use "-o pipefail" for RUN commands in modules Dockerfiles

see: https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#using-pipes https://github.com/hadolint/hadolint/wiki/DL4006
nginxinc · Feb 6, 2024 · 5b7624a · 5b7624a
1 parent 77dafa6
commit 5b7624a
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 12 deletions.
diff --git a/modules/Dockerfile b/modules/Dockerfile
@@ -3,16 +3,16 @@ FROM ${NGINX_FROM_IMAGE} as builder
 
 ARG ENABLED_MODULES
 
-RUN set -ex \
-    && if [ "$ENABLED_MODULES" = "" ]; then \
+SHELL ["/bin/bash", "-exo", "pipefail", "-c"]
+
+RUN if [ "$ENABLED_MODULES" = "" ]; then \
         echo "No additional modules enabled, exiting"; \
         exit 1; \
     fi
 
 COPY ./ /modules/
 
-RUN set -ex \
-    && apt-get update \
+RUN apt-get update \
     && apt-get install -y --no-install-suggests --no-install-recommends \
                 patch make wget mercurial devscripts debhelper dpkg-dev \
                 quilt lsb-release build-essential libxml2-utils xsltproc \
@@ -71,8 +71,7 @@ RUN set -ex \
 
 FROM ${NGINX_FROM_IMAGE}
 RUN --mount=type=bind,target=/tmp/packages/,source=/tmp/packages/,from=builder \
-    set -ex \
-    && apt-get update \
+    apt-get update \
     && . /tmp/packages/modules.env \
     && for module in $BUILT_MODULES; do \
            apt-get install --no-install-suggests --no-install-recommends -y /tmp/packages/nginx-module-${module}_${NGINX_VERSION}*.deb; \

diff --git a/modules/Dockerfile.alpine b/modules/Dockerfile.alpine
@@ -3,16 +3,16 @@ FROM ${NGINX_FROM_IMAGE} as builder
 
 ARG ENABLED_MODULES
 
-RUN set -ex \
-    && if [ "$ENABLED_MODULES" = "" ]; then \
+SHELL ["/bin/ash", "-exo", "pipefail", "-c"]
+
+RUN if [ "$ENABLED_MODULES" = "" ]; then \
         echo "No additional modules enabled, exiting"; \
         exit 1; \
     fi
 
 COPY ./ /modules/
 
-RUN set -ex \
-    && apk update \
+RUN apk update \
     && apk add linux-headers openssl-dev pcre2-dev zlib-dev openssl abuild \
                musl-dev libxslt libxml2-utils make mercurial gcc unzip git \
                xz g++ coreutils \
@@ -63,8 +63,7 @@ RUN set -ex \
 
 FROM ${NGINX_FROM_IMAGE}
 RUN --mount=type=bind,target=/tmp/packages/,source=/tmp/packages/,from=builder \
-    set -ex \
-    && . /tmp/packages/modules.env \
+    . /tmp/packages/modules.env \
     && for module in $BUILT_MODULES; do \
            apk add --no-cache --allow-untrusted /tmp/packages/nginx-module-${module}-${NGINX_VERSION}*.apk; \
        done