How do we perform static code analysis of a Dockerfile, in the course we just ta . . .

Kubernetes
#1

Rockford:
How do we perform static code analysis of a Dockerfile, in the course we just talk about kube manifest.

#2

Rockford:
@Mumshad Mannambeth help would be appreciated.

#3

Rockford:
And I am asking with respect to exam, in general we use different stuff.

#4

Mohamed Ayman:
there are two ways to do static analysis of the Dockerfile.

using FromLatest
using Hadolint
Option#2 is mostly preferable since this can be used as an automated process inside CICD pipelines.

#5

Rockford:
Thank you @Mohamed Ayman

#6

Deepak Ladwa:
@Mohamed Ayman @Rockford Is this part of CKS curriculum?

#7

Jia:
if this comes in exam, are these packages pre-installed ?

#8

Yes this kind of question comes in CKS exam end unfortunately none of the tools are installed. I think that analysis should be done manually based on best practices only and not using tools.

#9

@Chaimae-Rakhim you are correct; you need to be able to do a manual inspection of a Dockerfile and recognize common security issues.