perso/mysql-client
4
0
Fork 0
Code Issues 1 Pull Requests Actions Releases Wiki Activity

fix(docker): pin numeric uid/gid so hadolint DL3066 passes
PR Checks / hadolint (pull_request) Successful in 11s
Details
PR Checks / build-test (pull_request) Successful in 31s
Details

Browse Source 
hadolint 2.15.x - pulled in by hadolint-action v3.5.0 - adds DL3066
("Non-numeric user-id may not be resolvable by host system"). The
Dockerfile's `USER muser` trips it and the hadolint job exits 1 (hadolint
fails on info-level findings by default), turning the PR Checks pipeline
red on the Renovate bump PR.

muser was created without an explicit uid/gid, so its numeric identity
depended on busybox's auto-assignment. Both ids are now pinned at
1000:1000 - the values Alpine was already assigning - and USER uses the
numeric form, which is always resolvable by the host.

Verified with the upstream hadolint v2.15.1 binary: the previous
Dockerfile reports "Dockerfile:9 DL3066 info" and exits 1, the fixed one
lints clean and exits 0.

The hadolint-action v3.3.0 -> v3.5.0 bump is included here (all four
workflows, SHA 06be81ba) so that master ends up on v3.5.0 with a clean
lint - superseding Renovate PR #23.
This commit is contained in:
OpenCode Cabillot
2026-09-13 14:41:49 +00:00
parent 78d4ce958a
commit fb061f33a1
5 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/cron.yaml
+1 -1
View File
@@ -11,7 +11,7 @@ jobs:
- name: Checkout - name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: Hadolint - name: Hadolint
uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
continue-on-error: true continue-on-error: true
build: build:
.gitea/workflows/main.yaml
+1 -1
View File
@@ -10,7 +10,7 @@ jobs:
continue-on-error: true continue-on-error: true
steps: steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
with: with:
dockerfile: Dockerfile dockerfile: Dockerfile
.gitea/workflows/pr.yaml
+1 -1
View File
@@ -9,7 +9,7 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 - uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
with: with:
dockerfile: Dockerfile dockerfile: Dockerfile
.gitea/workflows/tag.yaml
+1 -1
View File
@@ -12,7 +12,7 @@ jobs:
- name: Checkout - name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
- name: Hadolint - name: Hadolint
uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 uses: hadolint/hadolint-action@06be81baf89a55ffd0e24b8f04a4185738dd3387 # v3.5.0
continue-on-error: true continue-on-error: true
build: build:
Dockerfile
+4 -2
View File
@@ -4,8 +4,10 @@ LABEL maintainer="Cabillot Julien <dockerimages@cabillot.eu>"
# hadolint ignore=DL3018 # hadolint ignore=DL3018
RUN apk add --no-cache mysql-client && \ RUN apk add --no-cache mysql-client && \
rm -rf /usr/share/apk/keys && \ rm -rf /usr/share/apk/keys && \
adduser -D muser addgroup -g 1000 muser && \
adduser -D -u 1000 -G muser muser
USER muser # Numeric uid/gid (DL3066): identity stays resolvable by the host
USER 1000:1000
ENTRYPOINT [ "/usr/bin/mysql" ] ENTRYPOINT [ "/usr/bin/mysql" ]