3 ms·
Worth noting that Hadolint[1] raises warnings the issues mentioned in the article. Some examples of warnings: - https://github.com/hadolint/hadolint/wiki/DL300
by saulr 5y ago
Worth noting that Hadolint[1] raises warnings the issues mentioned in the article. Some examples of warnings:
- https://github.com/hadolint/hadolint/wiki/DL3007 https://github.com/hadolint/hadolint/wiki/DL3007: Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag.
- https://github.com/hadolint/hadolint/wiki/DL3013 https://github.com/hadolint/hadolint/wiki/DL3013: Pin versions in pip.
- https://github.com/hadolint/hadolint/wiki/DL3018 https://github.com/hadolint/hadolint/wiki/DL3018: Pin versions in apk add.
[1] https://github.com/hadolint/hadolint https://github.com/hadolint/hadolint
- ievans 5y agoHadolint is great! If you want to customize your lint logic beyond the checks in it, I recently wrote a Semgrep rule to require all our Dockerfiles to pin images with a sha256 hash that could be a good starting point: https://github.com/returntocorp/semgrep-rules/pull/1861/files https://github.com/returntocorp/semgrep-rules/pull/1861/file...