Hadolint提升Dockerfile的质量和安全性 —— 筑梦之路

https://github.com/hadolint/hadolint

hadolint 在线版本：https://hadolint.github.io/hadolint/

FROM debian RUN export node_version="0.10" \ && apt-get update && apt-get -y install nodejs="$node_verion" COPY package.json usr/src/app RUN cd /usr/src/app \ && npm install node-static  EXPOSE 80000 CMD ["npm", "start"]

nerdctl run --rm -i hadolint/hadolint < Dockerfile  -:1 DL3006 warning: Always tag the version of an image explicitly -:2 DL3015 info: Avoid additional packages by specifying `--no-install-recommends` -:2 DL3009 info: Delete the apt-get lists after installing something -:2 SC2154 warning: node_verion is referenced but not assigned (did you mean 'node_version'?). -:4 DL3045 warning: `COPY` to a relative destination without `WORKDIR` set. -:5 DL3003 warning: Use WORKDIR to switch to a directory -:5 DL3016 warning: Pin versions in npm. Instead of `npm install <package>` use `npm install <package>@<version>` -:8 DL3011 error: Valid UNIX ports range from 0 to 65535

指定忽略的规则

如何你想忽略某些规则，在项目目录下创建hadolint.yaml文件，并指定要忽略的规则

ignored:   - DL3011

运行Hadolint时指定配置文件

nerdctl run --rm -i -v /root/hadolint-demo/hadolint.yaml:/.config/hadolint.yaml hadolint/hadolint < Dockerfile

-:1 DL3006 warning: Always tag the version of an image explicitly -:2 SC2154 warning: node_verion is referenced but not assigned (did you mean 'node_version'?). -:2 DL3009 info: Delete the apt-get lists after installing something -:2 DL3015 info: Avoid additional packages by specifying `--no-install-recommends` -:4 DL3045 warning: `COPY` to a relative destination without `WORKDIR` set. -:5 DL3003 warning: Use WORKDIR to switch to a directory -:5 DL3016 warning: Pin versions in npm. Instead of `npm install <package>` use `npm install <package>@<version>`

为了确保Dockerfiles的质量和安全性，将Hadolint集成到开发工作流程中是一个明智之举。这样可以在代码编写、提交前以及持续集成(CI)过程中自动检测潜在问题。以下是一些常见的集成方式：

• 代码审查平台集成

https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#code-review

• 持续集成

https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#continuous-integration

• 编辑器集成

https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#editors

• 版本控制集成

https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md#version-control