syncable_cli/analyzer/hadolint/rules/
dl3032.rs

1//! DL3032: yum clean all after yum install
2//!
3//! Clean up yum cache after installing packages to reduce image size.
4
5use crate::analyzer::hadolint::parser::instruction::Instruction;
6use crate::analyzer::hadolint::rules::{SimpleRule, simple_rule};
7use crate::analyzer::hadolint::shell::ParsedShell;
8use crate::analyzer::hadolint::types::Severity;
9
10pub fn rule() -> SimpleRule<impl Fn(&Instruction, Option<&ParsedShell>) -> bool + Send + Sync> {
11    simple_rule(
12        "DL3032",
13        Severity::Warning,
14        "`yum clean all` missing after yum command.",
15        |instr, shell| {
16            match instr {
17                Instruction::Run(_) => {
18                    if let Some(shell) = shell {
19                        // Check if yum install is used
20                        let has_yum_install = shell.any_command(|cmd| {
21                            cmd.name == "yum"
22                                && cmd.has_any_arg(&["install", "groupinstall", "localinstall"])
23                        });
24
25                        if !has_yum_install {
26                            return true;
27                        }
28
29                        // Check if cleanup is done
30                        let has_cleanup = shell.any_command(|cmd| {
31                            (cmd.name == "yum" && cmd.has_any_arg(&["clean"]))
32                                || (cmd.name == "rm"
33                                    && cmd
34                                        .arguments
35                                        .iter()
36                                        .any(|arg| arg.contains("/var/cache/yum")))
37                        });
38
39                        has_cleanup
40                    } else {
41                        true
42                    }
43                }
44                _ => true,
45            }
46        },
47    )
48}
49
50#[cfg(test)]
51mod tests {
52    use super::*;
53    use crate::analyzer::hadolint::config::HadolintConfig;
54    use crate::analyzer::hadolint::lint::{LintResult, lint};
55
56    fn lint_dockerfile(content: &str) -> LintResult {
57        lint(content, &HadolintConfig::default())
58    }
59
60    #[test]
61    fn test_yum_install_without_clean() {
62        let result = lint_dockerfile("FROM centos:7\nRUN yum install -y nginx");
63        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL3032"));
64    }
65
66    #[test]
67    fn test_yum_install_with_clean() {
68        let result = lint_dockerfile("FROM centos:7\nRUN yum install -y nginx && yum clean all");
69        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3032"));
70    }
71
72    #[test]
73    fn test_yum_install_with_rm_cache() {
74        let result =
75            lint_dockerfile("FROM centos:7\nRUN yum install -y nginx && rm -rf /var/cache/yum");
76        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3032"));
77    }
78
79    #[test]
80    fn test_no_yum_install() {
81        let result = lint_dockerfile("FROM centos:7\nRUN yum update");
82        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3032"));
83    }
84}
syncable_cli/analyzer/hadolint/rules/dl3032.rs

syncable_cli/analyzer/hadolint/rules/
dl3032.rs
