dockerfile.best-practice.missing-dnf-assume-yes-switch.missing-dnf-assume-yes-switch

profile photo of returntocorpreturntocorp
Author
unknown
Download Count*
LGPL Commons Clause
License

This 'dnf install' is missing the '-y' switch. This might stall builds because it requires human intervention. Add the '-y' switch.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: missing-dnf-assume-yes-switch
    severity: WARNING
    languages:
      - dockerfile
    patterns:
      - pattern: |
          RUN ... dnf install ...
      - pattern-not-inside: |
          RUN ... dnf install ... -y ...
      - pattern-not-inside: |
          RUN ... dnf ... --assumeyes ...
    message: This 'dnf install' is missing the '-y' switch. This might stall builds
      because it requires human intervention. Add the '-y' switch.
    metadata:
      source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3038
      references:
        - https://github.com/hadolint/hadolint/wiki/DL3038
      category: best-practice
      technology:
        - dockerfile
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]

Examples

missing-dnf-assume-yes-switch.dockerfile

# cf. https://github.com/hadolint/hadolint/wiki/DL3038

FROM centos
# ruleid: missing-dnf-assume-yes-switch
RUN dnf install httpd-2.24.4 && dnf clean all

# ok: missing-dnf-assume-yes-switch
RUN dnf install -y httpd-2.24.4 && dnf clean all

# ok: missing-dnf-assume-yes-switch
RUN dnf install --downloadonly -y httpd-2.24.4 python

# ok: missing-dnf-assume-yes-switch
RUN dnfinstall -y httpd-2.24.4

# ok: missing-dnf-assume-yes-switch
RUN dnf install -y --downloadonly \
    python3 \
    python3-pip \
    && dnf clean all

# ruleid: missing-dnf-assume-yes-switch
RUN dnf install --downloadonly \
    python3 \
    python3-pip \
    && dnf clean all

# ok: missing-dnf-assume-yes-switch
RUN dnf install --assumeyes \
    --downloadonly \
    python3 \
    python3-pip \
    && dnf clean all