch to avoid manual input `yum install -y <package>` |-| [DL3031](https://github.com/hadolint/hadolint/wiki/DL3031) | Do not use `yum update` |-| [DL3032](https://github.com/hadolint/hadolint/wiki/DL3032) | `yum clean all` missing after yum command. |-| [DL3033](https://github.com/hadolint/hadolint/wiki/DL3033) | Specify version with `yum install -y <package>-<version>` |-| [DL3034](https://github.com/hadolint/hadolint/wiki/DL3034) | Non-interactive switch missing from `zypper` command: `zypper install -y` |-| [DL3035](https://github.com/hadolint/hadolint/wiki/DL3035) | Do not use `zypper update`. |-| [DL3036](https://github.com/hadolint/hadolint/wiki/DL3036) | `zypper clean` missing after zypper use. |-| [DL3037](https://github.com/hadolint/hadolint/wiki/DL3037) | Specify version with `zypper install -y <package>[=]<version>`. |-| [DL3038](https://github.com/hadolint/hadolint/wiki/DL3038) | Use the `-y` switch to avoid manual input `dnf install -y <package>` |-| [DL3039](https://github.com/hadolint/hadolint/wiki/DL3039) | Do not use `dnf update` |-| [DL3040](https://github.com/hadolint/hadolint/wiki/DL3040) | `dnf clean all` missing after dnf command. |-| [DL3041](https://github.com/hadolint/hadolint/wiki/DL3041) | Specify version with `dnf install -y <package>-<version>` |-| [DL3042](https://github.com/hadolint/hadolint/wiki/DL3042) | Avoid cache directory with `pip install --no-cache-dir <package>`. |-| [DL3043](https://github.com/hadolint/hadolint/wiki/DL3043) | `ONBUILD`, `FROM` or `MAINTAINER` triggered from within `ONBUILD` instruction. |-| [DL3044](https://github.com/hadolint/hadolint/wiki/DL3044) | Do not refer to an environment variable within the same `ENV` statement where it is defined. |-| [DL3045](https://github.com/hadolint/hadolint/wiki/DL3045) | `COPY` to a relative destination without `WORKDIR` set. |-| [DL3046](https://github.com/hadolint/hadolint/wiki/DL3046) | `useradd` without flag `-l` and high UID will result in excessively large Image. |-| [DL3047](https://github.com/hadolint/hadolint/wiki/DL3047) | `wget` without flag `--progress` will result in excessively bloated build logs when downloading larger files. |-| [DL3048](https://github.com/hadolint/hadolint/wiki/DL3048) | Invalid Label Key |-| [DL3049](https://github.com/hadolint/hadolint/wiki/DL3049) | Label `<label>` is missing. |-| [DL3050](https://github.com/hadolint/hadolint/wiki/DL3050) | Superfluous label(s) present. |-| [DL3051](https://github.com/hadolint/hadolint/wiki/DL3051) | Label `<label>` is empty. |-| [DL3052](https://github.com/hadolint/hadolint/wiki/DL3052) | Label `<label>` is not a valid URL. |-| [DL3053](https://github.com/hadolint/hadolint/wiki/DL3053) | Label `<label>` is not a valid time format - must be conform to RFC3339. |-| [DL3054](https://github.com/hadolint/hadolint/wiki/DL3054) | Label `<label>` is not a valid SPDX license identifier. |-| [DL3055](https://github.com/hadolint/hadolint/wiki/DL3055) | Label `<label>` is not a valid git hash. |-| [DL3056](https://github.com/hadolint/hadolint/wiki/DL3056) | Label `<label>` does not conform to semantic versioning. |-| [DL3057](https://github.com/hadolint/hadolint/wiki/DL3057) | `HEALTHCHECK` instruction missing. |-| [DL3058](https://github.com/hadolint/hadolint/wiki/DL3058) | Label `<label>` is not a valid email format - must be conform to RFC5322. |-| [DL3059](https://github.com/hadolint/hadolint/wiki/DL3059) | Multiple consecutive `RUN` instructions. Consider consolidation. |-| [DL3060](https://github.com/hadolint/hadolint/wiki/DL3060) | `yarn cache clean` missing after `yarn install` was run. |-| [DL4000](https://github.com/hadolint/hadolint/wiki/DL4000) | MAINTAINER is deprecated. |-| [DL4001](https://github.com/hadolint/hadolint/wiki/DL4001) | Either use Wget or Curl but not both. |-| [DL4003](https://github.com/hadolint/hadolint/wiki/DL4003) | Multiple `CMD` instructions found. |-| [DL4004](https://github.com/hadolint/hadolint/wiki/DL4004) | Multiple `ENTRYPOINT` instructions found. |-| [DL4005](https://github.com/hadolint/hadolint/wiki/DL4005) | Use `SHELL` to change the default shell. |-| [DL4006](https://github.com/hadolint/hadolint/wiki/DL4006) | Set the `SHELL` option -o pipefail before `RUN` with a pipe in it |-| [SC1000](https://github.com/koalaman/shellcheck/wiki/SC1000) | `$` is not used specially and should therefore be escaped. |-| [SC1001](https://github.com/koalaman/shellcheck/wiki/SC1001) | This `\c` will be a regular `'c'` in this context. |-| [SC1007](https://github.com/koalaman/shellcheck/wiki/SC1007) | Remove space after `=` if trying to assign a value (or for empty string, use `var='' ...`). |-| [SC1010](https://github.com/koalaman/shellcheck/wiki/SC1010) | Use semicolon or linefeed before `done` (or quote to make it literal). |-| [SC1018](https://github.com/koalaman/shellcheck/wiki/SC1018) | This is a unicode non-breaking space. Delete it and retype as space. |-| [SC1035](https://github.com/koalaman/shellcheck/wiki/SC1035) | You need a space here |-| [SC1045](https://github.com/koalaman/shellcheck/wiki/SC1045) | It's not `foo &; bar`, just `foo & bar`. |-| [SC1065](https://github.com/koalaman/shellcheck/wiki/SC1065) | Trying to declare parameters? Don't. Use `()` and refer to params as `$1`, `$2` etc. |-| [SC1066](https://github.com/koalaman/shellcheck/wiki/SC1066) | Don't use $ on the left side of assignments. |-| [SC1068](https://github.com/koalaman/shellcheck/wiki/SC1068) | Don't put spaces around the `=` in assignments. |-| [SC1077](https://github.com/koalaman/shellcheck/wiki/SC1077) | For command expansion, the tick should slant left (\` vs ´). |-| [SC1078](https://github.com/koalaman/shellcheck/wiki/SC1078) | Did you forget to close this double-quoted string? |-| [SC1079](https://github.com/koalaman/shellcheck/wiki/SC1079) | This is actually an end quote, but due to next char, it looks suspect. |-| [SC1081](https://github.com/koalaman/shellcheck/wiki/SC1081) | Scripts are case sensitive. Use `if`, not `If`. |-| [SC1083](https://github.com/koalaman/shellcheck/wiki/SC1083) | This `{/}` is literal. Check expression (missing `;/\n`?) or quote it. |-| [SC1086](https://github.com/koalaman/shellcheck/wiki/SC1086) | Don't use `$` on the iterator name in for loops. |-| [SC1087](https://github.com/koalaman/shellcheck/wiki/SC1087) | Braces are required when expanding arrays, as in `${array[idx]}`. |-| [SC1095](https://github.com/koalaman/shellcheck/wiki/SC1095) | You need a space or linefeed between the function name and body. |-| [SC1097](https://github.com/koalaman/shellcheck/wiki/SC1097) | Unexpected `==`. For assignment, use `=`. For comparison, use `[ .. ]` or `[[ .. ]]`. |-| [SC1098](https://github.com/koalaman/shellcheck/wiki/SC1098) | Quote/escape special characters when using `eval`, e.g. `eval "a=(b)"`. |-| [SC1099](https://github.com/koalaman/shellcheck/wiki/SC1099) | You need a space before the `#`. |-| [SC2002](https://github.com/koalaman/shellcheck/wiki/SC2002) | Useless cat. Consider <code>cmd < file | ..</code> or <code>cmd file | ..</code> instead. |-| [SC2015](https://github.com/koalaman/shellcheck/wiki/SC2015) | Note that <code>A && B || C</code> is not if-then-else. C may run when A is true. |-| [SC2026](https://github.com/koalaman/shellcheck/wiki/SC2026) | This word is outside of quotes. Did you intend to 'nest '"'single quotes'"' instead'? |-| [SC2028](https://github.com/koalaman/shellcheck/wiki/SC2028) | `echo` won't expand escape sequences. Consider `printf`. |-| [SC2035](https://github.com/koalaman/shellcheck/wiki/SC2035) | Use `./*glob*` or `-- *glob*` so names with dashes won't become options. |-| [SC2039](https://github.com/koalaman/shellcheck/wiki/SC2039) | In POSIX sh, something is undefined. |-| [SC2046](https://github.com/koalaman/shellcheck/wiki/SC2046) | Quote this to prevent word splitting |-| [SC2086](https://github.com/koalaman/shellcheck/wiki/SC2086) | Double quote to prevent globbing and word splitting. |-| [SC2140](https://github.com/koalaman/shellcheck/wiki/SC2140) | Word is in the form `"A"B"C"` (B indicated). Did you mean `"ABC"` or `"A\"B\"C"`? |-| [SC2154](https://github.com/koalaman/shellcheck/wiki/SC2154) | var is referenced but not assigned. |-| [SC2155](https://github.com/koalaman/shellcheck/wiki/SC2155) | Declare and assign separately to avoid masking return values. |-| [SC2164](https://github.com/koalaman/shellcheck/wiki/SC2164) | Use <code>cd ... || exit</code> in case `cd` fails. |+<!--lint disable maximum-line-length-->+| Rule | Default Severity | Description |+|:-------------------------------------------------------------|:-----------------|:----------------------------------------------------------------------------------------------------------------------------------------------------|+| [DL3000](https://github.com/hadolint/hadolint/wiki/DL3000) | Error | Use absolute WORKDIR. |+| [DL3001](https://github.com/hadolint/hadolint/wiki/DL3001) | Info | For some bash commands it makes no sense running them in a Docker container like ssh, vim, shutdown, service, ps, free, top, kill, mount, ifconfig. |+| [DL3002](https://github.com/hadolint/hadolint/wiki/DL3002) | Warning | Last user should not be root. |+| [DL3003](https://github.com/hadolint/hadolint/wiki/DL3003) | Warning | Use WORKDIR to switch to a directory. |+| [DL3004](https://github.com/hadolint/hadolint/wiki/DL3004) | Error | Do not use sudo as it leads to unpredictable behavior. Use a tool like gosu to enforce root. |+| [DL3005](https://github.com/hadolint/hadolint/wiki/DL3005) | Error | Do not use apt-get dist-upgrade. |+| [DL3006](https://github.com/hadolint/hadolint/wiki/DL3006) | Warning | Always tag the version of an image explicitly. |+| [DL3007](https://github.com/hadolint/hadolint/wiki/DL3007) | Warning | Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag. |+| [DL3008](https://github.com/hadolint/hadolint/wiki/DL3008) | Warning | Pin versions in apt-get install. |+| [DL3009](https://github.com/hadolint/hadolint/wiki/DL3009) | Info | Delete the apt-get lists after installing something. |+| [DL3010](https://github.com/hadolint/hadolint/wiki/DL3010) | Info | Use ADD for extracting archives into an image. |+| [DL3011](https://github.com/hadolint/hadolint/wiki/DL3011) | Error | Valid UNIX ports range from 0 to 65535. |+| [DL3012](https://github.com/hadolint/hadolint/wiki/DL3012) | Error | Multiple `HEALTHCHECK` instructions. |+| [DL3013](https://github.com/hadolint/hadolint/wiki/DL3013) | Warning | Pin versions in pip. |+| [DL3014](https://github.com/hadolint/hadolint/wiki/DL3014) | Warning | Use the `-y` switch. |+| [DL3015](https://github.com/hadolint/hadolint/wiki/DL3015) | Info | Avoid additional packages by specifying --no-install-recommends. |+| [DL3016](https://github.com/hadolint/hadolint/wiki/DL3016) | Warning | Pin versions in `npm`. |+| [DL3018](https://github.com/hadolint/hadolint/wiki/DL3018) | Warning | Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`. |+| [DL3019](https://github.com/hadolint/hadolint/wiki/DL3019) | Info | Use the `--no-cache` switch to avoid the need to use `--update` and remove `/var/cache/apk/*` when done installing packages. |+| [DL3020](https://github.com/hadolint/hadolint/wiki/DL3020) | Error | Use `COPY` instead of `ADD` for files and folders. |+| [DL3021](https://github.com/hadolint/hadolint/wiki/DL3021) | Error | `COPY` with more than 2 arguments requires the last argument to end with `/` |+| [DL3022](https://github.com/hadolint/hadolint/wiki/DL3022) | Warning | `COPY --from` should reference a previously defined `FROM` alias |+| [DL3023](https://github.com/hadolint/hadolint/wiki/DL3023) | Error | `COPY --from` cannot reference its own `FROM` alias |+| [DL3024](https://github.com/hadolint/hadolint/wiki/DL3024) | Error | `FROM` aliases (stage names) must be unique |+| [DL3025](https://github.com/hadolint/hadolint/wiki/DL3025) | Warning | Use arguments JSON notation for CMD and ENTRYPOINT arguments |+| [DL3026](https://github.com/hadolint/hadolint/wiki/DL3026) | Error | Use only an allowed registry in the FROM image |+| [DL3027](https://github.com/hadolint/hadolint/wiki/DL3027) | Warning | Do not use `apt` as it is meant to be a end-user tool, use `apt-get` or `apt-cache` instead |+| [DL3028](https://github.com/hadolint/hadolint/wiki/DL3028) | Warning | Pin versions in gem install. Instead of `gem install <gem>` use `gem install <gem>:<version>` |+| [DL3029](https://github.com/hadolint/hadolint/wiki/DL3029) | Warning | Do not use --platform flag with FROM. |+| [DL3030](https://github.com/hadolint/hadolint/wiki/DL3030) | Warning | Use the `-y` switch to avoid manual input `yum install -y <package>` |+| [DL3032](https://github.com/hadolint/hadolint/wiki/DL3032) | Warning | `yum clean all` missing after yum command. |+| [DL3033](https://github.com/hadolint/hadolint/wiki/DL3033) | Warning | Specify version with `yum install -y <package>-<version>` |+| [DL3034](https://github.com/hadolint/hadolint/wiki/DL3034) | Warning | Non-interactive switch missing from `zypper` command: `zypper install -y` |+| [DL3035](https://github.com/hadolint/hadolint/wiki/DL3035) | Warning | Do not use `zypper dist-upgrade`. |+| [DL3036](https://github.com/hadolint/hadolint/wiki/DL3036) | Warning | `zypper clean` missing after zypper use. |+| [DL3037](https://github.com/hadolint/hadolint/wiki/DL3037) | Warning | Specify version with `zypper install -y <package>[=]<version>`. |+| [DL3038](https://github.com/hadolint/hadolint/wiki/DL3038) | Warning | Use the `-y` switch to avoid manual input `dnf install -y <package>` |+| [DL3040](https://github.com/hadolint/hadolint/wiki/DL3040) | Warning | `dnf clean all` missing after dnf command. |+| [DL3041](https://github.com/hadolint/hadolint/wiki/DL3041) | Warning | Specify version with `dnf install -y <package>-<version>` |+| [DL3042](https://github.com/hadolint/hadolint/wiki/DL3042) | Warning | Avoid cache directory with `pip install --no-cache-dir <package>`. |+| [DL3043](https://github.com/hadolint/hadolint/wiki/DL3043) | Error | `ONBUILD`, `FROM` or `MAINTAINER` triggered from within `ONBUILD` instruction. |+| [DL3044](https://github.com/hadolint/hadolint/wiki/DL3044) | Error | Do not refer to an environment variable within the same `ENV` statement where it is defined. |+| [DL3045](https://github.com/hadolint/hadolint/wiki/DL3045) | Warning | `COPY` to a relative destination without `WORKDIR` set. |+| [DL3046](https://github.com/hadolint/hadolint/wiki/DL3046) | Warning | `useradd` without flag `-l` and high UID will result in excessively large Image. |+| [DL3047](https://github.com/hadolint/hadolint/wiki/DL3047) | Info | `wget` without flag `--progress` will result in excessively bloated build logs when downloading larger files. |+| [DL3048](https://github.com/hadolint/hadolint/wiki/DL3048) | Style | Invalid Label Key |+| [DL3049](https://github.com/hadolint/hadolint/wiki/DL3049) | Info | Label `<label>` is missing. |+| [DL3050](https://github.com/hadolint/hadolint/wiki/DL3050) | Info | Superfluous label(s) present. |+| [DL3051](https://github.com/hadolint/hadolint/wiki/DL3051) | Warning | Label `<label>` is empty. |+| [DL3052](https://github.com/hadolint/hadolint/wiki/DL3052) | Warning | Label `<label>` is not a valid URL. |+| [DL3053](https://github.com/hadolint/hadolint/wiki/DL3053) | Warning | Label `<label>` is not a valid time format - must be conform to RFC3339. |+| [DL3054](https://github.com/hadolint/hadolint/wiki/DL3054) | Warning | Label `<label>` is not a valid SPDX license identifier. |+| [DL3055](https://github.com/hadolint/hadolint/wiki/DL3055) | Warning | Label `<label>` is not a valid git hash. |+| [DL3056](https://github.com/hadolint/hadolint/wiki/DL3056) | Warning | Label `<label>` does not conform to semantic versioning. |+| [DL3057](https://github.com/hadolint/hadolint/wiki/DL3057) | IgnoreC | `HEALTHCHECK` instruction missing. |+| [DL3058](https://github.com/hadolint/hadolint/wiki/DL3058) | Warning | Label `<label>` is not a valid email format - must be conform to RFC5322. |+| [DL3059](https://github.com/hadolint/hadolint/wiki/DL3059) | Info | Multiple consecutive `RUN` instructions. Consider consolidation. |+| [DL3060](https://github.com/hadolint/hadolint/wiki/DL3060) | Info | `yarn cache clean` missing after `yarn install` was run. |+| [DL4000](https://github.com/hadolint/hadolint/wiki/DL4000) | Error | MAINTAINER is deprecated. |+| [DL4001](https://github.com/hadolint/hadolint/wiki/DL4001) | Warning | Either use Wget or Curl but not both. |+| [DL4003](https://github.com/hadolint/hadolint/wiki/DL4003) | Warning | Multiple `CMD` instructions found. |+| [DL4004](https://github.com/hadolint/hadolint/wiki/DL4004) | Error | Multiple `ENTRYPOINT` instructions found. |+| [DL4005](https://github.com/hadolint/hadolint/wiki/DL4005) | Warning | Use `SHELL` to change the default shell. |+| [DL4006](https://github.com/hadolint/hadolint/wiki/DL4006) | Warning | Set the `SHELL` option -o pipefail before `RUN` with a pipe in it |+| [SC1000](https://github.com/koalaman/shellcheck/wiki/SC1000) | | `$` is not used specially and should therefore be escaped. |+| [SC1001](https://github.com/koalaman/shellcheck/wiki/SC1001) | | This `\c` will be a regular `'c'` in this context. |+| [SC1007](https://github.com/koalaman/shellcheck/wiki/SC1007) | | Remove space after `=` if trying to assign a value (or for empty string, use `var='' ...`). |+| [SC1010](https://github.com/koalaman/shellcheck/wiki/SC1010) | | Use semicolon or linefeed before `done` (or quote to make it literal). |+| [SC1018](https://github.com/koalaman/shellcheck/wiki/SC1018) | | This is a unicode non-breaking space. Delete it and retype as space. |+| [SC1035](https://github.com/koalaman/shellcheck/wiki/SC1035) | | You need a space here |+| [SC1045](https://github.com/koalaman/shellcheck/wiki/SC1045) | | It's not `foo &; bar`, just `foo & bar`. |+| [SC1065](https://github.com/koalaman/shellcheck/wiki/SC1065) | | Trying to declare parameters? Don't. Use `()` and refer to params as `$1`, `$2` etc. |+| [SC1066](https://github.com/koalaman/shellcheck/wiki/SC1066) | | Don't use $ on the left side of assignments. |+| [SC1068](https://github.com/koalaman/shellcheck/wiki/SC1068) | | Don't put spaces around the `=` in assignments. |+| [SC1077](https://github.com/koalaman/shellcheck/wiki/SC1077) | | For command expansion, the tick should slant left (\` vs ´). |+| [SC1078](https://github.com/koalaman/shellcheck/wiki/SC1078) | | Did you forget to close this double-quoted string? |+| [SC1079](https://github.com/koalaman/shellcheck/wiki/SC1079) | | This is actually an end quote, but due to next char, it looks suspect. |+| [SC1081](https://github.com/koalaman/shellcheck/wiki/SC1081) | | Scripts are case sensitive. Use `if`, not `If`. |+| [SC1083](https://github.com/koalaman/shellcheck/wiki/SC1083) | | This `{/}` is literal. Check expression (missing `;/\n`?) or quote it. |+| [SC1086](https://github.com/koalaman/shellcheck/wiki/SC1086) | | Don't use `$` on the iterator name in for loops. |+| [SC1087](https://github.com/koalaman/shellcheck/wiki/SC1087) | | Braces are required when expanding arrays, as in `${array[idx]}`. |+| [SC1095](https://github.com/koalaman/shellcheck/wiki/SC1095) | | You need a space or linefeed between the function name and body. |+| [SC1097](https://github.com/koalaman/shellcheck/wiki/SC1097) | | Unexpected `==`. For assignment, use `=`. For comparison, use `[ .. ]` or `[[ .. ]]`. |+| [SC1098](https://github.com/koalaman/shellcheck/wiki/SC1098) | | Quote/escape special characters when using `eval`, e.g. `eval "a=(b)"`. |+| [SC1099](https://github.com/koalaman/shellcheck/wiki/SC1099) | | You need a space before the `#`. |+| [SC2002](https://github.com/koalaman/shellcheck/wiki/SC2002) | | Useless cat. Consider <code>cmd < file | ..</code> or <code>cmd file | ..</code> instead. |+| [SC2015](https://github.com/koalaman/shellcheck/wiki/SC2015) | | Note that <code>A && B || C</code> is not if-then-else. C may run when A is true. |+| [SC2026](https://github.com/koalaman/shellcheck/wiki/SC2026) | | This word is outside of quotes. Did you intend to 'nest '"'single quotes'"' instead'? |+| [SC2028](https://github.com/koalaman/shellcheck/wiki/SC2028) | | `echo` won't expand escape sequences. Consider `printf`. |+| [SC2035](https://github.com/koalaman/shellcheck/wiki/SC2035) | | Use `./*glob*` or `-- *glob*` so names with dashes won't become options. |+| [SC2039](https://github.com/koalaman/shellcheck/wiki/SC2039) | | In POSIX sh, something is undefined. |+| [SC2046](https://github.com/koalaman/shellcheck/wiki/SC2046) | | Quote this to prevent word splitting |+| [SC2086](https://github.com/koalaman/shellcheck/wiki/SC2086) | | Double quote to prevent globbing and word splitting. |+| [SC2140](https://github.com/koalaman/shellcheck/wiki/SC2140) | | Word is in the form `"A"B"C"` (B indicated). Did you mean `"ABC"` or `"A\"B\"C"`? |+| [SC2154](https://github.com/koalaman/shellcheck/wiki/SC2154) | | var is referenced but not assigned. |+| [SC2155](https://github.com/koalaman/shellcheck/wiki/SC2155) | | Declare and assign separately to avoid masking return values. |+| [SC2164](https://github.com/koalaman/shellcheck/wiki/SC2164) | | Use <code>cd ... || exit</code> in case `cd` fails. |+<!--lint enable maximum-line-length--> ## Develop @@ -407,8 +515,9 @@ ### AST -Dockerfile syntax is fully described in the [Dockerfile reference][]. Just take-a look at [Syntax.hs][] in the `language-docker` project to see the AST definition.+Dockerfile syntax is fully described in the [Dockerfile reference][].+Just take a look at [Syntax.hs][] in the `language-docker` project to see+the AST definition. ## Alternatives
hadolint.cabal view
@@ -5,7 +5,7 @@ -- see: https://github.com/sol/hpack name: hadolint-version: 2.6.1+version: 2.7.0 synopsis: Dockerfile Linter JavaScript API description: A smarter Dockerfile linter that helps you build best practice Docker images. category: Development@@ -60,7 +60,6 @@ Hadolint.Rule.DL3014 Hadolint.Rule.DL3015 Hadolint.Rule.DL3016- Hadolint.Rule.DL3017 Hadolint.Rule.DL3018 Hadolint.Rule.DL3019 Hadolint.Rule.DL3020@@ -74,7 +73,6 @@ Hadolint.Rule.DL3028 Hadolint.Rule.DL3029 Hadolint.Rule.DL3030- Hadolint.Rule.DL3031 Hadolint.Rule.DL3032 Hadolint.Rule.DL3033 Hadolint.Rule.DL3034@@ -82,7 +80,6 @@ Hadolint.Rule.DL3036 Hadolint.Rule.DL3037 Hadolint.Rule.DL3038- Hadolint.Rule.DL3039 Hadolint.Rule.DL3040 Hadolint.Rule.DL3041 Hadolint.Rule.DL3042@@ -144,7 +141,7 @@ , filepath , foldl , ilist- , language-docker >=10.0.0 && <11+ , language-docker >=10.1.0 && <11 , megaparsec >=9.0.0 , mtl , network-uri@@ -181,7 +178,7 @@ , containers , gitrev >=1.3.1 , hadolint- , language-docker >=10.0.0 && <11+ , language-docker >=10.1.0 && <11 , megaparsec >=9.0.0 , optparse-applicative >=0.14.0 , text@@ -211,7 +208,6 @@ DL3014 DL3015 DL3016- DL3017 DL3018 DL3019 DL3020@@ -225,7 +221,6 @@ DL3028 DL3029 DL3030- DL3031 DL3032 DL3033 DL3034@@ -233,7 +228,6 @@ DL3036 DL3037 DL3038- DL3039 DL3040 DL3041 DL3042@@ -290,7 +284,7 @@ , foldl , hadolint , hspec- , language-docker >=10.0.0 && <11+ , language-docker >=10.1.0 && <11 , megaparsec >=9.0.0 , split >=0.2 , text
src/Hadolint/Process.hs view
@@ -25,7 +25,6 @@ import qualified Hadolint.Rule.DL3014 import qualified Hadolint.Rule.DL3015 import qualified Hadolint.Rule.DL3016-import qualified Hadolint.Rule.DL3017 import qualified Hadolint.Rule.DL3018 import qualified Hadolint.Rule.DL3019 import qualified Hadolint.Rule.DL3020@@ -39,7 +38,6 @@ import qualified Hadolint.Rule.DL3028 import qualified Hadolint.Rule.DL3029 import qualified Hadolint.Rule.DL3030-import qualified Hadolint.Rule.DL3031 import qualified Hadolint.Rule.DL3032 import qualified Hadolint.Rule.DL3033 import qualified Hadolint.Rule.DL3034@@ -47,7 +45,6 @@ import qualified Hadolint.Rule.DL3036 import qualified Hadolint.Rule.DL3037 import qualified Hadolint.Rule.DL3038-import qualified Hadolint.Rule.DL3039 import qualified Hadolint.Rule.DL3040 import qualified Hadolint.Rule.DL3041 import qualified Hadolint.Rule.DL3042@@ -156,7 +153,6 @@ <> Hadolint.Rule.DL3014.rule <> Hadolint.Rule.DL3015.rule <> Hadolint.Rule.DL3016.rule- <> Hadolint.Rule.DL3017.rule <> Hadolint.Rule.DL3018.rule <> Hadolint.Rule.DL3019.rule <> Hadolint.Rule.DL3020.rule@@ -170,7 +166,6 @@ <> Hadolint.Rule.DL3028.rule <> Hadolint.Rule.DL3029.rule <> Hadolint.Rule.DL3030.rule- <> Hadolint.Rule.DL3031.rule <> Hadolint.Rule.DL3032.rule <> Hadolint.Rule.DL3033.rule <> Hadolint.Rule.DL3034.rule@@ -178,7 +173,6 @@ <> Hadolint.Rule.DL3036.rule <> Hadolint.Rule.DL3037.rule <> Hadolint.Rule.DL3038.rule- <> Hadolint.Rule.DL3039.rule <> Hadolint.Rule.DL3040.rule <> Hadolint.Rule.DL3041.rule <> Hadolint.Rule.DL3042.rule
src/Hadolint/Rule.hs view
@@ -195,3 +195,22 @@ case fromInstr of From BaseImage {alias = Just (ImageAlias as)} -> predicate as _ -> True++archiveFileFormatExtensions :: [Text.Text]+archiveFileFormatExtensions =+ [ ".tar",+ ".Z",+ ".bz2",+ ".gz",+ ".lz",+ ".lzma",+ ".tZ",+ ".tb2",+ ".tbz",+ ".tbz2",+ ".tgz",+ ".tlz",+ ".tpz",+ ".txz",+ ".xz"+ ]
src/Hadolint/Rule/DL3010.hs view
@@ -11,28 +11,11 @@ code = "DL3010" severity = DLInfoC message = "Use ADD for extracting archives into an image"- check (Copy (CopyArgs srcs _ _ _ _)) =+ check (Copy (CopyArgs srcs _ _ _ NoSource)) = and [ not (format `Text.isSuffixOf` src) | SourcePath src <- toList srcs,- format <- archiveFormats+ format <- archiveFileFormatExtensions ] check _ = True- archiveFormats =- [ ".tar",- ".tar.bz2",- ".tb2",- ".tbz",- ".tbz2",- ".tar.gz",- ".tgz",- ".tpz",- ".tar.lz",- ".tar.lzma",- ".tlz",- ".tar.xz",- ".txz",- ".tar.Z",- ".tZ"- ] {-# INLINEABLE rule #-}
− src/Hadolint/Rule/DL3017.hs
@@ -1,16 +0,0 @@-module Hadolint.Rule.DL3017 (rule) where--import Hadolint.Rule-import Hadolint.Shell (ParsedShell)-import qualified Hadolint.Shell as Shell-import Language.Docker.Syntax--rule :: Rule ParsedShell-rule = simpleRule code severity message check- where- code = "DL3017"- severity = DLErrorC- message = "Do not use apk upgrade"- check (Run (RunArgs args _)) = foldArguments (Shell.noCommands (Shell.cmdHasArgs "apk" ["upgrade"])) args- check _ = True-{-# INLINEABLE rule #-}
src/Hadolint/Rule/DL3020.hs view
@@ -21,23 +21,7 @@ isArchive path = or ( [ ftype `Text.isSuffixOf` path- | ftype <-- [ ".tar",- ".gz",- ".bz2",- ".xz",- ".zip",- ".tgz",- ".tb2",- ".tbz",- ".tbz2",- ".lz",- ".lzma",- ".tlz",- ".txz",- ".Z",- ".tZ"- ]+ | ftype <- archiveFileFormatExtensions ] )
− src/Hadolint/Rule/DL3031.hs
@@ -1,27 +0,0 @@-module Hadolint.Rule.DL3031 (rule) where--import Hadolint.Rule-import qualified Hadolint.Shell as Shell-import Language.Docker.Syntax--rule :: Rule Shell.ParsedShell-rule = simpleRule code severity message check- where- code = "DL3031"- severity = DLErrorC- message = "Do not use yum update."- check (Run (RunArgs args _)) =- foldArguments- ( Shell.noCommands- ( Shell.cmdHasArgs- "yum"- [ "update",- "update-to",- "upgrade",- "upgrade-to"- ]- )- )- args- check _ = True-{-# INLINEABLE rule #-}
src/Hadolint/Rule/DL3035.hs view
@@ -9,16 +9,14 @@ where code = "DL3035" severity = DLWarningC- message = "Do not use `zypper update`."+ message = "Do not use `zypper dist-upgrade`." check (Run (RunArgs args _)) = foldArguments ( Shell.noCommands ( Shell.cmdHasArgs "zypper"- [ "update",- "up",- "dist-upgrade",+ [ "dist-upgrade", "dup" ] )
− src/Hadolint/Rule/DL3039.hs
@@ -1,26 +0,0 @@-module Hadolint.Rule.DL3039 (rule) where--import Hadolint.Rule-import qualified Hadolint.Shell as Shell-import Language.Docker.Syntax--rule :: Rule Shell.ParsedShell-rule = simpleRule code severity message check- where- code = "DL3039"- severity = DLErrorC- message = "Do not use dnf update."-- check (Run (RunArgs args _)) =- foldArguments- ( Shell.noCommands- ( Shell.cmdHasArgs- "dnf"- [ "upgrade",- "upgrade-minimal"- ]- )- )- args- check _ = True-{-# INLINEABLE rule #-}
src/Hadolint/Shell.hs view
@@ -61,7 +61,7 @@ shellcheck :: ShellOpts -> ParsedShell -> [PositionedComment] shellcheck (ShellOpts sh env) (ParsedShell txt _ _) =- if any (`Text.isPrefixOf` sh) nonPosixShells+ if any (`Text.isPrefixOf` sh) nonPosixShells || hasUnsupportedShebang txt then [] -- Do no run for non-posix shells i.e. powershell, cmd.exe else runShellCheck where@@ -87,6 +87,19 @@ nonPosixShells :: [Text.Text] nonPosixShells = ["pwsh", "powershell", "cmd"]++hasUnsupportedShebang :: Text.Text -> Bool+hasUnsupportedShebang script =+ "#!" `Text.isPrefixOf` script &&+ not ( any (`Text.isPrefixOf` script)+ [ "#!/bin/sh",+ "#!/bin/bash",+ "#!/bin/ksh",+ "#!/usr/bin/env sh",+ "#!/usr/bin/env bash",+ "#!/usr/bin/env ksh"+ ]+ ) parseShell :: Text.Text -> ParsedShell parseShell txt = ParsedShell {original = txt, parsed = parsedResult, presentCommands = commands}
test/DL3010.hs view
@@ -10,3 +10,4 @@ describe "COPY rules" $ do it "use add" $ ruleCatches "DL3010" "COPY packaged-app.tar /usr/src/app" it "use not add" $ ruleCatchesNot "DL3010" "COPY package.json /usr/src/app"+ it "ignore: copy from previous stage" $ ruleCatchesNot "DL3010" "COPY --from=builder /usr/local/share/some.tar /opt/some.tar"
− test/DL3017.hs
@@ -1,13 +0,0 @@-module DL3017 (tests) where--import Helpers-import Test.Hspec---tests :: SpecWith ()-tests = do- let ?rulesConfig = mempty- describe "DL3017 - Do not use `apk upgrade`." $ do- it "apk upgrade" $ do- ruleCatches "DL3017" "RUN apk update && apk upgrade"- onBuildRuleCatches "DL3017" "RUN apk update && apk upgrade"
test/DL3020.hs view
@@ -9,10 +9,10 @@ let ?rulesConfig = mempty describe "DL3020 - Use `COPY` instead of `ADD` for files and folders." $ do it "add for tar" $ ruleCatchesNot "DL3020" "ADD file.tar /usr/src/app/"- it "add for zip" $ ruleCatchesNot "DL3020" "ADD file.zip /usr/src/app/" it "add for gzip" $ ruleCatchesNot "DL3020" "ADD file.gz /usr/src/app/" it "add for bz2" $ ruleCatchesNot "DL3020" "ADD file.bz2 /usr/src/app/" it "add for xz" $ ruleCatchesNot "DL3020" "ADD file.xz /usr/src/app/" it "add for tgz" $ ruleCatchesNot "DL3020" "ADD file.tgz /usr/src/app/" it "add for url" $ ruleCatchesNot "DL3020" "ADD http://file.com /usr/src/app/" it "using add" $ ruleCatches "DL3020" "ADD file /usr/src/app/"+ it "warn for zip" $ ruleCatches "DL3020" "ADD file.zip /usr/src/app/"
− test/DL3031.hs
@@ -1,18 +0,0 @@-module DL3031 (tests) where--import Helpers-import Test.Hspec---tests :: SpecWith ()-tests = do- let ?rulesConfig = mempty- describe "DL3031" $ do- it "yum update" $ do- ruleCatches "DL3031" "RUN yum update"- onBuildRuleCatches "DL3031" "RUN yum update"- it "not yum update" $ do- ruleCatchesNot "DL3031" "RUN yum install -y httpd-2.4.42 && yum clean all"- ruleCatchesNot "DL3031" "RUN bash -c `# not even a yum command`"- onBuildRuleCatchesNot "DL3031" "RUN yum install -y httpd-2.4.42 && yum clean all"- onBuildRuleCatchesNot "DL3031" "RUN bash -c `# not even a yum command`"
test/DL3035.hs view
@@ -8,11 +8,6 @@ tests = do let ?rulesConfig = mempty describe "DL3035" $ do- it "not ok: zypper update" $ do- ruleCatches "DL3035" "RUN zypper update"- ruleCatches "DL3035" "RUN zypper up"- onBuildRuleCatches "DL3035" "RUN zypper update"- onBuildRuleCatches "DL3035" "RUN zypper up" it "not ok: zypper dist-upgrade" $ do ruleCatches "DL3035" "RUN zypper dist-upgrade" ruleCatches "DL3035" "RUN zypper dup"
− test/DL3039.hs
@@ -1,18 +0,0 @@-module DL3039 (tests) where--import Helpers-import Test.Hspec---tests :: SpecWith ()-tests = do- let ?rulesConfig = mempty- describe "DL3039" $ do- it "dnf update" $ do- ruleCatches "DL3039" "RUN dnf upgrade"- ruleCatches "DL3039" "RUN dnf upgrade-minimal"- onBuildRuleCatches "DL3039" "RUN dnf upgrade"- onBuildRuleCatches "DL3039" "RUN dnf upgrade-minimal"- it "not dnf upgrade" $ do- ruleCatchesNot "DL3039" "RUN notdnf upgrade"- onBuildRuleCatchesNot "DL3039" "RUN notdnf upgrade"
test/Spec.hs view
@@ -17,7 +17,6 @@ import qualified DL3014 import qualified DL3015 import qualified DL3016-import qualified DL3017 import qualified DL3018 import qualified DL3019 import qualified DL3020@@ -31,7 +30,6 @@ import qualified DL3028 import qualified DL3029 import qualified DL3030-import qualified DL3031 import qualified DL3032 import qualified DL3033 import qualified DL3034@@ -39,7 +37,6 @@ import qualified DL3036 import qualified DL3037 import qualified DL3038-import qualified DL3039 import qualified DL3040 import qualified DL3041 import qualified DL3042@@ -188,7 +185,6 @@ DL3014.tests DL3015.tests DL3016.tests- DL3017.tests DL3018.tests DL3019.tests DL3020.tests@@ -202,7 +198,6 @@ DL3028.tests DL3029.tests DL3030.tests- DL3031.tests DL3032.tests DL3033.tests DL3034.tests@@ -210,7 +205,6 @@ DL3036.tests DL3037.tests DL3038.tests- DL3039.tests DL3040.tests DL3041.tests DL3042.tests