Fix linting errors reported by hadolint (#1211)

* Fix linting errors reported by hadolint
* use full path for folders when listing contents
* add linting task to makefile

.hadolint.yaml

@@ -0,0 +1,5 @@
+ignored:
+  # disable explicit version for apt install
+  - DL3008
+trustedRegistries:
+  - docker.io

.travis.yml

@@ -3,9 +3,16 @@ branches:
   - donttestme
 language: bash
 sudo: required
+env:
+  global:
+    - HADOLINT_VERSION=1.17.1
 services:
 - docker
+before_install:
+- sudo curl -L https://github.com/hadolint/hadolint/releases/download/v$HADOLINT_VERSION/hadolint-$(uname -s)-$(uname -m) -o /usr/local/bin/hadolint
+- sudo chmod +rx /usr/local/bin/hadolint
 install:
+- make lint
 - travis_retry travis_wait make build-no-cache
 script:
 - make generate-accounts run generate-accounts-after-run fixtures tests

Dockerfile

@@ -14,10 +14,14 @@ ENV POSTGREY_TEXT="Delayed by postgrey"
 ENV SASLAUTHD_MECHANISMS=pam
 ENV SASLAUTHD_MECH_OPTIONS=""
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 # Packages
-RUN apt-get update -q --fix-missing && \
+# hadolint ignore=DL3015
-  apt-get -y upgrade && \
+RUN echo "deb http://ftp.debian.org/debian stretch-backports main" | tee -a /etc/apt/sources.list.d/stretch-bp.list && \
+  apt-get update -q --fix-missing && \
   apt-get -y install postfix && \
+  # TODO installing postfix with --no-install-recommends makes "checking ssl: generated default cert works correctly" fail
   apt-get -y install --no-install-recommends \
     amavisd-new \
     arj \
@@ -72,13 +76,6 @@ RUN apt-get update -q --fix-missing && \
     xz-utils \
     zoo \
     && \
-  curl https://packages.elasticsearch.org/GPG-KEY-elasticsearch | apt-key add - && \
-  echo "deb http://packages.elastic.co/beats/apt stable main" | tee -a /etc/apt/sources.list.d/beats.list && \
-  echo "deb http://ftp.debian.org/debian stretch-backports main" | tee -a /etc/apt/sources.list.d/stretch-bp.list && \
-  apt-get update -q --fix-missing && \
-  apt-get -y upgrade \
-    filebeat \
-    && \
   apt-get -t stretch-backports -y install --no-install-recommends \
     dovecot-core \
     dovecot-imapd \
@@ -98,6 +95,17 @@ RUN apt-get update -q --fix-missing && \
   rm -f /etc/cron.weekly/fstrim && \
   rm -f /etc/postsrsd.secret
 
+# install filebeat for logging
+RUN curl https://packages.elasticsearch.org/GPG-KEY-elasticsearch | apt-key add - && \
+  echo "deb http://packages.elastic.co/beats/apt stable main" | tee -a /etc/apt/sources.list.d/beats.list && \
+  apt-get update -q --fix-missing && \
+  apt-get -y install --no-install-recommends \
+    filebeat \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+COPY target/filebeat.yml.tmpl /etc/filebeat/filebeat.yml.tmpl
+
 RUN echo "0 */6 * * * clamav /usr/bin/freshclam --quiet" > /etc/cron.d/clamav-freshclam && \
   chmod 644 /etc/clamav/freshclam.conf && \
   freshclam && \
@@ -108,6 +116,8 @@ RUN echo "0 */6 * * * clamav /usr/bin/freshclam --quiet" > /etc/cron.d/clamav-fr
 
 # Configures Dovecot
 COPY target/dovecot/auth-passwdfile.inc target/dovecot/??-*.conf /etc/dovecot/conf.d/
+WORKDIR /usr/share/dovecot
+# hadolint ignore=SC2016,SC2086
 RUN sed -i -e 's/include_try \/usr\/share\/dovecot\/protocols\.d/include_try \/etc\/dovecot\/protocols\.d/g' /etc/dovecot/dovecot.conf && \
   sed -i -e 's/#mail_plugins = \$mail_plugins/mail_plugins = \$mail_plugins sieve/g' /etc/dovecot/conf.d/15-lda.conf && \
   sed -i -e 's/^.*lda_mailbox_autocreate.*/lda_mailbox_autocreate = yes/g' /etc/dovecot/conf.d/15-lda.conf && \
@@ -117,6 +127,7 @@ RUN sed -i -e 's/include_try \/usr\/share\/dovecot\/protocols\.d/include_try \/e
   # stretch-backport of dovecot needs this folder
   mkdir /etc/dovecot/ssl && \
   chmod 755 /etc/dovecot/ssl  && \
+  ./mkcert.sh  && \
   mkdir -p /usr/lib/dovecot/sieve-pipe /usr/lib/dovecot/sieve-filter /usr/lib/dovecot/sieve-global && \
   chmod 755 -R /usr/lib/dovecot/sieve-pipe /usr/lib/dovecot/sieve-filter /usr/lib/dovecot/sieve-global
 
@@ -125,6 +136,7 @@ COPY target/dovecot/dovecot-ldap.conf.ext /etc/dovecot
 COPY target/postfix/ldap-users.cf target/postfix/ldap-groups.cf target/postfix/ldap-aliases.cf target/postfix/ldap-domains.cf /etc/postfix/
 
 # Enables Spamassassin CRON updates and update hook for supervisor
+# hadolint ignore=SC2016
 RUN sed -i -r 's/^(CRON)=0/\1=1/g' /etc/default/spamassassin && \
     sed -i -r 's/^\$INIT restart/supervisorctl restart amavis/g' /etc/spamassassin/sa-update-hooks.d/amavisd-new
 
@@ -145,8 +157,8 @@ RUN sed -i -r 's/#(@|   \\%)bypass/\1bypass/g' /etc/amavis/conf.d/15-content_fil
   adduser amavis clamav && \
   # no syslog user in debian compared to ubuntu
   adduser --system syslog && \
-  useradd -u 5000 -d /home/docker -s /bin/bash -p $(echo docker | openssl passwd -1 -stdin) docker && \
+  useradd -u 5000 -d /home/docker -s /bin/bash -p "$(echo docker | openssl passwd -1 -stdin)" docker && \
-  (echo "0 4 * * * /usr/local/bin/virus-wiper" ; crontab -l) | crontab -
+  echo "0 4 * * * /usr/local/bin/virus-wiper" | crontab -
 
 # Configure Fail2ban
 COPY target/fail2ban/jail.conf /etc/fail2ban/jail.conf
@@ -154,10 +166,8 @@ COPY target/fail2ban/filter.d/dovecot.conf /etc/fail2ban/filter.d/dovecot.conf
 RUN echo "ignoreregex =" >> /etc/fail2ban/filter.d/postfix-sasl.conf && mkdir /var/run/fail2ban
 
 # Enables Pyzor and Razor
-USER amavis
+RUN su - amavis -c "razor-admin -create && \
-RUN razor-admin -create && \
+  razor-admin -register"
-  razor-admin -register
-USER root
 
 # Configure DKIM (opendkim)
 # DKIM config files
@@ -213,8 +223,8 @@ RUN chmod +x /usr/local/bin/*
 COPY target/supervisor/supervisord.conf /etc/supervisor/supervisord.conf
 COPY target/supervisor/conf.d/* /etc/supervisor/conf.d/
 
+WORKDIR /
+
 EXPOSE 25 587 143 465 993 110 995 4190
 
 CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]
-
-ADD target/filebeat.yml.tmpl /etc/filebeat/filebeat.yml.tmpl

Makefile

@@ -300,6 +300,11 @@ tests:
 test/%.bats: ALWAYS_RUN
 		./test/bats/bin/bats $@
 
+lint:
+	# List files which name starts with 'Dockerfile'
+	# eg. Dockerfile, Dockerfile.build, etc.
+	git ls-files --exclude='Dockerfile*' --ignored | xargs --max-lines=1 hadolint
+
 clean:
 	# Remove running test containers
 	-docker rm -f \

elk/Dockerfile

@@ -1,16 +1,17 @@
-FROM sebp/elk
+FROM sebp/elk:720
 
 RUN mkdir /etc/logstash/patterns.d
 #postfix grok and filter
 RUN curl -L https://raw.githubusercontent.com/whyscream/postfix-grok-patterns/master/postfix.grok > /etc/logstash/patterns.d/postfix.grok
 RUN curl -L https://raw.githubusercontent.com/whyscream/postfix-grok-patterns/master/50-filter-postfix.conf > /etc/logstash/conf.d/15-filter-postfix.conf
 # custom amavis grok and filter
-ADD amavis.grok  /etc/logstash/patterns.d
+COPY amavis.grok  /etc/logstash/patterns.d
-ADD 16-amavis.conf /etc/logstash/conf.d
+COPY 16-amavis.conf /etc/logstash/conf.d
 # dovecot grok and filter
 RUN curl -L https://raw.githubusercontent.com/ninech/logstash-patterns/master/patterns.d/dovecot.grok > /etc/logstash/patterns.d/dovecot.grok
 RUN curl -L https://raw.githubusercontent.com/ninech/logstash-patterns/master/exmples/50-filter-dovecot.conf > /etc/logstash/conf.d/17-filter-dovecot.conf
 # FIXME: may be a cron job? 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN mkdir  -p /usr/share/GeoIP && \
  curl -L http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz | gunzip -c - > /usr/share/GeoIP/GeoLiteCity.dat 
 
@@ -18,9 +19,9 @@ WORKDIR ${LOGSTASH_HOME}
 RUN gosu logstash bin/logstash-plugin install --local --no-verify logstash-filter-geoip
 
 # override beats input 
-ADD 02-beats-input.conf /etc/logstash/conf.d/
+COPY 02-beats-input.conf /etc/logstash/conf.d/
 # override syslog
-ADD 10-syslog.conf /etc/logstash/conf.d/
+COPY 10-syslog.conf /etc/logstash/conf.d/
 
 # avoid Bootstrap Checks failure on production
 RUN /bin/grep -q  -F 'transport.host' /etc/elasticsearch/elasticsearch.yml || echo "transport.host: 127.0.0.1" >> /etc/elasticsearch/elasticsearch.yml

test/docker-openldap/Dockerfile

@@ -1,5 +1,5 @@
 FROM osixia/openldap:1.1.6
-MAINTAINER Dennis Stumm <dstumm95@gmail.com>
+LABEL maintainer="Dennis Stumm <dstumm95@gmail.com>"
 
-ADD bootstrap /container/service/slapd/assets/config/bootstrap
+COPY bootstrap /container/service/slapd/assets/config/bootstrap
 RUN rm /container/service/slapd/assets/config/bootstrap/schema/mmc/mail.schema

test/tests.bats

@@ -670,7 +670,7 @@ function count_processed_changes() {
   # Check presence of tables and TrustedHosts
   run docker run --rm \
     -v "$(pwd)/test/config/empty/opendkim":/etc/opendkim \
-    `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l"
+    `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 /etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l"
   assert_success
   assert_output 4
 }
@@ -698,7 +698,7 @@ function count_processed_changes() {
   # Check presence of tables and TrustedHosts
   run docker run --rm \
     -v "$(pwd)/test/config/without-accounts/opendkim":/etc/opendkim \
-    `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l"
+    `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 /etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l"
   assert_success
   assert_output 4
 }
@@ -726,7 +726,7 @@ function count_processed_changes() {
   # Check presence of tables and TrustedHosts
   run docker run --rm \
     -v "$(pwd)/test/config/without-virtual/opendkim":/etc/opendkim \
-    `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l"
+    `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 /etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l"
   assert_success
   assert_output 4
 }