Hadolint

Dockerfile linter, validate inline bash, written in Haskell

AppSec Portal Importer Name: Hadolint, Hadolint Dockerfile check Auditor image: registry.gitlab.com/whitespots-public/security-images/hadolint:2.12.0

Hadolint is a specialized Dockerfile linter designed to ensure the correctness of Dockerfile syntax, adherence to best practices, and the identification of potential issues related to Docker image creation. It focuses on code quality and conformity to Dockerfile standards, assisting in the creation of secure and well-structured Docker images.

Hadolint analyzes Dockerfiles by checking for common mistakes, adherence to Dockerfile guidelines, and potential security issues. This tool can help developers and DevOps teams maintain high-quality Dockerfiles, ensuring that the resulting images are secure, efficient, and error-free.

One notable feature of Hadolint is its ability to provide feedback on Dockerfiles even before the images are built, allowing developers to catch potential issues early in the development process.

Curl example

curl -X POST localhost/api/v1/scan/import/ -H "Authorization: Token a75bb26171cf391671e67b128bfc8ae1c779ff7b" -H "Content-Type: multipart/form-data" -F "file=@./" -F "product_name=Product1" -F "product_type=Application" -F "scanner_name=Hadolint Dockerfile check" -F "branch=dev"

In this command, the following parameters are used:

1. -X POST: specifies the HTTP method to be used (in this case, POST)

2. -H "Authorization: Token <authorization_token>": specifies the authorization token obtained from AppSec Portal.

3. -H "Content-Type: multipart/form-data": specifies the content type of the request.

4. -F "file=@<report_file_path>": specifies the path to the report file generated by the scanner.

5. -F "product_name=<product_name>": specifies the name of the product being scanned.

6. -F "product_type=<product_type>": specifies the type of the product being scanned.

7. -F "scanner_name=<scanner_name>": specifies the name of the scanner used to generate the report (Hadolint or Hadolint Dockerfile check)

8. -F "branch=<branch_name>": (optional) specifies the name of the branch in the source code repository (if applicable) This parameter is particularly useful when you want to associate the scan results with a specific branch in your repository. If not provided, the scan will be associated with the default branch

Report example:

    {
   "line":1,"code":"DL3006","message":"Always tag the version of an image explicitly",
       "column":1,"file":"./test/smoke/Dockerfile","level":"warning"
    },
    {
    "line":3,"code":"DL3018","message":"Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`",
        "column":1,"file":"./test/smoke/Dockerfile","level":"warning"
    },
    {
    "line":3,"code":"DL3019","message":"Use the `--no-cache` switch to avoid the need to use `--update` and remove `/var/cache/apk/*` when done installing packages",
        "column":1,"file":"./test/smoke/Dockerfile","level":"info"
    }
]