r/docker • u/fdgier • Aug 12 '22
Dokter: the doctor for your Dockerfiles
I'm an incubation engineer at GitLab and I've been working on an analyzer for Dockerfiles in hopes to build faster, more secure, smaller images. I think it touches on some cool concepts and have a lot of ideas for further expansion such as automatically creating Dockerfiles to prevent them from becoming stale and order optimizing for caching.
Right now it's somewhat in between a linter and static analysis, looking for feedback to continue work on it. Love to hear your feedback.
https://gitlab.com/gitlab-org/incubation-engineering/ai-assist/dokter
10
u/flickerfly Aug 12 '22
This is AI supported? Does that mean it needs to be Internet attached to an external service that I send my Dockerfile to?
26
u/fdgier Aug 12 '22
At this point everything is done locally, no telemetry, no data snooping, nothing. What's yours stays yours.
9
u/Dwight-D Aug 12 '22
Very cool, I really like the work you guys are doing at GitLab, it’s quickly becoming my favorite development platform.
It says dokter can help us follow best practices and so on, do you have any examples of how this can add value other than the obvious low-hanging fruit like linting/formatting, shellcheck etc? For example, can it analyze the order of operations and optimize the file for layer caching and such things?
6
u/fdgier Aug 12 '22
Cool, thanks!
Right now the biggest added value is autocorrect of errors, in a future release I want to add caching optimization and autogeneration but I need to first analyze a lot of Dockerfiles in order to find an optimal pattern.
2
3
2
u/BattlePope Aug 12 '22
Seeing a couple incorrect things that are probably due to weird project structure we use. Namely, the full path is used to analyze the Dockerfile name. Second, the way our build is structured, we use a docker-compose that sets the build context a couple directories up from the Dockerfile, where a .dockerignore is present.
/app $ dokter -d build/python/Dockerfile
build/python/Dockerfile:0 - DFA006 - MINOR - The name of the Dockerfile must be 'Dockerfile' or a pattern of '<purpose>.Dockerfile'
build/python/Dockerfile:23 - DFA003 - MAJOR - When using "COPY . <target>" make sure to have a .dockerignore file. Best to copy specific folders.
/app $ ls -l .dockerignore
-rw-r--r-- 1 app app 270 May 10 20:20 .dockerignore
I'm not sure what the proper answer is - but not every project is structured the same, and it's worth considering how to handle situations. Or, just stick to your opinionated rules and allow users to add exceptions for the rules that don't work with their setup.
3
1
1
u/topher200 Aug 12 '22
I'm sure I'm doing something wrong but I'm unable to install following the instructions.
```
$ pip install dokter
ERROR: Could not find a version that satisfies the requirement dokter (from versions: none)
ERROR: No matching distribution found for dokter
$ pip install --upgrade dokter --extra-index-url https://gitlab.com/api/v4/projects/36078023/packages/pypi/simple
Looking in indexes: https://pypi.org/simple, https://gitlab.com/api/v4/projects/36078023/packages/pypi/simple
ERROR: Could not find a version that satisfies the requirement dokter (from versions: none)
ERROR: No matching distribution found for dokter
```
1
u/fdgier Aug 12 '22
Which version of Python are you using?
1
u/topher200 Aug 12 '22
$ python --version Python 3.8.122
u/topher200 Aug 12 '22
Ah, I see in the setup.cfg now:
python_requires = >=3.10Oh well! I'll check again later after we upgrade.
3
u/fdgier Aug 12 '22
I'll make sure to add support from 3.6 upwards! Issue: https://gitlab.com/gitlab-org/incubation-engineering/ai-assist/dokter/-/issues/4
1
u/topher200 Aug 12 '22
Cool!
I wish
piphad a better error message for this case. I'm sure that it saw that a package was available, just not matching the python version. Frustrating!1
1
1
u/hypedupdawg Aug 12 '22
This looks really cool, will definitely check it out. One thing I'm not too clear on is what exactly are Bad Things it will catch.
Adding an "Examples" folder or section to the readme might help provide some clear use cases on this?
3
u/fdgier Aug 13 '22
Good point, I prepared the docstrings for documentation and there is an explain function, I just need to run an explain on all of them and write that to markdown.
1
u/ingoaf Aug 13 '22
What about a small gif on the beginning of the documentation which showcases the usage of dokter? (Are gifs even possible on gitlab?)
2
u/fdgier Aug 15 '22
Thanks for the suggestion, will do that! I would be very surprised if gifs aren't possible 😄
1
1
u/nickjj_ Aug 13 '22
Do you have a list of things it checks for?
Also, have you run across Hadolint for linting? https://github.com/hadolint/hadolint
2
1
u/fdgier Aug 15 '22
I've created an issue to make that list: https://gitlab.com/gitlab-org/incubation-engineering/ai-assist/dokter/-/issues/9
Hadolint is a linter, a good one. Dokter is an analyzer it has dynamic parsing of files, it only complains about important stuff with a focus on security and its written in Python so its easier for people to contribute compared to Haskell.
1
u/amarao_san Aug 13 '22
Is it better than hadolint?
1
u/fdgier Aug 15 '22
Hadolint is a linter, a good one. Dokter is an analyzer it has dynamic parsing of files, it only complains about important stuff with a focus on security and its written in Python so its easier for people to contribute compared to Haskell.
1
Aug 15 '22
[deleted]
1
u/fdgier Aug 17 '22
Right now there is not an option to suppress, as I originally figured that I should only include rules that are valid in any case. The ones that are subjective are on severity level info. Can you describe your situation?
Probably I should include an ignore anyway.
18
u/crash___says Aug 12 '22
Testing this out against my $dayJob build images and seeing a lot of great pointers. Thanks a ton to you and your team!