Class: Dash::Dockerfile::Rules::SingleStageBuildDeps

Inherits:
Base
  • Object
show all
Defined in:
lib/dash/dockerfile/rules/single_stage_build_deps.rb

Overview

Compilers and header packages installed in the only stage ship to production: a bigger image, a bigger attack surface, and nothing gained once the gems are built.

Constant Summary collapse

BUILD_PACKAGES =

A lookahead for whitespace or a shell separator rather than \b: + is not a word character, so g++\b never matches.

/\b(build-essential|gcc|g\+\+|make|[\w.+-]+-dev)(?=[\s;&|)]|$)/
SUGGESTION = 
"split into a build stage and a runtime stage, and COPY --from the build output"

Instance Method Summary collapse

Instance Method Details

#findings ⇒ Object 



9
10
11
12
13
14
15
16
17
18
 
# File 'lib/dash/dockerfile/rules/single_stage_build_deps.rb', line 9

def findings
  return [] unless document.stages.one?

  document.stages.first.instructions.filter_map do |instruction|
    next unless instruction.name == "RUN"
    next unless (packages = instruction.shell_command.scan(BUILD_PACKAGES).map(&:first)).any?

    warning at(instruction), "the only stage installs build tooling (#{packages.uniq.join(", ")}), which ships in the image", SUGGESTION
  end
end