DOK-DL4006 · Set the `SHELL` option `-o pipefail` before using `RUN` with a pipe character

Set the SHELL option -o pipefail before using RUN with a pipe character DOK-DL4006

Bug risk

Major

5 months ago — 3 years old

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check

kubernetes/images/gcloud/Dockerfile

 4RUN apt-get clean -y && apt-get update -y
 5RUN apt-get install -y curl apt-transport-https
 6RUN echo "deb https://packages.cloud.google.com/apt cloud-sdk-jessie main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
 7RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add - 8RUN apt-get update -y && apt-get install -y google-cloud-sdk && apt-get autoremove -y
 9RUN apt-get clean -y
10

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check

kubernetes/images/gcloud/Dockerfile

 3
 4RUN apt-get clean -y && apt-get update -y
 5RUN apt-get install -y curl apt-transport-https
 6RUN echo "deb https://packages.cloud.google.com/apt cloud-sdk-jessie main" | tee -a /etc/apt/sources.list.d/google-cloud-sdk.list 7RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | apt-key add -
 8RUN apt-get update -y && apt-get install -y google-cloud-sdk && apt-get autoremove -y
 9RUN apt-get clean -y

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check

Dockerfile

29COPY pyproject.toml ./
30COPY poetry.lock ./
31
32RUN poetry export -f requirements.txt --without-hashes --only main | poetry run pip install -r /dev/stdin33
34####
35

Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check

Dockerfile

22
23ENV PATH="$POETRY_HOME/bin:$PATH"
24
25RUN set -eo pipefail; wget -O - https://install.python-poetry.org | python -26
27WORKDIR /opt/pysetup
28

Description

Some RUN commands depend on the ability to pipe the output of one command into another, using the pipe character (|), as in the following example:

RUN wget -O - https://some.site | wc -l > /number

Docker executes these commands using the /bin/sh -c interpreter, which only evaluates the exit code of the last operation in the pipe to determine success. In the example above this build step succeeds and produces a new image so long as the wc -l command succeeds, even if the wget command fails.

If you want the command to fail due to an error at any stage in the pipe, prepend set -o pipefail && to ensure that an unexpected error prevents the build from inadvertently succeeding.

Since there are some shells that do not accept the -o pipefail option, it is not enough to add set -o pipefail inside the RUN instruction. Therefore, we recommend to always explicitly set the SHELL before using pipes in RUN.

You can read more about best practices of using pipes here.

Bad Practice

RUN wget -O - https://some.site | wc -l > /number

fossasia / open-event-server

Bad Practice

Recommended