Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Proposed improved to issue 97 with better 'no_tag' matching #122

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Proposed improved to issue 97 with better 'no_tag' matching #122

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 37 additions & 37 deletions config/default_rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,58 +72,58 @@
- "http://docs.projectatomic.io/container-best-practices/#"
- "_recommended_labels_for_your_project"

FROM:
FROM:
paramSyntaxRegex: /^[\w./\-:]+(:[${}\w.]+)?(-[${}\w.]+)?( as \w+)?$/i
rules:
-
rules:
-
label: "is_latest_tag"
regex: /latest/
level: "error"
message: "base image uses 'latest' tag"
description: "using the 'latest' tag may cause unpredictable builds. It is recommended that a specific tag is used in the FROM line or *-released which is the latest supported release."
reference_url:
reference_url:
- "https://docs.docker.com/engine/reference/builder/"
- "#from"
-
-
label: "no_tag"
regex: /^[:]/
regex: /(^[^:]+$)|(^[^:]+:\d+\/[^:]+$)/
level: "error"
message: "No tag is used"
description: "lorem ipsum tar"
reference_url:
reference_url:
- "https://docs.docker.com/engine/reference/builder/"
- "#from"
MAINTAINER:
MAINTAINER:
paramSyntaxRegex: /.+/
rules:
-
-
label: "maintainer_deprecated"
regex: /.+/
level: "info"
message: "the MAINTAINER command is deprecated"
description: "MAINTAINER is deprecated in favor of using LABEL since Docker v1.13.0"
reference_url:
reference_url:
- "https://github.com/docker/cli/blob/master/docs/deprecated.md"
- "#maintainer-in-dockerfile"
RUN:
RUN:
paramSyntaxRegex: /.+/
rules:
-
rules:
-
label: "no_yum_clean_all"
regex: /yum(?!.+clean all|.+\.repo|-config|\.conf)/
level: "warn"
message: "yum clean all is not used"
description: "the yum cache will remain in this layer making the layer unnecessarily large"
reference_url:
reference_url:
- "http://docs.projectatomic.io/container-best-practices/#"
- "_clear_packaging_caches_and_temporary_package_downloads"
-
-
label: "yum_update_all"
regex: /yum(.+update all|.+upgrade|.+update)/
level: "info"
message: "updating the entire base image may add unnecessary size to the container"
description: "update the entire base image may add unnecessary size to the container"
reference_url:
reference_url:
- "http://docs.projectatomic.io/container-best-practices/#"
- "_clear_packaging_caches_and_temporary_package_downloads"
-
Expand All @@ -132,7 +132,7 @@
level: "warn"
message: "dnf clean all is not used"
description: "the dnf cache will remain in this layer making the layer unnecessarily large"
reference_url:
reference_url:
- "http://docs.projectatomic.io/container-best-practices/#"
- "_clear_packaging_caches_and_temporary_package_downloads"
-
Expand All @@ -141,7 +141,7 @@
level: "warn"
message: "rvm cleanup is not used"
description: "the rvm cache will remain in this layer making the layer unnecessarily large"
reference_url:
reference_url:
- "http://docs.projectatomic.io/container-best-practices/#"
- "_clear_packaging_caches_and_temporary_package_downloads"
-
Expand All @@ -150,25 +150,25 @@
level: "warn"
message: "gem cleanup all is not used"
description: "the gem cache will remain in this layer making the layer unnecessarily large"
reference_url:
reference_url:
- "http://docs.projectatomic.io/container-best-practices/#"
- "_clear_packaging_caches_and_temporary_package_downloads"
- "_clear_packaging_caches_and_temporary_package_downloads"
-
label: "no_apt-get_clean"
regex: /apt-get install(?!.+clean)/g
level: "info"
message: "apt-get clean is not used"
description: "the apt-get cache will remain in this layer making the layer unnecessarily large"
reference_url:
reference_url:
- "http://docs.projectatomic.io/container-best-practices/#"
- "_clear_packaging_caches_and_temporary_package_downloads"
- "_clear_packaging_caches_and_temporary_package_downloads"
-
label: "privileged_run_container"
regex: /privileged/
level: "warn"
message: "a privileged run container is allowed access to host devices"
description: "Does this run need to be privileged?"
reference_url:
reference_url:
- "http://docs.docker.com/engine/reference/run/#"
- "runtime-privilege-and-linux-capabilities"
-
Expand All @@ -177,8 +177,8 @@
level: "warn"
message: "installing SSH in a container is not recommended"
description: "Do you really need SSH in this image?"
reference_url: "https://github.com/jpetazzo/nsenter"
-
reference_url: "https://github.com/jpetazzo/nsenter"
-
label: "no_ampersand_usage"
regex: / ; /
level: "info"
Expand All @@ -187,15 +187,15 @@
reference_url:
- "http://docs.projectatomic.io/container-best-practices/#"
- "#_using_semi_colons_vs_double_ampersands"
EXPOSE:
EXPOSE:
paramSyntaxRegex: /^[\d-\s\w/\\]+$/
rules: []
ENV:
ENV:
paramSyntaxRegex: /^[\w-$/\\=\"[\]{}@:,'`\t. ]+$/
rules: []
ADD:
ADD:
paramSyntaxRegex: /^~?([\w-.~:/?#\[\]\\\/*@!$&'()*+,;=.{}"]+[\s]*)+$/
COPY:
COPY:
paramSyntaxRegex: /.+/
rules: []
ENTRYPOINT:
Expand All @@ -204,31 +204,31 @@
VOLUME:
paramSyntaxRegex: /.+/
rules: []
USER:
USER:
paramSyntaxRegex: /^[a-z0-9_][a-z0-9_-]{0,40}$/
rules: []
WORKDIR:
WORKDIR:
paramSyntaxRegex: /^~?[\w\d-\/.{}$\/:]+[\s]*$/
rules: []
ONBUILD:
ONBUILD:
paramSyntaxRegex: /.+/
rules: []
required_instructions:
-
required_instructions:
-
instruction: "EXPOSE"
count: 1
level: "info"
message: "There is no 'EXPOSE' instruction"
description: "Without exposed ports how will the service of the container be accessed?"
reference_url:
reference_url:
- "https://docs.docker.com/engine/reference/builder/"
- "#expose"
-
-
instruction: "CMD"
count: 1
level: "info"
message: "There is no 'CMD' instruction"
description: "None"
reference_url:
reference_url:
- "https://docs.docker.com/engine/reference/builder/"
- "#cmd"
Loading