Lint with hadolint

.github/hadolint.yml

@@ -0,0 +1,3 @@
+---
+trustedRegistries:
+  - docker.io

.github/workflows/build-images.yml

@@ -21,6 +21,12 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
+      - name: Lint Dockerfile
+        uses: hadolint/[email protected]
+        with:
+          dockerfile: ${{ matrix.distribution }}/Dockerfile
+          config: ".github/hadolint.yml"
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
 

alpine/Dockerfile

@@ -36,7 +36,11 @@ LABEL org.opencontainers.image.created=$BUILD_DATE \
     org.opencontainers.image.source="https://github.com/openhab/openhab-docker.git" \
     org.opencontainers.image.authors="openHAB <[email protected]>"
 
-# Install basepackages
+# https://github.com/hadolint/hadolint/wiki/DL4006
+SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
+
+# Install basepackages. Versions are "pinned" by using a pinned base image.
+# hadolint ignore=DL3018
 RUN apk update --no-cache && \
     apk add --no-cache \
         arping \
@@ -60,11 +64,13 @@ RUN apk update --no-cache && \
     rm -rf /var/cache/apk/*
 
 # Limit JDK crypto policy by default to comply with local laws which may prohibit use of unlimited strength cryptography
-RUN JAVA_HOME=$(ls -d /usr/lib/jvm/*jdk*) && \
+RUN JAVA_HOME=$(find /usr/lib/jvm -maxdepth 1 -name "*jdk*" -type d) && \
     sed -i 's/^crypto.policy=unlimited/crypto.policy=limited/' "${JAVA_HOME}/conf/security/java.security"
 
 # Install openHAB
 # Set permissions for openHAB. Export TERM variable. See issue #30 for details!
+# Single quotes are used on purpose, so $TERM is expanded when running the container.
+# hadolint ignore=SC2016
 RUN version="$(echo $OPENHAB_VERSION | sed 's/snapshot/SNAPSHOT/g')" && \
     if [ $(echo $version | grep -E '^.+\.(M|RC).+$') ]; then url="https://openhab.jfrog.io/openhab/libs-milestone-local/org/openhab/distro/openhab/${version}/openhab-${version}.zip"; \
     elif [ $(echo $version | grep -E '^4\..+-SNAPSHOT$') ]; then url="https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab/target/openhab-${version}.zip"; \

alpine/entrypoint

@@ -4,7 +4,7 @@ interactive=$(if test -t 0; then echo true; else echo false; fi)
 set -eux -o pipefail ${EXTRA_SHELL_OPTS-}
 IFS=$'\n\t'
 
-export JAVA_HOME=$(ls -d /usr/lib/jvm/*jdk*)
+export JAVA_HOME=$(find /usr/lib/jvm -maxdepth 1 -name "*jdk*" -type d)
 
 # Configure Java unlimited strength cryptography
 if [ "${CRYPTO_POLICY}" = "unlimited" ]; then

debian/Dockerfile

@@ -36,7 +36,11 @@ LABEL org.opencontainers.image.created=$BUILD_DATE \
     org.opencontainers.image.source="https://github.com/openhab/openhab-docker.git" \
     org.opencontainers.image.authors="openHAB <[email protected]>"
 
-# Install basepackages
+# https://github.com/hadolint/hadolint/wiki/DL4006
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+# Install basepackages. Versions are "pinned" by using a pinned base image.
+# hadolint ignore=DL3008
 RUN apt-get update && \
     DEBIAN_FRONTEND=noninteractive apt-get install --no-install-recommends -y \
         arping \
@@ -62,11 +66,13 @@ RUN apt-get update && \
     rm -rf /var/lib/apt/lists/*
 
 # Limit JDK crypto policy by default to comply with local laws which may prohibit use of unlimited strength cryptography
-RUN JAVA_HOME=$(ls -d /usr/lib/jvm/*jdk* | tail -n 1) && \
+RUN JAVA_HOME=$(find /usr/lib/jvm -maxdepth 1 -name "*jdk*" -type d) && \
     sed -i 's/^crypto.policy=unlimited/crypto.policy=limited/' "${JAVA_HOME}/conf/security/java.security"
 
 # Install openHAB
 # Set permissions for openHAB. Export TERM variable. See issue #30 for details!
+# Single quotes are used on purpose, so $TERM is expanded when running the container.
+# hadolint ignore=SC2016
 RUN version="$(echo $OPENHAB_VERSION | sed 's/snapshot/SNAPSHOT/g')" && \
     if [ $(echo $version | grep -E '^.+\.(M|RC).+$') ]; then url="https://openhab.jfrog.io/openhab/libs-milestone-local/org/openhab/distro/openhab/${version}/openhab-${version}.zip"; \
     elif [ $(echo $version | grep -E '^4\..+-SNAPSHOT$') ]; then url="https://ci.openhab.org/job/openHAB-Distribution/lastSuccessfulBuild/artifact/distributions/openhab/target/openhab-${version}.zip"; \

debian/entrypoint

@@ -4,7 +4,7 @@ interactive=$(if test -t 0; then echo true; else echo false; fi)
 set -eux -o pipefail ${EXTRA_SHELL_OPTS-}
 IFS=$'\n\t'
 
-export JAVA_HOME=$(ls -d /usr/lib/jvm/*jdk* | tail -n 1)
+export JAVA_HOME=$(find /usr/lib/jvm -maxdepth 1 -name "*jdk*" -type d)
 
 # Configure Java unlimited strength cryptography
 if [ "${CRYPTO_POLICY}" = "unlimited" ]; then