@cryptotaxi247 / kubo / commits / 82fef0c04

feat(ci): docker linting (#10927)

* feat(ci): docker linting adds hadolint to validate dockerfile best practices configures project-specific rules in .hadolint.yaml * fix(ci): enable hadolint console output adds verbose and tty format to see linting results in CI logs * test: trigger hadolint warning remove --no-install-recommends to test CI output * fix(ci): fail hadolint on warnings stricter linting to catch all best practice violations * fix: add --no-install-recommends to apt-get reduces image size by avoiding unnecessary packages * refactor: use WORKDIR instead of cd in dockerfile replaces cd commands with WORKDIR for cleaner dockerfile removes unnecessary hadolint ignore rules DL3003 and DL3009 * chore: simplify hadolint config removes unnecessary override rules for cleaner config

Marcin Rataj committed Aug 26, 2025 at 17:01 UTC 82fef0c04569701f34f769f9f8cc29f0f6ec0621

4 files changed +38 -7

.github/workflows/docker-check.yml renamed

+18 -3

@@ -1,5 +1,7 @@

1 -# If we decide to run build-image.yml on every PR, we could deprecate this workflow.

2 -name: Docker Build

1 +# This workflow performs a quick Docker build check on PRs and pushes to master.

2 +# It builds the Docker image and runs a basic smoke test to ensure the image works.

3 +# This is a lightweight check - for full multi-platform builds and publishing, see docker-image.yml

4 +name: Docker Check

6 on:

7 workflow_dispatch:

@@ -15,7 +17,20 @@ concurrency:

17 cancel-in-progress: true

19 jobs:

18 - docker-build:

20 + lint:

21 + if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch'

22 + runs-on: ubuntu-latest

23 + timeout-minutes: 5

24 + steps:

25 + - uses: actions/checkout@v5

26 + - uses: hadolint/hadolint-action@v3.1.0

27 + with:

28 + dockerfile: Dockerfile

29 + failure-threshold: warning

30 + verbose: true

31 + format: tty

32 +

33 + build:

34 if: github.repository == 'ipfs/kubo' || github.event_name == 'workflow_dispatch'

35 runs-on: ubuntu-latest

36 timeout-minutes: 10

.github/workflows/docker-image.yml

@@ -1,3 +1,7 @@

1 +# This workflow builds and publishes official Docker images to Docker Hub.

2 +# It handles multi-platform builds (amd64, arm/v7, arm64/v8) and pushes tagged releases.

3 +# This workflow is triggered on tags, specific branches, and can be manually dispatched.

4 +# For quick build checks during development, see docker-check.yml

5 name: Docker Push

7 on:

.hadolint.yaml new

+13

@@ -0,0 +1,13 @@

1 +# Hadolint configuration for Kubo Docker image

2 +# https://github.com/hadolint/hadolint

3 +

4 +# Ignore specific rules

5 +ignored:

6 + # DL3008: Pin versions in apt-get install

7 + # We use stable base images and prefer smaller layers over version pinning

8 + - DL3008

9 +

10 +# Trust base images from these registries

11 +trustedRegistries:

12 + - docker.io

13 + - gcr.io

\ No newline at end of file

Dockerfile

+3 -4

@@ -8,9 +8,9 @@ ENV SRC_DIR=/kubo

9 # Cache go module downloads between builds for faster rebuilds

10 COPY go.mod go.sum $SRC_DIR/

11 +WORKDIR $SRC_DIR

12 RUN --mount=type=cache,target=/go/pkg/mod \

12 - cd $SRC_DIR \

13 - && go mod download

13 + go mod download

15 COPY . $SRC_DIR

@@ -25,8 +25,7 @@ ARG MAKE_TARGET=build

25 # mkdir .git/objects allows git rev-parse to read commit hash for version info

26 RUN --mount=type=cache,target=/go/pkg/mod \

27 --mount=type=cache,target=/root/.cache/go-build \

28 - cd $SRC_DIR \

29 - && mkdir -p .git/objects \

28 + mkdir -p .git/objects \

29 && GOOS=$TARGETOS GOARCH=$TARGETARCH GOFLAGS=-buildvcs=false make ${MAKE_TARGET} IPFS_PLUGINS=$IPFS_PLUGINS

31 # Extract required runtime tools from Debian.