Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve README.md syntax #137

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
81 changes: 56 additions & 25 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
[![Build Status](https://travis-ci.org/projectatomic/dockerfile_lint.svg?branch=master)](https://travis-ci.org/projectatomic/dockerfile_lint)

# dockerfile-lint

A rule based 'linter' for [Dockerfiles](https://docs.docker.com/engine/reference/builder/). The linter rules can be used to check file syntax as well as arbitrary semantic and best practice attributes determined by the rule file writer.
The linter can also be used to check LABEL rules against docker images.

Expand All @@ -21,56 +22,67 @@ The linter can also be used to check LABEL rules against docker images.
- [License](#license)

# Quickstart

1. Change to directory where you have a Dockerfile
2. run
* Atomic CLI

atomic run projectatomic/dockerfile-lint

atomic run projectatomic/dockerfile-lint image <imageid>
- Atomic CLI

* Docker CLI
```sh
atomic run projectatomic/dockerfile-lint

docker run -it --rm -v $PWD:/root/ \
projectatomic/dockerfile-lint \
dockerfile_lint [-f Dockerfile]
atomic run projectatomic/dockerfile-lint image <imageid>
```

docker run -it --rm -v $PWD:/root/ \
-v /var/run/docker.sock:/var/run/docker.sock \
projectatomic/dockerfile-lint \
dockerfile_lint image <imageid>
- Docker CLI

```sh
docker run -it --rm -v $PWD:/root/ \
projectatomic/dockerfile-lint \
dockerfile_lint [-f Dockerfile]

docker run -it --rm -v $PWD:/root/ \
-v /var/run/docker.sock:/var/run/docker.sock \
projectatomic/dockerfile-lint \
dockerfile_lint image <imageid>
```

By default, the linter runs in strict mode (errors and/or warnings result in non-zero return code). Run the command with `-p` or `--permissive` to
run in permissive mode:

atomic run projectatomic/dockerfile-lint -p
```sh
atomic run projectatomic/dockerfile-lint -p

docker run -it --rm -v $PWD:/root/ \
projectatomic/dockerfile-lint \
dockerfile_lint -p -f Dockerfile
docker run -it --rm -v $PWD:/root/ \
projectatomic/dockerfile-lint \
dockerfile_lint -p -f Dockerfile
```

# Extending and Customizing: Rule Files

Rule files are written in [yaml](http://www.yaml.org/). See the example rule file **sample_rules.yaml** in the root folder of the project.
The rules are implememented using regular expressions, run on one instruction of the dockerfile at a time.
The rule file has 4 sections, a profile section, a general section, a line rule section and a required instruction section.

## Profile Section

The profile section gives information about the rule file
The information here is meant to help a user select a rule file that is appropriate for a given dockerfile. Example:

```yaml
profile:
name: "Default"
description: "Default Profile. Checks basic syntax."
```

## General Section

This section contains general syntax rules.

## Rule Attributes

Here is an example of a line rule expressed in yaml:

```yaml
label: "is_latest_tag"
regex: /latest/
Expand All @@ -82,7 +94,9 @@ Here is an example of a line rule expressed in yaml:
```

## Line Rule Section

This section contains rules that must be run on a given instruction in the dockerfile. There is a rule to check the syntax of each instruction and zero or more rules for semantic checks. The example below shows rules to run against the `FROM` instruction:

```yaml
line_rules:
FROM:
Expand Down Expand Up @@ -116,29 +130,37 @@ line_rules:
description: "Base Image must be from Red Hat"
reference_url:
```

Note the (optional) `inverse_rule` attribute - this is just a convinient way to negate a regex rule - by default a rule is considered violated if it matches the regex pattern, but when 'inverse_rule' is set to 'true' the rule is violated if the line does not match the regex.

## Required Instruction Section

This section includes a list of instructions that must exist in the dockerfile in order for it to be considered valid.

## Inline Ignore Instructions
The user can tell dockerfile_lint to ignore a specific comand line inside a Dockerfile by placing a comment containing the word "dockerfile_lint" followed by the word "ignore", separated by a space, or a space and a dash/equals sign, above the command in the Dockerfile to be ignored.
```

The user can tell dockerfile_lint to ignore a specific comand line inside a Dockerfile by placing a comment containing the word "dockerfile_lint" followed by the word "ignore", separated by a space, or a space and a dash/equals sign, above the command in the Dockerfile to be ignored.

```Dockerfile
# Add is required <for some previously approved reason documented here>
# dockerfile_lint - ignore
ADD http://example.com/big.tar.xz /usr/src/things/
```

The above inline ignore would cause dockerfile_lint to skip processing the ADD command that follows it. This allows the writing of strict rules in order to catch when best practices are not followed, while still being able to explicitly override the check on a case by case basis if a valid reason exists.

# Library Usage

## Node.js application use

Install from github from your application root directory:
```

```sh
npm install git+https://github.com/projectatomic/dockerfile_lint
```

Import and use the validator:

```js
var fs = require('fs');
var rulefile = '/path/to/rulefile';
Expand All @@ -148,37 +170,46 @@ var result = validator.validate(dockerfile);
```

## Command Line use

You can install the linter globally on your pc:
```

```sh
sudo npm install -g dockerfile_lint
```

Run the tool:
```

```sh
dockerfile_lint -f /path/to/dockerfile [-f /path/to/second/dockerfile] [-r /path/to/rule/file]
```

A default rule file is used if no rule file is given.

You can also run the tool without installing it - just clone the source repository and run the tool from the bin directory :
```

```sh
git clone [email protected]:projectatomic/dockerfile_lint.git
cd dockerfile_lint/bin
chmod 555 dockerfile_lint
dockerfile_lint -f /path/to/dockerfile [ -r /path/to/rule/file]
```

To display results as JSON use the `-j` option:
```

```sh
dockerfile_lint -j -f /path/to/dockerfile [ -r /path/to/rule/file]
```

Command Help:
```

```sh
dockerfile_lint -h
```

# Credits
The linter is based on https://github.com/aweiteka/dockerfile_checker

The linter is based on <https://github.com/aweiteka/dockerfile_checker>

# License

MIT