syncable_cli/analyzer/hadolint/rules/
dl3001.rs

1//! DL3001: Don't use invalid commands in RUN
2//!
3//! Commands like ssh, vim, shutdown, service, ps, free, top, kill, and mount
4//! are not appropriate for Dockerfile RUN instructions.
5
6use crate::analyzer::hadolint::parser::instruction::Instruction;
7use crate::analyzer::hadolint::rules::{SimpleRule, simple_rule};
8use crate::analyzer::hadolint::shell::ParsedShell;
9use crate::analyzer::hadolint::types::Severity;
10
11/// Invalid commands that shouldn't be used in Dockerfiles.
12const INVALID_COMMANDS: &[&str] = &[
13    "ssh", "vim", "shutdown", "service", "ps", "free", "top", "kill", "mount", "ifconfig", "nano",
14];
15
16pub fn rule() -> SimpleRule<impl Fn(&Instruction, Option<&ParsedShell>) -> bool + Send + Sync> {
17    simple_rule(
18        "DL3001",
19        Severity::Info,
20        "For some bash commands it makes no sense running them in a Docker container like ssh, vim, shutdown, service, ps, free, top, kill, mount, ifconfig",
21        |instr, shell| match instr {
22            Instruction::Run(_) => {
23                if let Some(shell) = shell {
24                    !shell.any_command(|cmd| INVALID_COMMANDS.contains(&cmd.name.as_str()))
25                } else {
26                    true
27                }
28            }
29            _ => true,
30        },
31    )
32}
33
34#[cfg(test)]
35mod tests {
36    use super::*;
37    use crate::analyzer::hadolint::parser::instruction::RunArgs;
38    use crate::analyzer::hadolint::rules::{Rule, RuleState};
39
40    #[test]
41    fn test_valid_command() {
42        let rule = rule();
43        let mut state = RuleState::new();
44
45        let instr = Instruction::Run(RunArgs::shell("apt-get update"));
46        let shell = ParsedShell::parse("apt-get update");
47        rule.check(&mut state, 1, &instr, Some(&shell));
48        assert!(state.failures.is_empty());
49    }
50
51    #[test]
52    fn test_invalid_ssh() {
53        let rule = rule();
54        let mut state = RuleState::new();
55
56        let instr = Instruction::Run(RunArgs::shell("ssh user@host"));
57        let shell = ParsedShell::parse("ssh user@host");
58        rule.check(&mut state, 1, &instr, Some(&shell));
59        assert_eq!(state.failures.len(), 1);
60        assert_eq!(state.failures[0].code.as_str(), "DL3001");
61    }
62
63    #[test]
64    fn test_invalid_vim() {
65        let rule = rule();
66        let mut state = RuleState::new();
67
68        let instr = Instruction::Run(RunArgs::shell("vim /etc/config"));
69        let shell = ParsedShell::parse("vim /etc/config");
70        rule.check(&mut state, 1, &instr, Some(&shell));
71        assert_eq!(state.failures.len(), 1);
72    }
73}
syncable_cli/analyzer/hadolint/rules/dl3001.rs

syncable_cli/analyzer/hadolint/rules/
dl3001.rs
