Skip to content

DL3061: Check for instruction order#763

Merged
lorenzo merged 1 commit intohadolint:masterfrom
m-ildefons:instruction-order-rule
Feb 25, 2022
Merged

DL3061: Check for instruction order#763
lorenzo merged 1 commit intohadolint:masterfrom
m-ildefons:instruction-order-rule

Conversation

@m-ildefons
Copy link
Copy Markdown
Member

Not all dockerfiles are valid just because all instructions in the
dockerfile are individually valid. For example, a RUN instruction may
not precede the first FROM instruction and so on. The new rule DL3061
checks that the order of the instructions is not completely bogus. That
means the Dockefile must begin with a comment, an ARG or a FROM
instruction.

  • Add new rule DL3061 to check for instruction order
  • Add tests for rule DL3061
  • Fix regression tests wrt. rule DL3061

fixes: #737

How to verify it

The new rule should alert in case the beginning of a dockerfile messes up instruction order such that a build can not succeed, e.g.:

RUN foo bar  # this is bad
FROM alpine:3
RUN bar foo

But should of course not alert in case a Dockerfile is valid and can be build:

# comments are ok
ARG BUILD_ARGUMENTS_OK=true
FROM alpine:3  # FROM must precede other instructions
LABEL foo "bar" # this is ok now
RUN something  # other instructions can follow

Thanks to @ye for suggesting this rule.

Not all dockerfiles are valid just because all instructions in the
dockerfile are individually valid. For example, a `RUN` instruction may
not preceed the first `FROM` instruction and so on. The new rule DL3061
checks that the order of the instructions is not completely bogus. That
means the Dockefile must begin with a comment, an `ARG` or a `FROM`
instruction.

- Add new rule DL3061 to check for instruction order
- Add tests for rule DL3061
- Fix regression tests wrt. rule DL3061

fixes: hadolint#737
@lorenzo lorenzo merged commit 8144eba into hadolint:master Feb 25, 2022
@aaronfi-procore
Copy link
Copy Markdown

Hi @lorenzo this rule is too restrictive, it needs to allow for comments.
i.e. it ended up breaking our production build because our Dockerfile is:

# syntax = docker/dockerfile:1.0-experimental

FROM node:16-alpine3.13 AS builder
WORKDIR /app
COPY ./package*.json ./

# etc, etc

We need the first comment to remain in place because it is a pragma. Without it the docker image build itself will fail.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

hadolint doesn't validate FROM instruction order in Dockerfile as it should

3 participants