Hadolint
The Hadolint project describes the tool as follows:
A smarter Dockerfile linter that helps you build best practice Docker images.
Hadolint checks Dockerfiles against best practices, such as pinning the
versions of installed packages. It also runs ShellCheck over the shell
commands in RUN instructions. Vortex lints the Dockerfiles in
.docker, which build its service images, with the default rules. Where a
rule doesn't fit, the Dockerfile has a hadolint ignore= directive with
the reason next to it, such as DL3018 where the package set tracks the
pinned base image.
This page is for developers who change the Dockerfiles in .docker. It
shows how to install and run Hadolint, how to ignore a rule and how CI
reports what Hadolint finds.
Installation
Vortex doesn't install Hadolint in the project. To run it locally, install it on your machine by following the Hadolint installation instructions. In CI, Hadolint runs from its official Docker image.
The installer selects Hadolint by default. If you deselect it in the
Development tools prompt, the installer removes the Hadolint step from
the CI configuration of every supported provider. The hadolint ignore=
directives stay in the Dockerfiles, so a check you run by hand still skips
the same rules.
Usage
To lint the Dockerfiles, run the following command from the project root:
hadolint .docker/*.dockerfile
The glob covers every shipped Dockerfile, because the shipped .docker
directory holds only top-level .dockerfile files. CI also picks up a
Dockerfile or a subdirectory, so add those paths to the command when you
create them.
Confirm that the check passed: echo $?, run right after Hadolint, prints
0 when Hadolint found no violation at the info severity or higher.
Ignore violations
To ignore rules for the whole file, add a global ignore directive to the
file header:
# hadolint global ignore=DL3003,DL3006,SC1035
FROM ubuntu
To ignore rules for the next instruction only, add an ignore directive on
the line before it:
FROM ubuntu
# hadolint ignore=DL3003,SC1035
RUN cd /tmp && echo "hello!"
To record why you ignore a rule, add a second # and the reason after the
rule codes, as .docker/php.dockerfile does:
# hadolint ignore=DL3018 # the package set tracks the pinned base image
RUN apk add --no-cache tzdata
Continuous integration
Hadolint runs in the lint job of the continuous integration
pipeline and fails the build on
any violation at the info severity or higher, which is Hadolint's default
failure threshold. Findings at the style severity appear in the job log
without failing the build.
The step lints every file under .docker and its subdirectories that's
named Dockerfile or ends in .dockerfile. It stops at the first file
that fails.
Ignore failures
To let the build pass despite violations, set the
VORTEX_CI_HADOLINT_IGNORE_FAILURE CI variable to 1. Hadolint still runs
and prints its violations in the job log, so you can see what you're
letting through.