Skip to content

dockerfile: rules check for EXPOSE instruction #6135

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from

Conversation

crazy-max
Copy link
Member

@crazy-max crazy-max commented Aug 13, 2025

follow-up #6128 (comment)
fixes #2173

Adds two rules for EXPOSE instruction:

  • ExposeProtoCasing: Protocol in EXPOSE instruction should be lowercase.
  • ExposeInvalidFormat: IP address and host-port mapping should not be used in EXPOSE instruction. This will become an error in a future release.

}
}

func (ps *portSpecs) splitParts(rawport string) (hostIP, hostPort, containerPort string) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Curious why you changed these all into methods, because the ps receiver is not used anywhere, so now it's required to first construct a (redundant portSpecs` before being able to use these functions.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is used in parsePort method to handle the build check and as other functions are only useful for port specs I was thinking it would be better to encapsulate them.

Copy link
Member

@tonistiigi tonistiigi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it make sense to have separate warnings for different invalid inputs of EXPOSE? Maybe we should just have one that covers both the casing and the IP issue. Unless we want to make IPs error instead of warn.

return parts[0], parts[1], parts[2]
default:
n := len(parts)
return strings.Join(parts[:n-2], ":"), parts[n-2], parts[n-1]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This code should ultimately go away, as it's only for handling the hostIP:hostPort-hostPortEnd:containerPort-containerPortEnd/Proto

Ultimately, all that remains is;

Split <port>[-<endport>][/proto] (which would be a split on /, then splitting on -. Which may be a 5 line-function 😂

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes I'm looking to handle this as build check in follow-up for IP address case. In future releases we could just error out if an IP is detected.

@crazy-max
Copy link
Member Author

Does it make sense to have separate warnings for different invalid inputs of EXPOSE?

Yes I think it makes sense to have a separate warning for IP address case to first warn users of removal in the future.

@crazy-max crazy-max force-pushed the lint-expose-proto-casing branch from 52f3531 to 7f64931 Compare August 13, 2025 15:54
@crazy-max crazy-max changed the title dockerfile: rule check for protocol casing in EXPOSE instruction dockerfile: rules check for EXPOSE instruction Aug 13, 2025
@crazy-max
Copy link
Member Author

Pushed extra commit to add a new rule for IP address and host-port mapping

@crazy-max crazy-max force-pushed the lint-expose-proto-casing branch from 7f64931 to d6c82c6 Compare August 13, 2025 21:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Dockerfile: "EXPOSE" parsing is too permissive
3 participants