feat: Lint Dockerfiles

Ignore rule to force setting specific package versions since

- Ubuntu should only be receiving non-breaking patches,
- we don't want the overhead of having to follow up on every package
  upgrade manually (see
  dependabot/dependabot-core#2129), and
- locking only the top level packages means we'd still get arbitrary
  versions of their dependencies.

.hadolint.yaml

@@ -0,0 +1,3 @@
+---
+ignored:
+    - DL3008

.pre-commit-config.yaml

@@ -19,6 +19,12 @@ repos:
             language: system
             stages: [commit-msg]
 
+          - id: hadolint
+            name: hadolint
+            language: docker_image
+            entry: hadolint/hadolint hadolint
+            files: Dockerfile
+
           - id: isort
             name: isort
             entry: isort

datalake/backend/processing/check_files_checksums/Dockerfile

@@ -1,6 +1,8 @@
 FROM ubuntu:20.04
 ENV DEBIAN_FRONTEND noninteractive
-RUN apt update && apt install -y python3 && rm -rf /var/lib/apt/lists/*
+RUN apt-get update \
+    && apt-get install --assume-yes --no-install-recommends python3 \
+    && rm -rf /var/lib/apt/lists/*
 COPY datalake/backend/processing/check_files_checksums/task.py /opt/task.py
 RUN chmod +x /opt/task.py
 ENTRYPOINT ["/opt/task.py"]

datalake/backend/processing/check_flat_directory_structure/Dockerfile

@@ -1,6 +1,8 @@
 FROM ubuntu:20.04
 ENV DEBIAN_FRONTEND noninteractive
-RUN apt update && apt install -y python3 && rm -rf /var/lib/apt/lists/*
+RUN apt-get update \
+    && apt-get install --assume-yes --no-install-recommends python3 \
+    && rm -rf /var/lib/apt/lists/*
 COPY datalake/backend/processing/check_flat_directory_structure/task.py /opt/task.py
 RUN chmod +x /opt/task.py
 ENTRYPOINT ["/opt/task.py"]

datalake/backend/processing/check_stac_metadata/Dockerfile

@@ -1,19 +1,26 @@
 FROM ubuntu:20.04 as build
 
 RUN apt-get update \
-    && apt-get install -y curl python3-pip \
+    && apt-get install --assume-yes --no-install-recommends curl python3-pip \
     && rm -rf /var/lib/apt/lists/*
-RUN curl -sSL https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py | python3 -
+RUN curl --location --show-error --silent --output get-poetry.py https://raw.githubusercontent.com/python-poetry/poetry/master/get-poetry.py \
+    && echo 'bfc42cff9cb49bb74f6a1fe12c37fb08bcf7a49245a441c272dfd25254d8ae39 get-poetry.py' > get-poetry.py.sha256 \
+    && sha256sum --check get-poetry.py.sha256 \
+    && python3 get-poetry.py \
+    && rm get-poetry.py get-poetry.py.sha256
 COPY poetry.lock poetry.toml pyproject.toml /opt/
-RUN cd /opt && ~/.poetry/bin/poetry install --extras=check-stac-metadata-job --no-dev
+WORKDIR /opt
+RUN ~/.poetry/bin/poetry install --extras=check-stac-metadata-job --no-dev
 
 
 FROM ubuntu:20.04
 
 ENTRYPOINT ["/opt/.venv/bin/python", "/opt/task.py"]
 
 ENV DEBIAN_FRONTEND noninteractive
-RUN apt-get update && apt-get install -y python3 && rm -rf /var/lib/apt/lists/*
+RUN apt-get update \
+    && apt-get install --assume-yes --no-install-recommends python3 \
+    && rm -rf /var/lib/apt/lists/*
 
 COPY --from=build /opt/.venv /opt/.venv