You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Either version pinning or cache busting with apt-get update is taken into account to mitigate outdated package retrieval from build cache, therefore DL3008 is not reported.
Using RUN apt-get update && apt-get install -y ensures your Dockerfile installs the latest package versions with no further coding or manual intervention. This technique is known as cache busting. You can also achieve cache busting by specifying a package version. This is known as version pinning.
Taking this into account the current rationale and behaviour of DL3008 seems a bit outdated (examples in the aforementioned link confirms that).
I am aware that version pinning still should be preferred, but in my opinion that should not be enforced or should be added as a separate rule that could be disabled when it would not be desirable.
Expected behavior
Best Dockerfile practices link in DL3008 page points to https://docs.docker.com/develop/develop-images/instructions/#apt-get.
Either version pinning or cache busting with
apt-get update
is taken into account to mitigate outdated package retrieval from build cache, therefore DL3008 is not reported.From
apt-get
best Dockerfile practices instructions:Taking this into account the current rationale and behaviour of DL3008 seems a bit outdated (examples in the aforementioned link confirms that).
I am aware that version pinning still should be preferred, but in my opinion that should not be enforced or should be added as a separate rule that could be disabled when it would not be desirable.
Actual behavior
apt-get
.apt-get update
andapt-get install
in the sameRUN
instruction currently is not taken into account thus reporting DL3008.Steps to reproduce the behavior
Output of
hadolint --version
:Dockerfile (if relevant)
Additional environment details (OS, stack version, etc.)
Ubuntu 22.04.3 LTS in a Docker container.
The text was updated successfully, but these errors were encountered: