Repository navigation
fix(dockerfile): ignore hadolint DL3066 on USER instruction - #222
Merged
Merged
Conversation
Collaborator
|
In theory, hadolint rule 3066 makes sense, but probably not in our case. User www-data is known by the image since the apache server is installed (which means that the www-data profile is created inside the image). We would need the advice from someone who is using librebooking with Kubernetes. |
Collaborator
|
@ikke-t , what would be your opinion on this matter? |
JohnVillalovos
force-pushed
the
jlvillal/hadolint_fix
branch
from
October 10, 2026 16:26
0eabd0f to
c2dc42f
Compare
hadolint 2.15.x adds rule DL3066, which flags a non-numeric user in the USER instruction because the name may not be resolvable by the host system. The rule is info severity, but hadolint-action's default failure-threshold is info, so it fails the "Lint Dockerfile" job. This blocks the Dependabot bump of hadolint/hadolint-action from 3.3.0 to 3.5.0 (#220). Keep `USER www-data:root` and suppress the rule with an inline `# hadolint ignore=DL3066` pragma. The www-data user and root group always exist in the Debian-based php:*-apache base image, and the names are more readable than their numeric IDs. Assisted-by: Claude Opus 5.5 <noreply@anthropic.com>
JohnVillalovos
force-pushed
the
jlvillal/hadolint_fix
branch
from
October 10, 2026 16:26
c2dc42f to
ac78523
Compare
Collaborator
Author
|
@colisee I changed the PR to just ignore this |
Contributor
|
The user depends on kube deployment. In OpenShift kube it gets random uid in each run, and gid root. That's why www-data:root and 0775 chmod earlier. It guarantees whichever uid is, the write permissions will match duenroot group can write to workdirs. |
Collaborator
|
Thank you so much @ikke-t |
JohnVillalovos
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
hadolint 2.15.x adds rule DL3066, which flags a non-numeric user in
the USER instruction because the name may not be resolvable by the
host system. The rule is info severity, but hadolint-action's default
failure-threshold is info, so it fails the "Lint Dockerfile" job. This
blocks the Dependabot bump of hadolint/hadolint-action from 3.3.0 to
3.5.0 (#220).
Keep
USER www-data:rootand suppress the rule with an inline# hadolint ignore=DL3066pragma. The www-data user and root groupalways exist in the Debian-based php:*-apache base image, and the
names are more readable than their numeric IDs.
Assisted-by: Claude Opus 5.5 noreply@anthropic.com