daenamnu/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/all-in-one.git synced 2026-09-18 17:27:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix dockerlint (#8523)

Browse Source
This commit is contained in:
Simon L.
2026-08-25 12:57:20 +02:00
committed by GitHub
parent c7fe885c50 1a146e05f6
commit a95737744c
21 changed files with 61 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/docker-lint.yml
+6 -6
View File
@@ -34,13 +34,13 @@ jobs:
- name: run lint
run: |
DOCKERFILES="$(find ./Containers -name Dockerfile)"
mapfile -t DOCKERFILES <<< "$DOCKERFILES"
for file in "${DOCKERFILES[@]}"; do
for file in $(find Containers -name "*Dockerfile"); do
# DL3018 warning: Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`
# DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
hadolint "$file" --ignore DL3018 --ignore DL4006 | tee -a ./hadolint.log
# DL3041 warning: Specify version with `dnf install -y <package>-<version>`.
# DL3066 info: Non-numeric user-id may not be resolvable by host system
hadolint "$file" --ignore DL3018 --ignore DL3041 --ignore DL3066 | tee -a hadolint.log
done
if grep -q "DL[0-9]\+\|SC[0-9]\+" ./hadolint.log; then
# hadolint only prints to console if it finds issues, so the workflow needs to fail if it printed something
if [ -s hadolint.log ]; then
exit 1
fi
Containers/apache/Dockerfile
+3 -2
View File
@@ -14,6 +14,7 @@ COPY --chmod=775 healthcheck.sh /healthcheck.sh
VOLUME /mnt/data
SHELL ["/bin/ash", "-o", "pipefail", "-c"]
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache shadow; \
@@ -95,14 +96,14 @@ RUN set -ex; \
echo "root:$(openssl rand -base64 12)" | chpasswd; \
apk --no-cache del openssl
USER 33
USER www-data:www-data
ENTRYPOINT ["/start.sh"]
CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]
ENV AIO_LOG_LEVEL=warn
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/borgbackup/Dockerfile
+1 -1
View File
@@ -21,7 +21,7 @@ COPY borg_excludes /
ENTRYPOINT ["/start.sh"]
# hadolint ignore=DL3002
USER root
USER root:root
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
Containers/clamav/Dockerfile
+3 -3
View File
@@ -6,7 +6,7 @@ RUN set -ex; \
apk add --no-cache tzdata clamav clamav-milter supervisor bash; \
mkdir -p /tmp /var/lib/clamav /run/clamav /var/log/supervisord /var/run/supervisord; \
chmod 777 -R /tmp /run/clamav /var/log/clamav /var/log/supervisord /var/run/supervisord; \
chown -R 100:100 /var/lib/clamav; \
chown -R clamav:clamav /var/lib/clamav; \
sed -i "s|#\?MaxDirectoryRecursion.*|MaxDirectoryRecursion 30|g" /etc/clamav/clamd.conf; \
sed -i "s|#\?MaxScanSize.*|MaxScanSize 2000M|g" /etc/clamav/clamd.conf; \
sed -i "s|#\?MaxFileSize.*|MaxFileSize 2000M|g" /etc/clamav/clamd.conf; \
@@ -35,7 +35,7 @@ COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
COPY --chmod=664 supervisord.conf /supervisord.conf
USER 100
USER clamav:clamav
RUN set -ex; \
freshclam --foreground --stdout
VOLUME /var/lib/clamav
@@ -50,4 +50,4 @@ LABEL com.centurylinklabs.watchtower.enable="false" \
org.opencontainers.image.source="https://github.com/nextcloud/all-in-one" \
org.opencontainers.image.vendor="Nextcloud" \
org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md"
HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh
HEALTHCHECK --start-period=60s --retries=9 CMD ["/healthcheck.sh"]
Containers/collabora/Dockerfile
+3 -3
View File
@@ -2,15 +2,15 @@
# From a file located probably somewhere here: https://github.com/CollaboraOnline/online/blob/master/docker/from-packages/Dockerfile
FROM collabora/code:26.04.2.1.1
USER root
USER root:root
ARG DEBIAN_FRONTEND=noninteractive
COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
USER 1001
USER cool:cool
HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh
HEALTHCHECK --start-period=60s --retries=9 CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/docker-socket-proxy/Dockerfile
+2 -2
View File
@@ -2,7 +2,7 @@
FROM haproxy:3.4.3-alpine
# hadolint ignore=DL3002
USER root
USER root:root
ENV NEXTCLOUD_HOST=nextcloud-aio-nextcloud
RUN set -ex; \
apk upgrade --no-cache -a; \
@@ -17,7 +17,7 @@ COPY --chmod=775 *.sh /
COPY --chmod=664 haproxy.cfg /haproxy.cfg
ENTRYPOINT ["/start.sh"]
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/domaincheck/Dockerfile
+2 -2
View File
@@ -13,10 +13,10 @@ COPY --chown=www-data:www-data lighttpd.conf /lighttpd.conf
COPY --chmod=775 start.sh /start.sh
USER www-data
USER www-data:www-data
ENTRYPOINT ["/start.sh"]
HEALTHCHECK CMD nc -z 127.0.0.1 $APACHE_PORT || exit 1
HEALTHCHECK CMD ["/bin/sh", "-c", "nc -z 127.0.0.1 $APACHE_PORT || exit 1"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/eurooffice/Dockerfile
+1 -1
View File
@@ -5,7 +5,7 @@ FROM ghcr.io/euro-office/documentserver:v9.3.3
COPY --chmod=775 healthcheck.sh /healthcheck.sh
HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh
HEALTHCHECK --start-period=60s --retries=9 CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/fulltextsearch/Dockerfile
+2 -3
View File
@@ -2,9 +2,8 @@
# Probably from here https://github.com/elastic/dockerfiles/blob/9.3/elasticsearch/Dockerfile
FROM elasticsearch:9.5.1
USER root
USER root:root
# hadolint ignore=DL3041
RUN set -ex; \
\
microdnf update -y; \
@@ -18,7 +17,7 @@ COPY --chmod=775 healthcheck.sh /healthcheck.sh
USER 1000:0
HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD /healthcheck.sh
HEALTHCHECK --interval=10s --timeout=5s --start-period=1m --retries=5 CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/harp/Dockerfile
+1 -1
View File
@@ -14,4 +14,4 @@ LABEL com.centurylinklabs.watchtower.enable="false" \
org.opencontainers.image.documentation="https://github.com/nextcloud/all-in-one/blob/main/readme.md"
# Copied from upstream
HEALTHCHECK --interval=10s --timeout=10s --retries=9 CMD /healthcheck.sh
HEALTHCHECK --interval=10s --timeout=10s --retries=9 CMD ["/healthcheck.sh"]
Containers/imaginary/Dockerfile
+2 -2
View File
@@ -36,13 +36,13 @@ COPY --chmod=775 healthcheck.sh /healthcheck.sh
ENV PORT=9000 \
AIO_LOG_LEVEL=warn
USER 65534
USER nobody:nobody
# https://github.com/h2non/imaginary#memory-issues
ENV MALLOC_ARENA_MAX=2
ENTRYPOINT ["/start.sh"]
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/mastercontainer/Dockerfile
+4 -3
View File
@@ -31,7 +31,8 @@ COPY --chmod=664 Containers/mastercontainer/supervisord.conf /supervisord.conf
WORKDIR /var/www/docker-aio
# hadolint ignore=SC2086,DL3047,DL3003
SHELL ["/bin/ash", "-o", "pipefail", "-c"]
# hadolint ignore=SC2086,DL3003
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache shadow; \
@@ -111,8 +112,8 @@ LABEL org.opencontainers.image.title="Nextcloud All-in-One Mastercontainer" \
com.docker.compose.project="nextcloud-aio"
# hadolint ignore=DL3002
USER root
USER root:root
ENTRYPOINT ["/start.sh"]
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
Containers/nextcloud/Dockerfile
+7 -2
View File
@@ -9,6 +9,10 @@ ENV REDIS_DB_INDEX=0
# AIO settings start # Do not remove or change this line!
ENV NEXTCLOUD_VERSION=33.0.8
# Required to stop hadolint from complaining about potentially sensitive data in an environment variable.
# It might be a good idea to reconsider using and env var for this at one point,
# but the actual value here is just a dummy and not relevant, so we silence the warning for now.
# hadolint ignore=DL3064
ENV AIO_TOKEN=123456
ENV AIO_URL=localhost
# AIO settings end # Do not remove or change this line!
@@ -27,6 +31,7 @@ VOLUME /mnt/ncdata
VOLUME /var/www/html
# Custom: change id of www-data user as it needs to be the same like on old installations
SHELL ["/bin/ash", "-o", "pipefail", "-c"]
# hadolint ignore=SC2086,DL3003
RUN set -ex; \
apk upgrade --no-cache -a; \
@@ -279,11 +284,11 @@ RUN set -ex; \
chmod -R 777 /nc-updater
# hadolint ignore=DL3002
USER root
USER root:root
ENTRYPOINT ["/start.sh"]
CMD ["/usr/bin/supervisord", "-c", "/supervisord.conf"]
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/notify-push/Dockerfile
+7 -3
View File
@@ -4,6 +4,7 @@ FROM alpine:3.24.1
COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
SHELL ["/bin/ash", "-o", "pipefail", "-c"]
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache \
@@ -15,12 +16,15 @@ RUN set -ex; \
# Give root a random password
echo "root:$(openssl rand -base64 12)" | chpasswd; \
apk del --no-cache \
openssl;
openssl; \
delgroup www-data; \
addgroup -g 33 -S www-data; \
adduser -u 33 -S -D -G www-data -H -s /sbin/nologin www-data;
USER 33
USER www-data:www-data
ENTRYPOINT ["/start.sh"]
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/onlyoffice/Dockerfile
+1 -1
View File
@@ -6,7 +6,7 @@ FROM onlyoffice/documentserver:9.3.1.2
COPY --chmod=775 healthcheck.sh /healthcheck.sh
HEALTHCHECK --start-period=60s --retries=9 CMD /healthcheck.sh
HEALTHCHECK --start-period=60s --retries=9 CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/postgresql/Dockerfile
+3 -2
View File
@@ -8,6 +8,7 @@ COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
COPY --chmod=775 init-user-db.sh /docker-entrypoint-initdb.d/init-user-db.sh
SHELL ["/bin/ash", "-o", "pipefail", "-c"]
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache \
@@ -43,10 +44,10 @@ RUN set -ex; \
VOLUME /mnt/data
USER 999
USER postgres:postgres
ENTRYPOINT ["/start.sh"]
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/redis/Dockerfile
+3 -2
View File
@@ -4,6 +4,7 @@ FROM redis:8.8.1-alpine
COPY --chmod=775 start.sh /start.sh
SHELL ["/bin/ash", "-o", "pipefail", "-c"]
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache openssl bash; \
@@ -17,10 +18,10 @@ RUN set -ex; \
COPY --chmod=775 healthcheck.sh /healthcheck.sh
USER 999
USER redis:redis
ENTRYPOINT ["/start.sh"]
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/talk-recording/Dockerfile
+3 -2
View File
@@ -12,6 +12,7 @@ ENV ALLOW_ALL=false \
HPB_PATH=/standalone-signaling/ \
AIO_LOG_LEVEL=warn
SHELL ["/bin/ash", "-o", "pipefail", "-c"]
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache \
@@ -60,11 +61,11 @@ RUN set -ex; \
VOLUME /tmp
WORKDIR /tmp
USER 122
USER recording:recording
ENTRYPOINT ["/start.sh"]
CMD ["python", "-m", "nextcloud.talk.recording", "--config", "/conf/recording.conf"]
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/talk/Dockerfile
+3 -2
View File
@@ -48,6 +48,7 @@ COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
COPY --chmod=664 supervisord.conf /supervisord.conf
SHELL ["/bin/ash", "-o", "pipefail", "-c"]
RUN set -ex; \
apk upgrade --no-cache -a; \
apk add --no-cache \
@@ -105,11 +106,11 @@ RUN set -ex; \
ln -s /opt/eturnal/bin/stun /usr/local/bin/stun; \
ln -s /opt/eturnal/bin/eturnalctl /usr/local/bin/eturnalctl
USER 1000
USER eturnal:eturnal
ENTRYPOINT ["/start.sh"]
CMD ["supervisord", "-c", "/supervisord.conf"]
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
LABEL com.centurylinklabs.watchtower.enable="false" \
wud.watch="false" \
dockhand.update="false" \
Containers/watchtower/Dockerfile
+1 -1
View File
@@ -20,7 +20,7 @@ COPY --from=go /go/bin/watchtower /watchtower
COPY --chmod=775 start.sh /start.sh
# hadolint ignore=DL3002
USER root
USER root:root
ENV AIO_LOG_LEVEL="warn"
Containers/whiteboard/Dockerfile
+3 -3
View File
@@ -2,7 +2,7 @@
# Probably from this file: https://github.com/nextcloud/whiteboard/blob/main/Dockerfile
FROM ghcr.io/nextcloud-releases/whiteboard:v1.5.9
USER root
USER root:root
RUN set -ex; \
apk add --no-cache bash jq; \
chmod 777 -R /tmp; \
@@ -11,12 +11,12 @@ RUN set -ex; \
printf '%s\n' '#!/bin/sh' "exec /usr/lib/chromium/chrome_crashpad_handler.real --no-periodic-tasks --database=\"\${CRASHPAD_DATABASE:-/tmp/chrome-crashpad}\" \"\$@\"" >/usr/lib/chromium/chrome_crashpad_handler; \
chmod +x /usr/lib/chromium/chrome_crashpad_handler; \
fi
USER 65534
USER nobody:nobody
COPY --chmod=775 start.sh /start.sh
COPY --chmod=775 healthcheck.sh /healthcheck.sh
HEALTHCHECK CMD /healthcheck.sh
HEALTHCHECK CMD ["/healthcheck.sh"]
WORKDIR /tmp