Dockerfile扫描工具Hadolint

一、简介

Hadolint是一个用Haskell 编写的开源Dockerfiles语法检查、优化工具。

Github地址：https://github.com/hadolint/hadolint

在线扫描：https://hadolint.github.io/hadolint/

二、安装与配置

1、安装

• OSX brew

  brew install hadolint
  

• Windows scoop

  scoop install hadolint
  

• docker

  docker pull hadolint/hadolint:latest-debian
  docker pull hadolint/hadolint:latest-alpine
  

2、配置

hadolint会按照以下顺序读取配置文件

• $PWD/.hadolint.yaml
• $XDG_CONFIG_HOME/hadolint.yaml
• ~/.config/hadolint.yaml

扫描时指定配置文件

hadolint --config /path/to/config.yaml Dockerfile

配置忽略规则

echo "export XDG_CONFIG_HOME=~/.hadolint" >> /etc/profile && \
mkdir ~/.hadolint && \
source /etc/profile && \

创建并编辑配置vi ~/.hadolint/hadolint.yaml

ignored:
  - DL3000
  - SC1010

trustedRegistries:
  - docker.io
  - my-company.com:5000

3、命令参数

hadolint [-v|--version] [-c|--config FILENAME] [-f|--format ARG] [DOCKERFILE...] 
         [--ignore RULECODE] [--trusted-registry REGISTRY (e.g. docker.io)]

可选参数:
  -h,--help                Show this help text
  -v,--version             Show version
  -c,--config FILENAME     Path to the configuration file
  -f,--format ARG          The output format for the results [tty | json |
                           checkstyle | codeclimate | codacy] (default: tty)
  --ignore RULECODE        A rule to ignore. If present, the ignore list in the
                           config file is ignored
  --trusted-registry REGISTRY (e.g. docker.io)
                           A docker registry to allow to appear in FROM instructions

三、扫描Dockerfile

hadolint Dockerfile 
hadolint --ignore DL3003 --ignore DL3006 Dockerfile
# 或者
docker run --rm -i hadolint/hadolint < Dockerfile

输出扫描结果

Dockerfile:2 DL3020 Use COPY instead of ADD for files and folders
Dockerfile:3 DL3025 Use arguments JSON notation for CMD and ENTRYPOINT arguments

四、与CI流程与编辑器的集成

官方集成示例文档：https://github.com/hadolint/hadolint/blob/master/docs/INTEGRATION.md

编辑器

• VSCode
• Sublime Text 3
• Vim and NeoVim
• Atom

CI流程

1、Travis CI

# Use container-based infrastructure for quicker build start-up
sudo: false
# Use generic image to cut start-up time
language: generic
env:
  # Path to 'hadolint' binary
  HADOLINT: "${HOME}/hadolint"
install:
  # Download hadolint binary and set it as executable
  - curl -sL -o ${HADOLINT} "https://github.com/hadolint/hadolint/releases/download/v1.17.5/hadolint-$(uname -s)-$(uname -m)"
    && chmod 700 ${HADOLINT}
script:
  # List files which name starts with 'Dockerfile'
  # eg. Dockerfile, Dockerfile.build, etc.
  - git ls-files --exclude='Dockerfile*' --ignored | xargs --max-lines=1 ${HADOLINT}

2、GitHub Actions

name: Lint Dockerfile
on: push
jobs:
  linter:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Lint Dockerfile
        uses: brpaz/hadolint-action@master
        with:
          dockerfile: "Dockerfile"

3、Gitlab CI

lint_dockerfile:
  image: hadolint/hadolint:latest-debian
  script:
    - hadolint Dockerfile

4、Jenkins declarative pipeline

stage ("lint dockerfile") {
    agent {
        docker {
            image 'hadolint/hadolint:latest-debian'
        }
    }
    steps {
        sh 'hadolint dockerfiles/* | tee -a hadolint_lint.txt'
    }
    post {
        always {
            archiveArtifacts 'hadolint_lint.txt'
        }
    }
}

5、Jenkins K8S plugin

声明hadolint pod

- name: hadolint
  image: hadolint/hadolint:latest-debian
  imagePullPolicy: Always
  command:
    - cat
  tty: true

stage('lint dockerfile') {
    steps {
        container('hadolint') {
            sh 'hadolint dockerfiles/* | tee -a hadolint_lint.txt'
        }
    }
    post {
        always {
            archiveArtifacts 'hadolint_lint.txt'
        }
    }
}

6、Bitbucket Pipelines

pipelines:
  default:
    - step:
        image: hadolint/hadolint:latest-debian
        script:
          - hadolint Dockerfile

五、扫描规则

DL开头的规则是hadolint的

SC开头的规则是ShellChecke的