Skip to content

Commit 7ffaaef

Browse files
GitHubNick Van Wiggerengorzellnickvanwbkeepers
committed
Initial commit
Co-authored-by: Nick Van Wiggeren <[email protected]> Co-authored-by: Greg Orzell <[email protected]> Co-authored-by: Nick Van Wiggeren <[email protected]> Co-authored-by: Brandon Keepers <[email protected]> Co-authored-by: Greg Orzell <[email protected]> Co-authored-by: Max Schoening <[email protected]> Co-authored-by: Guðmundur Bjarni Ólafsson <[email protected]> Co-authored-by: Steve Winton <[email protected]>
0 parents  commit 7ffaaef

33 files changed

+1595
-0
lines changed

‎.dockerfile_lint/default_rules.yaml

Lines changed: 173 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,173 @@
1+
# https://github.com/projectatomic/dockerfile_lint
2+
---
3+
profile:
4+
name: "Default"
5+
description: "Default Profile. Checks basic syntax."
6+
line_rules:
7+
LABEL:
8+
paramSyntaxRegex: /.+/
9+
defined_namevals:
10+
Name:
11+
valueRegex: /[\w]+/
12+
message: "Label 'name' is missing or has invalid format"
13+
level: "error"
14+
required: true
15+
Version:
16+
valueRegex: /[\w.${}()"'\\\/~<>\-?\%:]+/
17+
message: "Label 'version' is missing or has invalid format"
18+
level: "error"
19+
required: true
20+
Maintainer:
21+
valueRegex: /[\w]+/
22+
message: "Label 'maintainer' is missing or has invalid format"
23+
level: "error"
24+
required: true
25+
26+
FROM:
27+
paramSyntaxRegex: /^[\w./\-:]+(:[\w.]+)?(-[\w]+)?( as \w+)?$/i
28+
rules:
29+
-
30+
label: "is_latest_tag"
31+
regex: /latest/
32+
level: "error"
33+
message: "base image uses 'latest' tag"
34+
description: "using the 'latest' tag may cause unpredictable builds. It is recommended that a specific tag is used in the FROM line or *-released which is the latest supported release."
35+
reference_url:
36+
- "https://docs.docker.com/engine/reference/builder/"
37+
- "#from"
38+
-
39+
label: "no_tag"
40+
regex: /^[:]/
41+
level: "error"
42+
message: "No tag is used"
43+
description: "lorem ipsum tar"
44+
reference_url:
45+
- "https://docs.docker.com/engine/reference/builder/"
46+
- "#from"
47+
RUN:
48+
paramSyntaxRegex: /.+/
49+
rules:
50+
-
51+
label: "no_yum_clean_all"
52+
regex: /yum(?!.+clean all|.+\.repo|-config|\.conf)/g
53+
level: "warn"
54+
message: "yum clean all is not used"
55+
description: "the yum cache will remain in this layer making the layer unnecessarily large"
56+
reference_url:
57+
- "http://docs.projectatomic.io/container-best-practices/#"
58+
- "_clear_packaging_caches_and_temporary_package_downloads"
59+
-
60+
label: "yum_update_all"
61+
regex: /yum(.+update all|.+upgrade|.+update|\.config)/
62+
level: "info"
63+
message: "updating the entire base image may add unnecessary size to the container"
64+
description: "update the entire base image may add unnecessary size to the container"
65+
reference_url:
66+
- "http://docs.projectatomic.io/container-best-practices/#"
67+
- "_clear_packaging_caches_and_temporary_package_downloads"
68+
-
69+
label: "no_dnf_clean_all"
70+
regex: /dnf(?!.+clean all|.+\.repo)/g
71+
level: "warn"
72+
message: "dnf clean all is not used"
73+
description: "the dnf cache will remain in this layer making the layer unnecessarily large"
74+
reference_url:
75+
- "http://docs.projectatomic.io/container-best-practices/#"
76+
- "_clear_packaging_caches_and_temporary_package_downloads"
77+
-
78+
label: "no_rvm_cleanup_all"
79+
regex: /rvm install(?!.+cleanup all)/g
80+
level: "warn"
81+
message: "rvm cleanup is not used"
82+
description: "the rvm cache will remain in this layer making the layer unnecessarily large"
83+
reference_url:
84+
- "http://docs.projectatomic.io/container-best-practices/#"
85+
- "_clear_packaging_caches_and_temporary_package_downloads"
86+
-
87+
label: "no_gem_clean_all"
88+
regex: /gem install(?!.+cleanup|.+\rvm cleanup all)/g
89+
level: "warn"
90+
message: "gem cleanup all is not used"
91+
description: "the gem cache will remain in this layer making the layer unnecessarily large"
92+
reference_url:
93+
- "http://docs.projectatomic.io/container-best-practices/#"
94+
- "_clear_packaging_caches_and_temporary_package_downloads"
95+
-
96+
label: "no_apt-get_clean"
97+
regex: /apt-get install(?!.+clean)/g
98+
level: "warn"
99+
message: "apt-get clean is not used"
100+
description: "the apt-get cache will remain in this layer making the layer unnecessarily large"
101+
reference_url:
102+
- "http://docs.projectatomic.io/container-best-practices/#"
103+
- "_clear_packaging_caches_and_temporary_package_downloads"
104+
-
105+
label: "privileged_run_container"
106+
regex: /privileged/
107+
level: "warn"
108+
message: "a privileged run container is allowed access to host devices"
109+
description: "Does this run need to be privileged?"
110+
reference_url:
111+
- "http://docs.docker.com/engine/reference/run/#"
112+
- "runtime-privilege-and-linux-capabilities"
113+
-
114+
label: "installing_ssh"
115+
regex: /openssh-server/
116+
level: "warn"
117+
message: "installing SSH in a container is not recommended"
118+
description: "Do you really need SSH in this image?"
119+
reference_url: "https://github.com/jpetazzo/nsenter"
120+
-
121+
label: "no_ampersand_usage"
122+
regex: / ; /
123+
level: "warn"
124+
message: "using ; instead of &&"
125+
description: "RUN do_1 && do_2: The ampersands change the resulting evaluation into do_1 and then do_2 only if do_1 was successful."
126+
reference_url:
127+
- "http://docs.projectatomic.io/container-best-practices/#"
128+
- "#_using_semi_colons_vs_double_ampersands"
129+
EXPOSE:
130+
paramSyntaxRegex: /^[\d-\s\w/\\]+$/
131+
rules: []
132+
ENV:
133+
paramSyntaxRegex: /.+/
134+
rules: []
135+
ADD:
136+
paramSyntaxRegex: /^~?([\w-.~:/?#\[\]\\\/*@!$&'()*+,;=.{}"]+[\s]*)+$/
137+
COPY:
138+
paramSyntaxRegex: /.+/
139+
rules: []
140+
ENTRYPOINT:
141+
paramSyntaxRegex: /.+/
142+
rules: []
143+
VOLUME:
144+
paramSyntaxRegex: /.+/
145+
rules: []
146+
USER:
147+
paramSyntaxRegex: /^[a-z0-9_][a-z0-9_]{0,40}$/
148+
rules: []
149+
WORKDIR:
150+
paramSyntaxRegex: /^~?[\w\d-\/.{}$\/:]+[\s]*$/
151+
rules: []
152+
ONBUILD:
153+
paramSyntaxRegex: /.+/
154+
rules: []
155+
required_instructions:
156+
-
157+
instruction: "ENTRYPOINT"
158+
count: 1
159+
level: "info"
160+
message: "There is no 'ENTRYPOINT' instruction"
161+
description: "None"
162+
reference_url:
163+
- "https://docs.docker.com/engine/reference/builder/"
164+
- "#entrypoint"
165+
-
166+
instruction: "CMD"
167+
count: 1
168+
level: "info"
169+
message: "There is no 'CMD' instruction"
170+
description: "None"
171+
reference_url:
172+
- "https://docs.docker.com/engine/reference/builder/"
173+
- "#cmd"

‎.dockerfile_lint/github_actions.yaml

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# https://github.com/projectatomic/dockerfile_lint
2+
profile:
3+
name: "GitHub Actions"
4+
description: "Checks for GitHub Actions."
5+
includes:
6+
- default_rules.yaml
7+
general:
8+
# It appears these get duplicated rather than overriding. The hope was to use this as a counter to the
9+
# `required_instructions` section, but perhaps it defines the `line_rules` map. It would be great to either be able
10+
# to set `required_instructions` to a 0 value or have an `invalid_instructions` section?
11+
valid_instructions:
12+
- FROM
13+
- RUN
14+
- CMD
15+
- LABEL
16+
- ENV
17+
- ADD
18+
- COPY
19+
- ENTRYPOINT
20+
- WORKDIR
21+
- ONBUILD
22+
- ARG
23+
- STOPSIGNAL
24+
- SHELL
25+
line_rules:
26+
# Invalid Lines
27+
ADD:
28+
paramSyntaxRegex: /.+/
29+
rules:
30+
-
31+
label: "add_antipattern"
32+
regex: /.+/
33+
level: "info"
34+
message: "Avoid using ADD"
35+
description: "It is generally an anti-pattern to us ADD, use COPY instead."
36+
EXPOSE:
37+
paramSyntaxRegex: /.+/
38+
rules:
39+
-
40+
label: "expose_invalid"
41+
regex: /.+/
42+
level: "error"
43+
message: "There should not be an 'EXPOSE' instruction"
44+
description: "Actions should not expose ports."
45+
HEALTHCHECK:
46+
paramSyntaxRegex: /.+/
47+
rules:
48+
-
49+
label: "healthcheck_invalid"
50+
regex: /.+/
51+
level: "error"
52+
message: "There should not be a 'HEALTHCHECK' instruction"
53+
description: "Actions should not require HEALTHCHECKs."
54+
MAINTAINER:
55+
paramSyntaxRegex: /.+/
56+
rules:
57+
-
58+
label: "maintainer_deprecated"
59+
regex: /.+/
60+
level: "info"
61+
message: "the MAINTAINER command is deprecated"
62+
description: "MAINTAINER is deprecated in favor of using LABEL since Docker v1.13.0"
63+
reference_url:
64+
- "https://github.com/docker/cli/blob/master/docs/deprecated.md"
65+
- "#maintainer-in-dockerfile"
66+
SHELL:
67+
paramSyntaxRegex: /.+/
68+
rules:
69+
-
70+
label: "shell_invalid"
71+
regex: /.+/
72+
level: "info"
73+
message: "There should not be a 'SHELL' instruction"
74+
description: "Actions generally rely on sh and setting an alternative shell may have unexpected consequences."
75+
USER:
76+
paramSyntaxRegex: /.+/
77+
rules:
78+
-
79+
label: "user_discouraged"
80+
regex: /.+/
81+
level: "warn"
82+
message: "'USER' instruction exists"
83+
description: "Actions don't expect a USER to be set."
84+
VOLUME:
85+
paramSyntaxRegex: /.+/
86+
rules:
87+
-
88+
label: "volume_invalid"
89+
regex: /.+/
90+
level: "error"
91+
message: "There should not be a 'VOLUME' instruction"
92+
description: "Actions do not support volumes."
93+
94+
# Required Labels
95+
LABEL:
96+
paramSyntaxRegex: /.+/
97+
defined_namevals:
98+
com.github.actions.name:
99+
valueRegex: /[\w]+/
100+
message: "Label 'com.github.actions.name' is missing or has invalid format"
101+
level: "error"
102+
required: true
103+
com.github.actions.description:
104+
valueRegex: /[\w]+/
105+
message: "Label 'com.github.actions.description' is missing or has invalid format"
106+
level: "error"
107+
required: true
108+
com.github.actions.icon:
109+
valueRegex: /[\w]+/
110+
message: "Label 'com.github.actions.icon' is missing or has invalid format"
111+
level: "error"
112+
required: true
113+
com.github.actions.color:
114+
valueRegex: /[\w]+/
115+
message: "Label 'com.github.actions.color' is missing or has invalid format"
116+
level: "error"
117+
required: true
118+
119+
120+
required_instructions:
121+
-
122+
instruction: "ENTRYPOINT"
123+
count: 1
124+
level: "error"
125+
message: "There is no 'ENTRYPOINT' instruction"
126+
description: "Actions require that a default ENTRYPOINT be set"
127+
reference_url:
128+
- "https://docs.docker.com/engine/reference/builder/"
129+
- "#entrypoint"
130+
-
131+
instruction: "CMD"
132+
count: 1
133+
level: "info"
134+
message: "There is no 'CMD' instruction"
135+
description: "In most cases it is helpful to include reasonable defaults for CMD"
136+
reference_url:
137+
- "https://docs.docker.com/engine/reference/builder/"
138+
- "#cmd"

‎.github/main.workflow

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
workflow "Build and Publish" {
2+
on = "push"
3+
resolves = "Publish"
4+
}
5+
6+
action "Lint" {
7+
uses = "actions/action-builder/shell@master"
8+
runs = "make"
9+
args = "lint"
10+
}
11+
12+
action "Test" {
13+
uses = "actions/action-builder/shell@master"
14+
runs = "make"
15+
args = "test"
16+
}
17+
18+
action "Build" {
19+
needs = ["Lint", "Test"]
20+
uses = "actions/action-builder/docker@master"
21+
runs = "make"
22+
args = "build"
23+
}
24+
25+
action "Publish Filter" {
26+
needs = ["Build"]
27+
uses = "actions/bin/filter@master"
28+
args = "branch master"
29+
}
30+
31+
action "Docker Login" {
32+
needs = ["Publish Filter"]
33+
uses = "actions/docker/login@master"
34+
secrets = ["DOCKER_USERNAME", "DOCKER_PASSWORD"]
35+
}
36+
37+
action "Publish" {
38+
needs = ["Docker Login"]
39+
uses = "actions/action-builder/docker@master"
40+
runs = "make"
41+
args = "publish"
42+
}
43+

‎LICENSE

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
2+
The MIT License (MIT)
3+
4+
Copyright (c) 2018 GitHub, Inc. and contributors
5+
6+
Permission is hereby granted, free of charge, to any person obtaining a copy
7+
of this software and associated documentation files (the "Software"), to deal
8+
in the Software without restriction, including without limitation the rights
9+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
copies of the Software, and to permit persons to whom the Software is
11+
furnished to do so, subject to the following conditions:
12+
13+
The above copyright notice and this permission notice shall be included in
14+
all copies or substantial portions of the Software.
15+
16+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22+
THE SOFTWARE.

0 commit comments

Comments
 (0)