diff --git a/.dockerignore b/.dockerignore index 3a5374b00c..e33a371f29 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,6 +1,17 @@ +# Ignore git files .git/ .github/ +# Ignore Dodckerfile +Dockerfile + +# Ignore hidden files +.pre-commit-config.yaml +.dockerignore +.gitignore +.pytest* +.DS_Store + # Ignore output directories output/ junit-reports/ diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 6adc8cc3ac..225a5b334a 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -16,3 +16,13 @@ repos: rev: v0.8.0 hooks: - id: shellcheck + + - repo: https://github.com/hadolint/hadolint + rev: v2.10.0 + hooks: + - id: hadolint + name: Lint Dockerfiles + description: Runs hadolint to lint Dockerfiles + language: system + types: ["dockerfile"] + entry: hadolint diff --git a/Dockerfile b/Dockerfile index e4d0e46033..e697fd6422 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,7 @@ # Build command # docker build --platform=linux/amd64 --no-cache -t prowler:latest -f util/Dockerfile . +# hadolint ignore=DL3007 FROM public.ecr.aws/amazonlinux/amazonlinux:latest LABEL maintainer="https://github.com/prowler-cloud/prowler" @@ -8,25 +9,53 @@ LABEL maintainer="https://github.com/prowler-cloud/prowler" ARG USERNAME=prowler ARG USERID=34000 -RUN yum install -y shadow-utils && \ - useradd -s /bin/sh -U -u ${USERID} ${USERNAME} && \ - yum install -y python3 bash curl jq coreutils py3-pip which unzip && \ - yum upgrade -y && \ +# Prepare image as root +USER 0 +# System dependencies +# hadolint ignore=DL3006,DL3013,DL3033 +RUN yum check-update && \ + yum upgrade -y && \ + yum install -y python3 bash curl jq coreutils py3-pip which unzip shadow-utils && \ yum clean all && \ - pip3 install --upgrade pip && \ + rm -rf /var/cache/yum + +RUN amazon-linux-extras install -y epel postgresql14 && \ + yum clean all && \ + rm -rf /var/cache/yum + +# Create non-root user +RUN useradd -l -s /bin/bash -U -u ${USERID} ${USERNAME} + +USER ${USERNAME} + +# Python dependencies +# hadolint ignore=DL3006,DL3013,DL3042 +RUN pip3 install --upgrade pip && \ pip3 install --no-cache-dir boto3 detect-secrets==1.0.3 && \ - pip3 cache purge && \ - curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip && \ + pip3 cache purge + +USER 0 + +# Install AWS CLI +RUN curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip && \ unzip -q awscliv2.zip && \ aws/install && \ - rm -rf aws awscliv2.zip /var/cache/yum && \ - rm /usr/bin/python && \ - ln -s /usr/bin/python3 /usr/bin/python + rm -rf aws awscliv2.zip +# Keep Python2 for yum +RUN sed -i '1 s/python/python2.7/' /usr/bin/yum + +# Set Python3 +RUN rm /usr/bin/python && \ + ln -s /usr/bin/python3 /usr/bin/python + +# Set working directory WORKDIR /prowler +# Copy all files COPY . ./ +# Set files ownership RUN chown -R prowler . USER ${USERNAME}