Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issue with DL3008 and its documentation #999

Open
2 of 3 tasks
eandersons opened this issue Feb 2, 2024 · 0 comments
Open
2 of 3 tasks

Issue with DL3008 and its documentation #999

eandersons opened this issue Feb 2, 2024 · 0 comments

Comments

@eandersons
Copy link

  • This is a bug report
  • This is a feature request
  • I searched existing issues before opening this one

Expected behavior

  1. Best Dockerfile practices link in DL3008 page points to https://docs.docker.com/develop/develop-images/instructions/#apt-get.

  2. Either version pinning or cache busting with apt-get update is taken into account to mitigate outdated package retrieval from build cache, therefore DL3008 is not reported.

    From apt-get best Dockerfile practices instructions:

    Using RUN apt-get update && apt-get install -y ensures your Dockerfile installs the latest package versions with no further coding or manual intervention. This technique is known as cache busting. You can also achieve cache busting by specifying a package version. This is known as version pinning.

    Taking this into account the current rationale and behaviour of DL3008 seems a bit outdated (examples in the aforementioned link confirms that).

    I am aware that version pinning still should be preferred, but in my opinion that should not be enforced or should be added as a separate rule that could be disabled when it would not be desirable.

Actual behavior

  1. Best Dockerfile practices link in DL3008 page points to https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#apt-get, where nothing is mentioned about apt-get.
  2. Cache busting with apt-get update and apt-get install in the same RUN instruction currently is not taken into account thus reporting DL3008.

Steps to reproduce the behavior

Output of hadolint --version:

Haskell Dockerfile Linter 2.12.0

Dockerfile (if relevant)

FROM gitpod/openvscode-server:1.85.1
RUN apt-get update && \
  apt-get --assume-yes install --no-install-recommends
    less \
    micro

Additional environment details (OS, stack version, etc.)

Ubuntu 22.04.3 LTS in a Docker container.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant