Skip to content

Conversation

jonasbardino
Copy link
Contributor

The recently added hadolint Action should help identify various suboptimal or directly broken constructs in our Dockerfiles before they come back to bite us.
One can also manually test e.g. with the docker version using:

docker run --rm -i hadolint/hadolint < Dockerfile

@jonasbardino jonasbardino self-assigned this Jul 16, 2025
@jonasbardino jonasbardino added enhancement New feature or request help wanted Extra attention is needed labels Jul 16, 2025
@jonasbardino jonasbardino force-pushed the adjust/address-some-dockerfile-lint-errors-and-warnings branch from 6444508 to ae8c2f3 Compare July 16, 2025 11:55
@jonasbardino jonasbardino requested a review from a team July 16, 2025 12:54
@jonasbardino
Copy link
Contributor Author

There's a sort of related pending task of completely cleaning up after the pylustrequota build, which I better leave to you @Martin-Rehr.
I already added the missing dnf cleanup there but don't know if the lustre checkout and build can just be wiped as well after install. In short we generally don't want any such build and package caches to bloat the resulting images. There may be other similar leftovers from libopkele/mod_auth_openid builds, btw.

Copy link
Contributor

@Martin-Rehr Martin-Rehr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

…d in

docker docs and pointed out by hadolint.
…`tini` we

use the checksum of the binary that was released and gpg-signed by the author.
Fix a FROM ... AS ... case mismatch as pointed out by docker compose.
…g image

with package cache, etc. as pointed out by hadolint.
excessive image size.
Properly anchor `*.key` to prevent option interference as recommended by
ShellCheck (SC2035).
…e of the

author for improved integrity assurance.
We could in principle preserve the weaker checksum verification during ADD, but
we disable it for the time being since gpg is sufficient and because `hadolint`
does not yet support the `--checksum` argument to ADD.
…ly make

a difference until we have cleaned up Dockerfiles enough to have nothing worse
than warnings reported.
@jonasbardino jonasbardino force-pushed the adjust/address-some-dockerfile-lint-errors-and-warnings branch from 1390ab7 to 36c3294 Compare August 16, 2025 10:19
@jonasbardino jonasbardino merged commit 760f513 into master Aug 16, 2025
2 of 4 checks passed
@jonasbardino jonasbardino deleted the adjust/address-some-dockerfile-lint-errors-and-warnings branch August 16, 2025 10:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request help wanted Extra attention is needed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants