Skip to content

Commit

Permalink
APP-5322-update-yarn-to-v2
Browse files Browse the repository at this point in the history 
update the Dockerfile with updated Yarn to V2
  • Loading branch information
@farhad-ris
farhad-ris committed Sep 24, 2024
1 parent 77551ee commit 0fbc02b
Showing 1 changed file with 29 additions and 13 deletions.
42 changes: 29 additions & 13 deletions Dockerfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,26 +6,42 @@ FROM $NODE_ALPINE_IMAGE
ARG SERVERLESS_VERSION=latest
ENV SERVERLESS_VERSION $SERVERLESS_VERSION

RUN apk --no-cache add python3 python3-dev py-pip poetry aws-cli ca-certificates groff less bash make cmake jq curl wget g++ zip git openssh && \
# Install dependencies
RUN apk --no-cache add \

Check warning on line 10 in Dockerfile

View check run for this annotation

Wiz Security Bot (22793c4344) / Wiz IaC Scanner

Unpinned Package Version in Apk Add 

Rule ID: a9814cfa-c0c7-4fd8-9bd7-bdc323973360
Severity: Medium
Resource: FROM={{$NODE_ALPINE_IMAGE}}.{{RUN apk --no-cache add     python3     python3-dev     py-pip     poetry     aws-cli     ca-certificates     groff     less     bash     make     cmake     jq     curl     wget     g++     zip     git     openssh &&     update-ca-certificates}}

Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes
Raw output 
Expected: RUN instruction with 'apk add <package>' should use package pinning form 'apk add <package>=<version>'
Found: RUN instruction apk --no-cache add     python3     python3-dev     py-pip     poetry     aws-cli     ca-certificates     groff     less     bash     make     cmake     jq     curl     wget     g++     zip     git     openssh &&     update-ca-certificates does not use package pinning form
python3 \
python3-dev \
py-pip \
poetry \
aws-cli \
ca-certificates \
groff \
less \
bash \
make \
cmake \
jq \
curl \
wget \
g++ \
zip \
git \
openssh && \
update-ca-certificates

# Install glibc for alpine
RUN wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub && \
wget -q https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.34-r0/glibc-2.34-r0.apk && \
apk add --force-overwrite glibc-2.34-r0.apk && \
rm -f glibc-2.34-r0.apk

RUN mkdir -p /tmp/yarn && \
mkdir -p /opt/yarn/dist && \
cd /tmp/yarn && \
wget -q https://yarnpkg.com/latest.tar.gz && \
tar zvxf latest.tar.gz && \
find /tmp/yarn -maxdepth 2 -mindepth 2 -exec mv {} /opt/yarn/dist/ \; && \
rm -rf /tmp/yarn

RUN ln -sf /opt/yarn/dist/bin/yarn /usr/local/bin/yarn && \
ln -sf /opt/yarn/dist/bin/yarn /usr/local/bin/yarnpkg && \
# Enable Corepack and set Yarn to Berry version
RUN npm install -g corepack && \

Check warning on line 38 in Dockerfile

View check run for this annotation

Wiz Security Bot (22793c4344) / Wiz IaC Scanner

Install command without pinned version 

Rule ID: 2594c504-dcdd-4294-acdb-81eca2baeb9f
Severity: Medium
Resource: FROM={{$NODE_ALPINE_IMAGE}}.{{RUN npm install -g corepack &&     corepack enable &&     yarn set version berry &&     yarn --version}}

Check if packages installed by npm and pnpm are pinning a specific version.
Raw output 
Expected: 'RUN npm install -g corepack &&     corepack enable &&     yarn set version berry &&     yarn --version' uses npm install with a pinned version
Found: 'RUN npm install -g corepack &&     corepack enable &&     yarn set version berry &&     yarn --version' does not uses npm install with a pinned version
corepack enable && \
yarn set version berry && \
yarn --version

RUN yarn global add serverless@$SERVERLESS_VERSION
# Use yarn dlx to run serverless without globally installing
RUN yarn dlx serverless@$SERVERLESS_VERSION --version

WORKDIR /opt/app
# Set working directory
WORKDIR /opt/app

0 comments on commit 0fbc02b

Please sign in to comment.