From 1ba0991d8082b0f227170ce1655e990b82082235 Mon Sep 17 00:00:00 2001 From: Felix Bartels Date: Tue, 13 Aug 2019 11:41:38 +0200 Subject: [PATCH] Fix linting errors reported by hadolint (#1211) * Fix linting errors reported by hadolint * use full path for folders when listing contents * add linting task to makefile --- .hadolint.yaml | 5 ++++ .travis.yml | 7 ++++++ Dockerfile | 44 ++++++++++++++++++++------------- Makefile | 5 ++++ elk/Dockerfile | 11 +++++---- test/docker-openldap/Dockerfile | 4 +-- test/tests.bats | 6 ++--- 7 files changed, 55 insertions(+), 27 deletions(-) create mode 100644 .hadolint.yaml diff --git a/.hadolint.yaml b/.hadolint.yaml new file mode 100644 index 00000000..f9128629 --- /dev/null +++ b/.hadolint.yaml @@ -0,0 +1,5 @@ +ignored: + # disable explicit version for apt install + - DL3008 +trustedRegistries: + - docker.io diff --git a/.travis.yml b/.travis.yml index 9bccf6d4..48f41d0c 100644 --- a/.travis.yml +++ b/.travis.yml @@ -3,9 +3,16 @@ branches: - donttestme language: bash sudo: required +env: + global: + - HADOLINT_VERSION=1.17.1 services: - docker +before_install: +- sudo curl -L https://github.com/hadolint/hadolint/releases/download/v$HADOLINT_VERSION/hadolint-$(uname -s)-$(uname -m) -o /usr/local/bin/hadolint +- sudo chmod +rx /usr/local/bin/hadolint install: +- make lint - travis_retry travis_wait make build-no-cache script: - make generate-accounts run generate-accounts-after-run fixtures tests diff --git a/Dockerfile b/Dockerfile index fc41e7ff..9f6a4701 100644 --- a/Dockerfile +++ b/Dockerfile @@ -14,10 +14,14 @@ ENV POSTGREY_TEXT="Delayed by postgrey" ENV SASLAUTHD_MECHANISMS=pam ENV SASLAUTHD_MECH_OPTIONS="" +SHELL ["/bin/bash", "-o", "pipefail", "-c"] + # Packages -RUN apt-get update -q --fix-missing && \ - apt-get -y upgrade && \ +# hadolint ignore=DL3015 +RUN echo "deb http://ftp.debian.org/debian stretch-backports main" | tee -a /etc/apt/sources.list.d/stretch-bp.list && \ + apt-get update -q --fix-missing && \ apt-get -y install postfix && \ + # TODO installing postfix with --no-install-recommends makes "checking ssl: generated default cert works correctly" fail apt-get -y install --no-install-recommends \ amavisd-new \ arj \ @@ -72,13 +76,6 @@ RUN apt-get update -q --fix-missing && \ xz-utils \ zoo \ && \ - curl https://packages.elasticsearch.org/GPG-KEY-elasticsearch | apt-key add - && \ - echo "deb http://packages.elastic.co/beats/apt stable main" | tee -a /etc/apt/sources.list.d/beats.list && \ - echo "deb http://ftp.debian.org/debian stretch-backports main" | tee -a /etc/apt/sources.list.d/stretch-bp.list && \ - apt-get update -q --fix-missing && \ - apt-get -y upgrade \ - filebeat \ - && \ apt-get -t stretch-backports -y install --no-install-recommends \ dovecot-core \ dovecot-imapd \ @@ -98,6 +95,17 @@ RUN apt-get update -q --fix-missing && \ rm -f /etc/cron.weekly/fstrim && \ rm -f /etc/postsrsd.secret +# install filebeat for logging +RUN curl https://packages.elasticsearch.org/GPG-KEY-elasticsearch | apt-key add - && \ + echo "deb http://packages.elastic.co/beats/apt stable main" | tee -a /etc/apt/sources.list.d/beats.list && \ + apt-get update -q --fix-missing && \ + apt-get -y install --no-install-recommends \ + filebeat \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* + +COPY target/filebeat.yml.tmpl /etc/filebeat/filebeat.yml.tmpl + RUN echo "0 */6 * * * clamav /usr/bin/freshclam --quiet" > /etc/cron.d/clamav-freshclam && \ chmod 644 /etc/clamav/freshclam.conf && \ freshclam && \ @@ -108,6 +116,8 @@ RUN echo "0 */6 * * * clamav /usr/bin/freshclam --quiet" > /etc/cron.d/clamav-fr # Configures Dovecot COPY target/dovecot/auth-passwdfile.inc target/dovecot/??-*.conf /etc/dovecot/conf.d/ +WORKDIR /usr/share/dovecot +# hadolint ignore=SC2016,SC2086 RUN sed -i -e 's/include_try \/usr\/share\/dovecot\/protocols\.d/include_try \/etc\/dovecot\/protocols\.d/g' /etc/dovecot/dovecot.conf && \ sed -i -e 's/#mail_plugins = \$mail_plugins/mail_plugins = \$mail_plugins sieve/g' /etc/dovecot/conf.d/15-lda.conf && \ sed -i -e 's/^.*lda_mailbox_autocreate.*/lda_mailbox_autocreate = yes/g' /etc/dovecot/conf.d/15-lda.conf && \ @@ -117,6 +127,7 @@ RUN sed -i -e 's/include_try \/usr\/share\/dovecot\/protocols\.d/include_try \/e # stretch-backport of dovecot needs this folder mkdir /etc/dovecot/ssl && \ chmod 755 /etc/dovecot/ssl && \ + ./mkcert.sh && \ mkdir -p /usr/lib/dovecot/sieve-pipe /usr/lib/dovecot/sieve-filter /usr/lib/dovecot/sieve-global && \ chmod 755 -R /usr/lib/dovecot/sieve-pipe /usr/lib/dovecot/sieve-filter /usr/lib/dovecot/sieve-global @@ -125,6 +136,7 @@ COPY target/dovecot/dovecot-ldap.conf.ext /etc/dovecot COPY target/postfix/ldap-users.cf target/postfix/ldap-groups.cf target/postfix/ldap-aliases.cf target/postfix/ldap-domains.cf /etc/postfix/ # Enables Spamassassin CRON updates and update hook for supervisor +# hadolint ignore=SC2016 RUN sed -i -r 's/^(CRON)=0/\1=1/g' /etc/default/spamassassin && \ sed -i -r 's/^\$INIT restart/supervisorctl restart amavis/g' /etc/spamassassin/sa-update-hooks.d/amavisd-new @@ -145,8 +157,8 @@ RUN sed -i -r 's/#(@| \\%)bypass/\1bypass/g' /etc/amavis/conf.d/15-content_fil adduser amavis clamav && \ # no syslog user in debian compared to ubuntu adduser --system syslog && \ - useradd -u 5000 -d /home/docker -s /bin/bash -p $(echo docker | openssl passwd -1 -stdin) docker && \ - (echo "0 4 * * * /usr/local/bin/virus-wiper" ; crontab -l) | crontab - + useradd -u 5000 -d /home/docker -s /bin/bash -p "$(echo docker | openssl passwd -1 -stdin)" docker && \ + echo "0 4 * * * /usr/local/bin/virus-wiper" | crontab - # Configure Fail2ban COPY target/fail2ban/jail.conf /etc/fail2ban/jail.conf @@ -154,10 +166,8 @@ COPY target/fail2ban/filter.d/dovecot.conf /etc/fail2ban/filter.d/dovecot.conf RUN echo "ignoreregex =" >> /etc/fail2ban/filter.d/postfix-sasl.conf && mkdir /var/run/fail2ban # Enables Pyzor and Razor -USER amavis -RUN razor-admin -create && \ - razor-admin -register -USER root +RUN su - amavis -c "razor-admin -create && \ + razor-admin -register" # Configure DKIM (opendkim) # DKIM config files @@ -213,8 +223,8 @@ RUN chmod +x /usr/local/bin/* COPY target/supervisor/supervisord.conf /etc/supervisor/supervisord.conf COPY target/supervisor/conf.d/* /etc/supervisor/conf.d/ +WORKDIR / + EXPOSE 25 587 143 465 993 110 995 4190 CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"] - -ADD target/filebeat.yml.tmpl /etc/filebeat/filebeat.yml.tmpl diff --git a/Makefile b/Makefile index 3892edd8..b1c9e055 100644 --- a/Makefile +++ b/Makefile @@ -300,6 +300,11 @@ tests: test/%.bats: ALWAYS_RUN ./test/bats/bin/bats $@ +lint: + # List files which name starts with 'Dockerfile' + # eg. Dockerfile, Dockerfile.build, etc. + git ls-files --exclude='Dockerfile*' --ignored | xargs --max-lines=1 hadolint + clean: # Remove running test containers -docker rm -f \ diff --git a/elk/Dockerfile b/elk/Dockerfile index 05a80211..de97d26f 100644 --- a/elk/Dockerfile +++ b/elk/Dockerfile @@ -1,16 +1,17 @@ -FROM sebp/elk +FROM sebp/elk:720 RUN mkdir /etc/logstash/patterns.d #postfix grok and filter RUN curl -L https://raw.githubusercontent.com/whyscream/postfix-grok-patterns/master/postfix.grok > /etc/logstash/patterns.d/postfix.grok RUN curl -L https://raw.githubusercontent.com/whyscream/postfix-grok-patterns/master/50-filter-postfix.conf > /etc/logstash/conf.d/15-filter-postfix.conf # custom amavis grok and filter -ADD amavis.grok /etc/logstash/patterns.d -ADD 16-amavis.conf /etc/logstash/conf.d +COPY amavis.grok /etc/logstash/patterns.d +COPY 16-amavis.conf /etc/logstash/conf.d # dovecot grok and filter RUN curl -L https://raw.githubusercontent.com/ninech/logstash-patterns/master/patterns.d/dovecot.grok > /etc/logstash/patterns.d/dovecot.grok RUN curl -L https://raw.githubusercontent.com/ninech/logstash-patterns/master/exmples/50-filter-dovecot.conf > /etc/logstash/conf.d/17-filter-dovecot.conf # FIXME: may be a cron job? +SHELL ["/bin/bash", "-o", "pipefail", "-c"] RUN mkdir -p /usr/share/GeoIP && \ curl -L http://geolite.maxmind.com/download/geoip/database/GeoLite2-City.mmdb.gz | gunzip -c - > /usr/share/GeoIP/GeoLiteCity.dat @@ -18,9 +19,9 @@ WORKDIR ${LOGSTASH_HOME} RUN gosu logstash bin/logstash-plugin install --local --no-verify logstash-filter-geoip # override beats input -ADD 02-beats-input.conf /etc/logstash/conf.d/ +COPY 02-beats-input.conf /etc/logstash/conf.d/ # override syslog -ADD 10-syslog.conf /etc/logstash/conf.d/ +COPY 10-syslog.conf /etc/logstash/conf.d/ # avoid Bootstrap Checks failure on production RUN /bin/grep -q -F 'transport.host' /etc/elasticsearch/elasticsearch.yml || echo "transport.host: 127.0.0.1" >> /etc/elasticsearch/elasticsearch.yml diff --git a/test/docker-openldap/Dockerfile b/test/docker-openldap/Dockerfile index 8e32766c..934c498f 100644 --- a/test/docker-openldap/Dockerfile +++ b/test/docker-openldap/Dockerfile @@ -1,5 +1,5 @@ FROM osixia/openldap:1.1.6 -MAINTAINER Dennis Stumm +LABEL maintainer="Dennis Stumm " -ADD bootstrap /container/service/slapd/assets/config/bootstrap +COPY bootstrap /container/service/slapd/assets/config/bootstrap RUN rm /container/service/slapd/assets/config/bootstrap/schema/mmc/mail.schema diff --git a/test/tests.bats b/test/tests.bats index f6706ef5..2e501859 100644 --- a/test/tests.bats +++ b/test/tests.bats @@ -670,7 +670,7 @@ function count_processed_changes() { # Check presence of tables and TrustedHosts run docker run --rm \ -v "$(pwd)/test/config/empty/opendkim":/etc/opendkim \ - `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l" + `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 /etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l" assert_success assert_output 4 } @@ -698,7 +698,7 @@ function count_processed_changes() { # Check presence of tables and TrustedHosts run docker run --rm \ -v "$(pwd)/test/config/without-accounts/opendkim":/etc/opendkim \ - `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l" + `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 /etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l" assert_success assert_output 4 } @@ -726,7 +726,7 @@ function count_processed_changes() { # Check presence of tables and TrustedHosts run docker run --rm \ -v "$(pwd)/test/config/without-virtual/opendkim":/etc/opendkim \ - `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l" + `docker inspect --format '{{ .Config.Image }}' mail` /bin/sh -c "ls -1 /etc/opendkim | grep -E 'KeyTable|SigningTable|TrustedHosts|keys'|wc -l" assert_success assert_output 4 }