Why should we ensure apt is not used with RUN command for Docker file (AC_DOCKER_0002)

[tr4l]

A bunch of new compliance rules has been added recently (which is nice!)

Several of them relate to the fact that we don't want to update system package of docker image.

I mostly share the point of view of Itamar Turner-Trauring- on that matter and we can see that hadolint also allow apt update/upgrade but disallow dist-upgrade.

Did you have any other reason/pointer on "why" I should not run apt on my docker creation image ?

[TechnicallyJoe]

Hi

I cannot find any reason online as to why this is. I even asked Chatgpt!
Why should we ensure apt is not used with a RUN command in dockerfiles and what would be the better approach?

[jstbillz]

@TechnicallyJoe
I don't think it's just apt - it will complain if you change it to apt-get.
The better practice is, as described here , to always combine apt-get with apt-get update in the same RUN

[jstbillz]

My bad, wrong scratch that bridgecrew reference out.

[tfrokt]

I don't understand why trunk doesn't give a recommendation. This error is not helpful.

[jaredquinn]

I am still getting this failure when lines wrap:

RUN apt-get update && \
         apt-get install -y git ... && \
         apt-get clean && rm -rf /var/lib/apt/lists/*

[scriptkiddie123]

Seems like the rules assumes that the base image is a Red Hat image, and that you must use dnf or yum.
So you either need to disable the scanning for AC_DOCKER_0002, or switch your base image to a Red Hat compatible image, to make the scanner happy.

[TechnicallyJoe]

@TechnicallyJoe I don't think it's just apt - it will complain if you change it to apt-get. The better practice is, as described here , to always combine apt-get with apt-get update in the same RUN

I hear you and i might be remembering wrong (My response is a little old)

But thats not what the error says :-)