4 ms·

I use Hadolint[1] as a CI job to check if my Dockerfiles follow the good "rules". But there is one rule that annoys me the most and which is also present in thi

I use Hadolint[1] as a CI job to check if my Dockerfiles follow the good "rules". But there is one rule that annoys me the most and which is also present in this article, is the pinned OS package version rule[2]. While I understand its interest, I struggle to handle this problem. When I build new images and it fails because the pinned version is not available anymore, I have to dig into Debian or Ubuntu packages websites to find the new ones as they don't keep the old packages online. I know I could ask Hadolint to ignore this rule but I don't like this and I think it's important to stick to a certain version of a package to avoid problems. I'm just trying to find any tip that could make me use pinned version and avoid this manual search every time I have to. Does apt-get install allows wildcard for example? 1: https://github.com/hadolint/hadolint https://github.com/hadolint/hadolint 2: https://github.com/hadolint/hadolint/wiki/DL3008 https://github.com/hadolint/hadolint/wiki/DL3008

yrro 6y ago
snapshot.debian.org?
- teddyh 6y ago
  http://archive.debian.org/debian/ http://archive.debian.org/debian/
forty 6y ago
You could use renovate [1] to watch your repository and open pr for you when there is a new version. I don't know if it supports watching debian repositories out of the box, but that's probably doable with some tweaking [1] https://github.com/renovatebot/renovate https://github.com/renovatebot/renovate
nicbou 6y ago
I had a pretty serious issue because I didn't pin versions [1] and countless small problems. [1] https://nicolasbouliane.com/blog/nextcloud-docker-upgrade-error https://nicolasbouliane.com/blog/nextcloud-docker-upgrade-er...
jose_zap 6y ago
One of hadolint authors here. You can do `apt-get install my_package==4.1.*`, for instance and that will pass the validation and still be close to the ideal of having reproducible builds.
- hivacruz 6y ago
  Awesome, thanks your answer and for this great tool!

yrro 6y ago

snapshot.debian.org?

teddyh 6y ago
http://archive.debian.org/debian/ http://archive.debian.org/debian/

forty 6y ago

You could use renovate [1] to watch your repository and open pr for you when there is a new version. I don't know if it supports watching debian repositories out of the box, but that's probably doable with some tweaking [1] https://github.com/renovatebot/renovate https://github.com/renovatebot/renovate

nicbou 6y ago

I had a pretty serious issue because I didn't pin versions [1] and countless small problems. [1] https://nicolasbouliane.com/blog/nextcloud-docker-upgrade-error https://nicolasbouliane.com/blog/nextcloud-docker-upgrade-er...

jose_zap 6y ago

One of hadolint authors here. You can do `apt-get install my_package==4.1.*`, for instance and that will pass the validation and still be close to the ideal of having reproducible builds.

hivacruz 6y ago
Awesome, thanks your answer and for this great tool!