Re: Dockerfile

Histoire d'aller un peu plus loin, il existe des linter pour Dockerfile.

Il y a hadolint par exemple.

Voici ce qu'il donne sur le Dockerfile:

$ docker run --rm -i sjourdan/hadolint < Dockerfile
/dev/stdin:6 DL3003 Use WORKDIR to switch to a directory
/dev/stdin:7 SC1091 Not following: File not included in mock.
/dev/stdin:7 DL3003 Use WORKDIR to switch to a directory
/dev/stdin:33 DL3002 Do not switch to root USER
/dev/stdin:34 DL3020 Use COPY instead of ADD for files and folders
/dev/stdin:35 DL3020 Use COPY instead of ADD for files and folders
/dev/stdin:36 DL3020 Use COPY instead of ADD for files and folders

Evidemment chaque item a de la doc correspondante avec des liens vers les documentation docker, par exemple le DL3020.

Rationale:

https://docs.docker.com/engine/articles/dockerfile_best-practices/#add-or-copy

For other items (files, directories) that do not require ADD’s tar auto-extraction capability, you should always use COPY.

Il y a aussi un linter dans le projet Atomic qui a le mérite d'être assez complet et détaillé:

$ docker run --rm -it --privileged -v $PWD:/root/ projectatomic/dockerfile-lint dockerfile_lint lint 
--------ERRORS---------
ERROR: Required LABEL name/key 'Name' is not defined. 
Reference -> http://docs.projectatomic.io/container-best-practices/#_recommended_labels_for_your_project
ERROR: Required LABEL name/key 'Version' is not defined. 
Reference -> http://docs.projectatomic.io/container-best-practices/#_recommended_labels_for_your_project
-------WARNINGS--------
Line 5: -> RUN yum -y install git openssh-server; yum clean all
WARNING: installing SSH in a container is not recommended. Do you really need SSH in this image?. 
Reference -> https://github.com/jpetazzo/nsenter
Line 23: -> RUN cd /opt/sources/fusionforge && source ./autoinstall/common-backports && yum install -y make tar && backports_rpm && yum --enablerepo=epel install -y httpd-itk && yum install -y gettext php-cli php-pgsql php-process php-mbstring php-pear-HTTP httpd mod_dav_svn mod_ssl postgresql-server postgresql-contrib nscd cvs subversion viewvc python-pycurl git gitweb xinetd moin mod_wsgi python-psycopg2 unoconv poppler-utils libreoffice-headless cronie mediawiki && cd src/ && make && make install-base install-shell install-scm install-plugin-scmcvs install-plugin-scmsvn install-plugin-scmgit install-plugin-blocks install-plugin-moinmoin install-plugin-taskboard install-plugin-message install-plugin-repositoryapi install-plugin-mediawiki
WARNING: yum clean all is not used. the yum cache will remain in this layer making the layer unnecessarily large. 
Reference -> http://docs.projectatomic.io/container-best-practices/#_clear_packaging_caches_and_temporary_package_downloads
Line 25: -> RUN yum --enablerepo=epel install -y supervisor
WARNING: yum clean all is not used. the yum cache will remain in this layer making the layer unnecessarily large. 
Reference -> http://docs.projectatomic.io/container-best-practices/#_clear_packaging_caches_and_temporary_package_downloads
--------INFO---------
Line 4: -> RUN yum -y update; yum clean all
INFO: updating the entire base image may add unnecessary size to the container. update the entire base image may add unnecessary size to the container. 
Reference -> http://docs.projectatomic.io/container-best-practices/#_clear_packaging_caches_and_temporary_package_downloads
INFO: There is no 'CMD' instruction. None. 
Reference -> https://docs.docker.com/engine/reference/builder/#cmd

L'avantage de ces linter et qu'il devient très simple de les ajouter de manière automatique dans des procédures de tests, intégration continue histoire d'avoir toujours un aperçu de l'état des Dockerfile.