0.7.11 • Published 4 months ago

@tdurieux/docker-parfum v0.7.11

Weekly downloads
-
License
MIT
Repository
github
Last release
4 months ago

Docker-Parfum

Parfum is a tool to detect and repair smell in Dockerfile smells.

The impact of the smells are described in the paper "Empirical Study of the Docker Smells Impact on the Image Size".

Docker-Parfum currently support 32 rules that have been partially identified by Henkel et al. in "Learning from, Understanding, and Supporting DevOps Artifacts for Docker"

Build

npm run build

Usage

Web based

You can use the web version of Docker-Parfum https://durieux.me/docker-parfum/ (The website is purely static no data is sent).

CLI

npm i -g @tdurieux/docker-parfum
docker-parfum repair <dockerfile>
Usage: docker-parfum [options] [command]

Options:
  -h, --help               display help for command

Commands:
  rules                    List the supported rules
  repair [options] <file>  Repair the Dockerfile smells
  analyze <file>           Analyze a Dockerfile file for smells
  help [command]           display help for command

API

import { DockerParser, File } from "@tdurieux/dinghy";
import { Matcher, rules } from "@tdurieux/docker-parfum";

const dockerParser = new DockerParser(new File(<filePath>,<filecontent>)); // the path or the content can be provided
const ast = await dockerParser.parse();
const matcher = new Matcher(dockerfile);
const violations = matcher.match(rules.aptGetInstallThenRemoveAptLists); // look for a specific rule
const allViolations = matcher.matchAll();

for (const violation of allViolations) {
  await violation.repair(); // repair the violation
}

const repairedDockerfile = ast.toString(true);

Browser

const dockerParser = new dockerParfum.dinghy.dockerfileParser.DockerParser(
  new dockerParfum.dinghy.File(undefined, dockerfile)
);

const ast = await dockerParser.parse();
const matcher = new dockerParfum.Matcher(ast);
const violations = matcher.match(
  dockerParfum.rules.aptGetInstallThenRemoveAptLists
); // look for a specific rule
const violations = matcher.matchAll();

for (const violation of allViolations) {
  await violation.repair(); // repair the violation
}

const repairedDockerfile = ast.toString(true);

Enricher

import * as dindhy from "@tdurieux/dinghy";
import { enricher } from "@tdurieux/docker-parfum";

const ast = await dindhy.parseDocker(/* file */);
enricher.enrich(ast);
ast.find(dindhy.nodeType.Q("SC-APT-PACKAGE"));

Supported Rules

#RuleDescription
1curlUseFlagLThe -L option in curl stands for "follow redirects." When this option is used, curl will follow any redirects that it encounters when making an HTTP request. This can be useful in a Dockerfile if you want to download a file from a URL that may redirect to another URL.
2ruleMoreThanOneInstallAll apt-get install should group into one.
3curlUseFlagFUsing curl -f in a Dockerfile can help to prevent the build from failing if the HTTP request returns an error code >= 400.
4npmCacheCleanAfterInstallRunning npm cache clean after npm install in a Dockerfile can help to reduce the size of the image and ensure that the latest version of packages are installed.
5npmCacheCleanUseForceUsing the --force flag with npm cache clean can override the default behavior of npm and force the cache to be cleaned, even if it is not more than 3 days old or if npm is in a "read-only" state.
6yarnCacheCleanAfterInstallyarn keeps a local cache of downloaded packages. This unnecessarily increases image size. It can be cleared by executing yarn cache clean.
7rmRecursiveAfterMktempDUsing mktemp -d followed by rm -r in a Dockerfile can create and delete a temporary directory, helping to keep the image small and clean up sensitive data.
8curlUseHttpsUrlUsing https instead of http with curl in a Dockerfile can provide an encrypted connection for transferring data and ensure that curl can access resources that may require https.
9wgetUseHttpsUrlUsing https instead of http with wget in a Dockerfile can provide an encrypted connection for transferring data and ensure that wget can access resources that may require https.
10pipUseNoCacheDirUsing the --no-cache-dir flag with pip in a Dockerfile can disable the package cache, ensuring that the latest version of a package and its dependencies are installed.
11mkdirUsrSrcThenRemoveRunning rm -rf /usr/src* after creating the /usr/src directory in a Dockerfile helps keep the file system organized, reduce clutter, and free up space, but it is important to be cautious when using the rm -rf command.
12configureShouldUseBuildFlagPassing the --build flag to ./configure in a Dockerfile can help to ensure that the configure script correctly detects the current build environment and generates the correct Makefiles.
13gemUpdateSystemRmRootGemRemoving the /root/.gem directory after running gem update --system can ensure that all of the installed gems are compatible with the new version of gem and that the image starts with a clean slate.
14sha256sumEchoOneSpacesThe sha256sum command reads input from stdin with one space as a separator in order to distinguish the input from a filename.
15gemUpdateNoDocumentAdding the --no-document flag to the .gemrc config file or using it with gem update can speed up the update process by skipping the installation of documentation for updated gems.
16gpgVerifyAscRmAscIt is generally good practice to remove the .asc file after verifying its signature because the .asc file serves no further purpose once the signature has been verified.
17yumInstallForceYesUsing the -y flag with yum install in a Dockerfile allows for fully automated package installation, but it is important to carefully consider the packages being installed to avoid potential issues or conflicts.
18yumInstallRmVarCacheYumRemoving the /var/cache/yum directory after running yum install in a Dockerfile helps reduce the size of the final image and can improve build times, as well as prevent issues caused by outdated or inconsistent cache data.
19tarSomethingRmTheSomethingRemoving the .tar file after extracting its contents in a Dockerfile helps reduce the size of the final image and can improve build times, as well as keep the file system organized and reduce clutter.
20gpgUseBatchFlagUsing the --batch flag with gpg in a Dockerfile allows the command to run without user input, but it is important to carefully consider the implications of using the flag to ensure that it is appropriate for the task at hand.
21gpgUseHaPoolsUsing ha.pool. instead of pool. with gpg in a Dockerfile improves key server access reliability and efficiency.
22aptGetInstallUseYUsing the -y flag with apt-get install in a Dockerfile allows for fully automated package installation, but it is important to carefully consider the packages being installed to avoid potential issues or conflicts.
23aptGetInstallUseNoRecUsing the --no-install-recommends flag with apt-get install in a Dockerfile helps save layer space, improve build times, and reduce the size and attack surface of the final image, as well as prevent hidden dependencies.
24aptGetUpdatePrecedesInstallRunning apt-get update and apt-get install in a single layer in a Dockerfile improves efficiency, reliability, and readability.
25aptGetInstallThenRemoveAptListsRunning rm -rf /var/lib/apt/lists/* after apt-get install in a Dockerfile can improve efficiency and reduce the size of the image.
26apkAddUseNoCacheUsing the --no-cache flag with apk add in a Dockerfile can help prevent issues caused by installing outdated packages and ensure that the latest version of a package is installed, but it can increase build times.
27DL3002Switching to the root USER opens up certain security risks if an attacker gets access to the container. In order to mitigate this, switch back to a non privileged user after running the commands you need as root.
28DL3004Do not use sudo as it leads to unpredictable behavior. Use a tool like gosu to enforce root.
29DL3020Use COPY instead of ADD for files and folders.
30DL3027apt is discouraged by the linux distributions as an unattended tool as its interface may suffer changes between versions. Better use the more stable apt-get and apt-cache
31DL3029Specifying --platform= in the docker file FROM clause forces the Image to build only one target platform.
32DL3046Without the -l or the --no-log-init flag, useradd will add the user to the lastlog and faillog databases.
0.7.11

4 months ago

0.7.10

6 months ago

0.7.9

6 months ago

0.7.6

6 months ago

0.7.5

6 months ago

0.7.8

6 months ago

0.7.7

6 months ago

0.7.2

6 months ago

0.7.1

6 months ago

0.7.4

6 months ago

0.7.3

6 months ago

0.7.0

6 months ago

0.6.2

1 year ago

0.6.1

1 year ago

0.6.0

1 year ago