Skip to content

Commit 241d1b7

Browse files
jiridanekcursoragent
jiridanek
and
cursoragent
committed
RHAIENG-287: fix(Dockerfiles): wrap remaining RUN && chains in bash heredocs
Convert workbench Dockerfiles (excluding datascience and rstudio) to RUN /bin/bash <<'EOF' blocks so hadolint accepts source and multiline install steps stay readable. Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent d4ba344 commit 241d1b7

15 files changed

Lines changed: 681 additions & 348 deletions

File tree

‎jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cpu‎

Lines changed: 38 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
2525
# Problem: The operation would result in removing the following protected packages: systemd
2626
# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
2727
# Solution: --best --skip-broken does not work either, so use --nobest
28-
RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
29-
&& dnf clean all -y
28+
RUN /bin/bash <<'EOF'
29+
set -Eeuxo pipefail
30+
dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0
31+
dnf clean all -y
32+
EOF
33+
3034
# upgrade first to avoid fixable vulnerabilities end
3135

3236
# Install useful OS packages
33-
RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum
37+
RUN /bin/bash <<'EOF'
38+
set -Eeuxo pipefail
39+
dnf install -y perl mesa-libGL skopeo
40+
dnf clean all
41+
rm -rf /var/cache/yum
42+
EOF
3443

3544
# Other apps and tools installed as default user
3645
USER 1001
@@ -40,10 +49,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
4049
# Install micropipenv and uv to deploy packages from requirements.txt end
4150

4251
# Install the oc client begin
43-
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
44-
-o /tmp/openshift-client-linux.tar.gz && \
45-
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
46-
rm -f /tmp/openshift-client-linux.tar.gz
52+
RUN /bin/bash <<'EOF'
53+
set -Eeuxo pipefail
54+
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
55+
-o /tmp/openshift-client-linux.tar.gz
56+
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
57+
rm -f /tmp/openshift-client-linux.tar.gz
58+
EOF
59+
4760
# Install the oc client end
4861

4962
####################
@@ -81,21 +94,24 @@ USER 1001
8194
COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./
8295

8396
# Install Python dependencies from requirements.txt file
84-
RUN echo "Installing softwares and packages" && \
85-
# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
86-
# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
87-
uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \
88-
# Disable announcement plugin of jupyterlab \
89-
jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \
90-
# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \
91-
sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \
92-
# copy jupyter configuration
93-
cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \
94-
# Fix permissions to support pip in Openshift environments \
95-
chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \
96-
fix-permissions /opt/app-root -P && \
97-
# Apply JupyterLab addons \
98-
/opt/app-root/bin/utils/addons/apply.sh
97+
RUN /bin/bash <<'EOF'
98+
set -Eeuxo pipefail
99+
echo "Installing softwares and packages"
100+
# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
101+
# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
102+
uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml
103+
# Disable announcement plugin of jupyterlab
104+
jupyter labextension disable "@jupyterlab/apputils-extension:announcements"
105+
# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y
106+
sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json
107+
# copy jupyter configuration
108+
cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter
109+
# Fix permissions to support pip in Openshift environments
110+
chmod -R g+w /opt/app-root/lib/python3.12/site-packages
111+
fix-permissions /opt/app-root -P
112+
# Apply JupyterLab addons
113+
/opt/app-root/bin/utils/addons/apply.sh
114+
EOF
99115

100116
WORKDIR /opt/app-root/src
101117

‎jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.cuda‎

Lines changed: 38 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
2727
# Problem: The operation would result in removing the following protected packages: systemd
2828
# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
2929
# Solution: --best --skip-broken does not work either, so use --nobest
30-
RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
31-
&& dnf clean all -y
30+
RUN /bin/bash <<'EOF'
31+
set -Eeuxo pipefail
32+
dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0
33+
dnf clean all -y
34+
EOF
35+
3236
# upgrade first to avoid fixable vulnerabilities end
3337

3438
# Install useful OS packages
35-
RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum
39+
RUN /bin/bash <<'EOF'
40+
set -Eeuxo pipefail
41+
dnf install -y perl mesa-libGL skopeo
42+
dnf clean all
43+
rm -rf /var/cache/yum
44+
EOF
3645

3746
# Other apps and tools installed as default user
3847
USER 1001
@@ -42,10 +51,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
4251
# Install micropipenv and uv to deploy packages from requirements.txt end
4352

4453
# Install the oc client begin
45-
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
46-
-o /tmp/openshift-client-linux.tar.gz && \
47-
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
48-
rm -f /tmp/openshift-client-linux.tar.gz
54+
RUN /bin/bash <<'EOF'
55+
set -Eeuxo pipefail
56+
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
57+
-o /tmp/openshift-client-linux.tar.gz
58+
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
59+
rm -f /tmp/openshift-client-linux.tar.gz
60+
EOF
61+
4962
# Install the oc client end
5063

5164
#########################
@@ -81,21 +94,24 @@ USER 1001
8194
COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./
8295

8396
# Install Python dependencies from requirements.txt file
84-
RUN echo "Installing softwares and packages" && \
85-
# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
86-
# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
87-
uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \
88-
# Disable announcement plugin of jupyterlab \
89-
jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \
90-
# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \
91-
sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \
92-
# copy jupyter configuration
93-
cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \
94-
# Fix permissions to support pip in Openshift environments \
95-
chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \
96-
fix-permissions /opt/app-root -P && \
97-
# Apply JupyterLab addons \
98-
/opt/app-root/bin/utils/addons/apply.sh
97+
RUN /bin/bash <<'EOF'
98+
set -Eeuxo pipefail
99+
echo "Installing softwares and packages"
100+
# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
101+
# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
102+
uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml
103+
# Disable announcement plugin of jupyterlab
104+
jupyter labextension disable "@jupyterlab/apputils-extension:announcements"
105+
# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y
106+
sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json
107+
# copy jupyter configuration
108+
cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter
109+
# Fix permissions to support pip in Openshift environments
110+
chmod -R g+w /opt/app-root/lib/python3.12/site-packages
111+
fix-permissions /opt/app-root -P
112+
# Apply JupyterLab addons
113+
/opt/app-root/bin/utils/addons/apply.sh
114+
EOF
99115

100116
WORKDIR /opt/app-root/src
101117

‎jupyter/minimal/ubi9-python-3.12/Dockerfile.konflux.rocm‎

Lines changed: 49 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,21 @@ COPY --from=ubi-repos /etc/yum.repos.d/ubi.repo /etc/yum.repos.d/ubi.repo
2525
# Problem: The operation would result in removing the following protected packages: systemd
2626
# (try to add '--allowerasing' to command line to replace conflicting packages or '--skip-broken' to skip uninstallable packages)
2727
# Solution: --best --skip-broken does not work either, so use --nobest
28-
RUN dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0 \
29-
&& dnf clean all -y
28+
RUN /bin/bash <<'EOF'
29+
set -Eeuxo pipefail
30+
dnf -y upgrade --refresh --nobest --skip-broken --nodocs --noplugins --setopt=install_weak_deps=0 --setopt=keepcache=0
31+
dnf clean all -y
32+
EOF
33+
3034
# upgrade first to avoid fixable vulnerabilities end
3135

3236
# Install useful OS packages
33-
RUN dnf install -y perl mesa-libGL skopeo && dnf clean all && rm -rf /var/cache/yum
37+
RUN /bin/bash <<'EOF'
38+
set -Eeuxo pipefail
39+
dnf install -y perl mesa-libGL skopeo
40+
dnf clean all
41+
rm -rf /var/cache/yum
42+
EOF
3443

3544
# Other apps and tools installed as default user
3645
USER 1001
@@ -40,10 +49,14 @@ RUN pip install --no-cache-dir -U "micropipenv[toml]==1.9.0" "uv==0.8.12"
4049
# Install micropipenv and uv to deploy packages from requirements.txt end
4150

4251
# Install the oc client begin
43-
RUN curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
44-
-o /tmp/openshift-client-linux.tar.gz && \
45-
tar -xzvf /tmp/openshift-client-linux.tar.gz oc && \
46-
rm -f /tmp/openshift-client-linux.tar.gz
52+
RUN /bin/bash <<'EOF'
53+
set -Eeuxo pipefail
54+
curl -L https://mirror.openshift.com/pub/openshift-v4/$(uname -m)/clients/ocp/stable/openshift-client-linux.tar.gz \
55+
-o /tmp/openshift-client-linux.tar.gz
56+
tar -xzvf /tmp/openshift-client-linux.tar.gz oc
57+
rm -f /tmp/openshift-client-linux.tar.gz
58+
EOF
59+
4760
# Install the oc client end
4861

4962
########################
@@ -69,31 +82,43 @@ USER 1001
6982
COPY ${MINIMAL_SOURCE_CODE}/pylock.toml ${MINIMAL_SOURCE_CODE}/start-notebook.sh ./
7083

7184
# Install Python dependencies from Pipfile.lock file
72-
RUN echo "Installing softwares and packages" && \
73-
# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
74-
# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
75-
uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml && \
76-
# Disable announcement plugin of jupyterlab \
77-
jupyter labextension disable "@jupyterlab/apputils-extension:announcements" && \
78-
# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y \
79-
sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json && \
80-
# copy jupyter configuration
81-
cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter && \
82-
# Apply JupyterLab addons \
83-
/opt/app-root/bin/utils/addons/apply.sh
84-
85-
# Fix permissions to support pip in Openshift environments \
85+
RUN /bin/bash <<'EOF'
86+
set -Eeuxo pipefail
87+
echo "Installing softwares and packages"
88+
# This may have to download and compile some dependencies, and as we don't lock requirements from `build-system.requires`,
89+
# we often don't know the correct hashes and `--require-hashes` would therefore fail on non amd64, where building is common.
90+
uv pip install --strict --no-deps --no-cache --no-config --no-progress --verify-hashes --compile-bytecode --index-strategy=unsafe-best-match --requirements=./pylock.toml
91+
# Disable announcement plugin of jupyterlab
92+
jupyter labextension disable "@jupyterlab/apputils-extension:announcements"
93+
# Replace Notebook's launcher, "(ipykernel)" with Python's version 3.x.y
94+
sed -i -e "s/Python.*/$(python --version | cut -d '.' -f-2)\",/" /opt/app-root/share/jupyter/kernels/python3/kernel.json
95+
# copy jupyter configuration
96+
cp /opt/app-root/bin/utils/jupyter_server_config.py /opt/app-root/etc/jupyter
97+
# Apply JupyterLab addons
98+
/opt/app-root/bin/utils/addons/apply.sh
99+
EOF
100+
101+
# Fix permissions to support pip in Openshift environments
86102
USER 0
87-
RUN chmod -R g+w /opt/app-root/lib/python3.12/site-packages && \
88-
fix-permissions /opt/app-root -P
103+
RUN /bin/bash <<'EOF'
104+
set -Eeuxo pipefail
105+
chmod -R g+w /opt/app-root/lib/python3.12/site-packages
106+
fix-permissions /opt/app-root -P
107+
EOF
108+
89109
USER 1001
90110

91111
# Workaround for https://issues.redhat.com/browse/AIPCC-8152
92112
ENV ROCM_PATH=/opt/rocm
93113
# Workaround for 2.25.2 issue https://issues.redhat.com/browse/RHAIENG-1638 missing rocm package in older AIPCC builds
94114
# https://issues.redhat.com/browse/AIPCC-5882
95115
USER 0
96-
RUN dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs && dnf clean all
116+
RUN /bin/bash <<'EOF'
117+
set -Eeuxo pipefail
118+
dnf --setopt=reposdir=/etc/rhaipcc/repos.d --enablerepo="external-amd-rocm-*" install -y rocm-device-libs
119+
dnf clean all
120+
EOF
121+
97122
USER 1001
98123

99124
WORKDIR /opt/app-root/src

0 commit comments

Comments
 (0)