Hadolint提升Dockerfile的质量和安全性 —— 筑梦之路

https://github.com/hadolint/hadolint

hadolint 在线版本:https://hadolint.github.io/hadolint/

bash 复制代码
FROM debian
RUN export node_version="0.10" \
&& apt-get update && apt-get -y install nodejs="$node_verion"
COPY package.json usr/src/app
RUN cd /usr/src/app \
&& npm install node-static

EXPOSE 80000
CMD ["npm", "start"]
bash 复制代码
nerdctl run --rm -i hadolint/hadolint < Dockerfile

-:1 DL3006 warning: Always tag the version of an image explicitly
-:2 DL3015 info: Avoid additional packages by specifying `--no-install-recommends`
-:2 DL3009 info: Delete the apt-get lists after installing something
-:2 SC2154 warning: node_verion is referenced but not assigned (did you mean 'node_version'?).
-:4 DL3045 warning: `COPY` to a relative destination without `WORKDIR` set.
-:5 DL3003 warning: Use WORKDIR to switch to a directory
-:5 DL3016 warning: Pin versions in npm. Instead of `npm install <package>` use `npm install <package>@<version>`
-:8 DL3011 error: Valid UNIX ports range from 0 to 65535

指定忽略的规则

如何你想忽略某些规则,在项目目录下创建hadolint.yaml文件,并指定要忽略的规则

bash 复制代码
ignored:
  - DL3011

运行Hadolint时指定配置文件

bash 复制代码
nerdctl run --rm -i -v /root/hadolint-demo/hadolint.yaml:/.config/hadolint.yaml hadolint/hadolint < Dockerfile
bash 复制代码
-:1 DL3006 warning: Always tag the version of an image explicitly
-:2 SC2154 warning: node_verion is referenced but not assigned (did you mean 'node_version'?).
-:2 DL3009 info: Delete the apt-get lists after installing something
-:2 DL3015 info: Avoid additional packages by specifying `--no-install-recommends`
-:4 DL3045 warning: `COPY` to a relative destination without `WORKDIR` set.
-:5 DL3003 warning: Use WORKDIR to switch to a directory
-:5 DL3016 warning: Pin versions in npm. Instead of `npm install <package>` use `npm install <package>@<version>`

为了确保Dockerfiles的质量和安全性,将Hadolint集成到开发工作流程中是一个明智之举。这样可以在代码编写、提交前以及持续集成(CI)过程中自动检测潜在问题。以下是一些常见的集成方式:

  • 代码审查平台集成

https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#code-review

  • 持续集成

https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#continuous-integration

  • 编辑器集成

https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#editors

  • 版本控制集成

https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#version-control

相关推荐
TeYiToKu24 分钟前
笔记整理—linux驱动开发部分(9)framebuffer驱动框架
linux·c语言·arm开发·驱动开发·笔记·嵌入式硬件·arm
dsywws26 分钟前
Linux学习笔记之时间日期和查找和解压缩指令
linux·笔记·学习
yeyuningzi34 分钟前
Debian 12环境里部署nginx步骤记录
linux·运维·服务器
上辈子杀猪这辈子学IT1 小时前
【Zookeeper集群搭建】安装zookeeper、zookeeper集群配置、zookeeper启动与关闭、zookeeper的shell命令操作
linux·hadoop·zookeeper·centos·debian
minihuabei1 小时前
linux centos 安装redis
linux·redis·centos
lldhsds2 小时前
书生大模型实战营第四期-入门岛-1. Linux前置基础
linux
wowocpp2 小时前
ubuntu 22.04 硬件配置 查看 显卡
linux·运维·ubuntu
山河君3 小时前
ubuntu使用DeepSpeech进行语音识别(包含交叉编译)
linux·ubuntu·语音识别
鹏大师运维3 小时前
【功能介绍】信创终端系统上各WPS版本的授权差异
linux·wps·授权·麒麟·国产操作系统·1024程序员节·统信uos
筱源源3 小时前
Elasticsearch-linux环境部署
linux·elasticsearch