Merge pull request #430 from jstourac/codeQuality

openshift-merge-bot[bot] · web-flow · commit 2ffa89508c4d · 2024-02-26T14:34:09.000Z
Add hadolint checks for Dockerfiles
diff --git a/.github/workflows/code-quality.yaml b/.github/workflows/code-quality.yaml
@@ -40,3 +40,13 @@ jobs:
               echo "There were errors in some of the checked files. Please run `json_verify` on such files and fix issues there."
           fi
           exit "${ret_code}"
+
+      - name: Validate Dockerfiles
+        id: validate-dockerfiles
+        run: |
+          type hadolint || sudo apt-get -y install wget \
+                             && wget --output-document=hadolint https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64 \
+                             && chmod a+x hadolint
+          echo "Starting Hadolint"
+          find . -name "Dockerfile" | xargs ./hadolint --config ./ci/hadolint-config.yaml
+          echo "Hadolint done"
diff --git a/base/anaconda-python-3.8/Dockerfile b/base/anaconda-python-3.8/Dockerfile
@@ -79,7 +79,7 @@ ENV BASH_ENV="source /opt/anaconda3/bin/activate ${APP_ROOT}" \
 USER 1001
 
 # Set the default CMD to print the usage of the language image.
-CMD $STI_SCRIPTS_PATH/usage
+CMD ["$STI_SCRIPTS_PATH/usage"]
 
 
 FROM s2i-python-anaconda-38-base
diff --git a/base/c9s-python-3.9/Dockerfile b/base/c9s-python-3.9/Dockerfile
@@ -13,7 +13,7 @@ LABEL name="odh-notebook-base-centos-stream9-python-3.9" \
 WORKDIR /opt/app-root/bin
 
 # Install micropipenv to deploy packages from Pipfile.lock
-RUN pip install -U "micropipenv[toml]"
+RUN pip install --no-cache-dir -U "micropipenv[toml]"
 
 # Install Python dependencies from Pipfile.lock file
 COPY Pipfile.lock ./
@@ -22,7 +22,7 @@ COPY Pipfile.lock ./
 USER root
 
 # Install usefull OS packages
-RUN dnf install -y mesa-libGL
+RUN dnf install -y mesa-libGL && dnf clean all && rm -rf /var/cache/yum
 
 # Other apps and tools installed as default user
 USER 1001
diff --git a/base/ubi8-python-3.8/Dockerfile b/base/ubi8-python-3.8/Dockerfile
@@ -13,7 +13,7 @@ LABEL name="odh-notebook-base-ubi8-python-3.8" \
 WORKDIR /opt/app-root/bin
 
 # Install micropipenv to deploy packages from Pipfile.lock
-RUN pip install -U "micropipenv[toml]"
+RUN pip install --no-cache-dir -U "micropipenv[toml]"
 
 # Install Python dependencies from Pipfile.lock file
 COPY Pipfile.lock ./
diff --git a/base/ubi9-python-3.9/Dockerfile b/base/ubi9-python-3.9/Dockerfile
@@ -13,7 +13,7 @@ LABEL name="odh-notebook-base-ubi9-python-3.9" \
 WORKDIR /opt/app-root/bin
 
 # Install micropipenv to deploy packages from Pipfile.lock
-RUN pip install -U "micropipenv[toml]"
+RUN pip install --no-cache-dir -U "micropipenv[toml]"
 
 # Install Python dependencies from Pipfile.lock file
 COPY Pipfile.lock ./
@@ -24,7 +24,7 @@ RUN echo "Installing softwares and packages" && micropipenv install && rm -f ./P
 USER root
 
 # Install usefull OS packages
-RUN dnf install -y mesa-libGL
+RUN dnf install -y mesa-libGL && dnf clean all && rm -rf /var/cache/yum
 
 # Other apps and tools installed as default user
 USER 1001
diff --git a/ci/hadolint-config.yaml b/ci/hadolint-config.yaml
@@ -0,0 +1,36 @@
+---
+
+# Reference https://github.com/hadolint/hadolint
+# hadolint --config ./ci/hadolint-config.yaml <Dockerfile>
+
+# We should revisit this ignore list and reduce it regularly
+
+ignored:
+  # DL3006 warning: Always tag the version of an image explicitly
+  - DL3006
+  # DL3033 warning: Specify version with `yum install -y <package>-<version>`.
+  - DL3033
+  # DL3045 warning: `COPY` to a relative destination without `WORKDIR` set.
+  - DL3045
+  # DL3041 warning: Specify version with `dnf install -y <package>-<version>`.
+  - DL3041
+  # DL3059 info: Multiple consecutive `RUN` instructions. Consider consolidation.
+  - DL3059
+  # DL3013 warning: Pin versions in pip. Instead of `pip install <package>` use
+  # `pip install <package>==<version>` or `pip install --requirement <requirements file>`
+  - DL3013
+  # DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it.
+  # If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox
+  # then consider explicitly setting your SHELL to /bin/ash, or disable this check
+  - DL4006
+  # DL3007 warning: Using latest is prone to errors if the image will ever update.
+  # Pin the version explicitly to a release tag
+  - DL3007
+  # SC3060 warning: In POSIX sh, string replacement is undefined.
+  - SC3060
+  # SC2086 info: Double quote to prevent globbing and word splitting.
+  - SC2086
+  # SC2046 warning: Quote this to prevent word splitting.
+  - SC2046
+  # SC2140 warning: Word is of the form "A"B"C" (B indicated). Did you mean "ABC" or "A\"B\"C"?
+  - SC2140
diff --git a/codeserver/c9s-python-3.9/Dockerfile b/codeserver/c9s-python-3.9/Dockerfile
@@ -87,4 +87,4 @@ WORKDIR /opt/app-root/src
 
 USER 1001
 
-CMD /opt/app-root/bin/run-code-server.sh
+CMD ["/opt/app-root/bin/run-code-server.sh"]
diff --git a/codeserver/ubi9-python-3.9/Dockerfile b/codeserver/ubi9-python-3.9/Dockerfile
@@ -29,7 +29,7 @@ RUN echo "Installing softwares and packages" && \
     fix-permissions /opt/app-root -P
 
 # Install usefull OS packages
-RUN dnf install -y jq git-lfs libsndfile
+RUN dnf install -y jq git-lfs libsndfile && dnf clean all && rm -rf /var/cache/yum
 
 # Install code-server
 RUN yum install -y "https://github.com/coder/code-server/releases/download/${CODESERVER_VERSION}/code-server-${CODESERVER_VERSION/v/}-amd64.rpm" && \
@@ -105,4 +105,4 @@ WORKDIR /opt/app-root/src
 
 USER 1001
 
-CMD /opt/app-root/bin/run-code-server.sh
+CMD ["/opt/app-root/bin/run-code-server.sh"]
diff --git a/jupyter/datascience/ubi8-python-3.8/Dockerfile b/jupyter/datascience/ubi8-python-3.8/Dockerfile
@@ -28,20 +28,20 @@ COPY utils ./utils/
 USER root
 
 # Install usefull OS packages
-RUN dnf install -y jq unixODBC git-lfs libsndfile
+RUN dnf install -y jq unixODBC git-lfs libsndfile && dnf clean all && rm -rf /var/cache/yum
 
 # Disable announcement plugin of jupyterlab
 RUN jupyter labextension disable "@jupyterlab/apputils-extension:announcements"
 
 # Install MongoDB Client, We need a special repo for MongoDB as they do their own distribution
 COPY mongodb-org-6.0.repo-x86_64 /etc/yum.repos.d/mongodb-org-6.0.repo
 
-RUN dnf install -y mongocli
+RUN dnf install -y mongocli && dnf clean all && rm -rf /var/cache/yum
 
 # Install MSSQL Client, We need a special repo for MSSQL as they do their own distribution
 COPY mssql-2022.repo-x86_64 /etc/yum.repos.d/mssql-2022.repo
 
-RUN ACCEPT_EULA=Y dnf install -y mssql-tools18 unixODBC-devel
+RUN ACCEPT_EULA=Y dnf install -y mssql-tools18 unixODBC-devel && dnf clean all && rm -rf /var/cache/yum
 
 ENV PATH="$PATH:/opt/mssql-tools18/bin"
 
diff --git a/jupyter/datascience/ubi9-python-3.9/Dockerfile b/jupyter/datascience/ubi9-python-3.9/Dockerfile
@@ -28,20 +28,20 @@ COPY utils ./utils/
 USER root
 
 # Install usefull OS packages
-RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile
+RUN dnf install -y jq unixODBC postgresql git-lfs libsndfile && dnf clean all && rm -rf /var/cache/yum
 
 # Disable announcement plugin of jupyterlab
 RUN jupyter labextension disable "@jupyterlab/apputils-extension:announcements"
 
 # Install MongoDB Client, We need a special repo for MongoDB as they do their own distribution
 COPY mongodb-org-6.0.repo-x86_64 /etc/yum.repos.d/mongodb-org-6.0.repo
 
-RUN dnf install -y mongocli
+RUN dnf install -y mongocli && dnf clean all && rm -rf /var/cache/yum
 
 # Install MSSQL Client, We need a special repo for MSSQL as they do their own distribution
 COPY mssql-2022.repo-x86_64 /etc/yum.repos.d/mssql-2022.repo
 
-RUN ACCEPT_EULA=Y dnf install -y mssql-tools18 unixODBC-devel
+RUN ACCEPT_EULA=Y dnf install -y mssql-tools18 unixODBC-devel && dnf clean all && rm -rf /var/cache/yum
 
 ENV PATH="$PATH:/opt/mssql-tools18/bin"
 
diff --git a/rstudio/c9s-python-3.9/Dockerfile b/rstudio/c9s-python-3.9/Dockerfile
@@ -37,7 +37,7 @@ ENV R_LIBS_USER /opt/app-root/src/Rpackages/4.3
 WORKDIR /tmp/
 
 # Install RStudio
-RUN wget https://download2.rstudio.org/server/rhel9/x86_64/rstudio-server-rhel-2023.06.1-524-x86_64.rpm && \
+RUN wget --progress=dot:giga https://download2.rstudio.org/server/rhel9/x86_64/rstudio-server-rhel-2023.06.1-524-x86_64.rpm && \
     yum install -y rstudio-server-rhel-2023.06.1-524-x86_64.rpm && \
     rm rstudio-server-rhel-2023.06.1-524-x86_64.rpm && \
     yum -y clean all  --enablerepo='*'
@@ -48,7 +48,8 @@ RUN chmod 1777 /var/run/rstudio-server && \
 COPY rsession.conf /etc/rstudio/rsession.conf
 
 # package installation 
-RUN dnf install -y libsodium-devel.x86_64 libgit2-devel.x86_64 libcurl-devel harfbuzz-devel.x86_64 fribidi-devel.x86_64 cmake "flexiblas-*"
+RUN dnf install -y libsodium-devel.x86_64 libgit2-devel.x86_64 libcurl-devel harfbuzz-devel.x86_64 fribidi-devel.x86_64 cmake "flexiblas-*" \
+    && dnf clean all && rm -rf /var/cache/yum
 RUN R -e "install.packages('Rcpp')"
 
 # Install NGINX to proxy RStudio and pass probes check 
@@ -118,4 +119,4 @@ WORKDIR /opt/app-root/src
 
 USER 1001
 
-CMD /opt/app-root/bin/run-rstudio.sh
+CMD ["/opt/app-root/bin/run-rstudio.sh"]

Original file line number	Diff line number	Diff line change
`@@ -87,4 +87,4 @@ WORKDIR /opt/app-root/src`
`87`	`87`
`88`	`88`	`USER 1001`
`89`	`89`
`90`		`-CMD /opt/app-root/bin/run-code-server.sh`
	`90`	`+CMD ["/opt/app-root/bin/run-code-server.sh"]`