Using ARG in a Dockerfile – beware the gotcha

Re:Using ARG in a Dockerfile – beware the gotcha by vbezhenar on Tuesday May 14, 2024 @06:18AM (#40353547)

For this use-case you don't need anything in Dockerfile spec. ARG is not magically expanded inside RUN blocks, it's just an env available during build stage.

In other words you can use this code to catch this error:

  ARG DEBVER="10"
  ARG CAPVER="7.8"
  FROM debian:${DEBVER}
  
  RUN <<EOF
  set -eu
  printf "DEB=${DEBVER}\nCAP=${CAPVER}\n"
  EOF

This code fails with expected error.

[ Parent | on HN ]

Re:Using ARG in a Dockerfile – beware the gotcha by kmarc on Tuesday May 14, 2024 @08:05AM (#40354275)

This is unnecessarily complicated. Just use `SHELL`

    SHELL ["/bin/sh", "-o", "nounset", "-c"]
    RUN printf "DEB=${DEBVER}\nCAP=${CAPVER}\n"

[ Parent | on HN ]

Re:Using ARG in a Dockerfile – beware the gotcha by MereInterest on Tuesday May 14, 2024 @08:11AM (#40354321)

Follow-up question: Does the SHELL need to be set within each stage of a multistage build? Ideally, it could be set once to remove this footgun, but I’m guessing the footgun gets reloaded with each stage.

[ Parent | on HN ]

Re:Using ARG in a Dockerfile – beware the gotcha by kmarc on Tuesday May 14, 2024 @08:31AM (#40354504)

Yes.

In general, I think of multi-stage builds as if multiple docker files were concatenated; if ARG or SHELL doesn't exist in the theoretical split Dockerfile, then it wouldn't exist in the multistage build.

Docker(file) is a thing which brought in some quite neat new ideas, and a lot of these "footguns". I did read the docs, and I am comfortable now building even complicated "Dockerfile-architectures" with proper linting, watching out for good caching, etc. I wish there were better alternatives; I saw images being built with Bazel, and thanks, but that is even more convoluted, with presumably a different set of footguns.

I am not saying that Dockerfiles are good. But I also think that knowing the tool you use differentiates you from being a rookie to an experienced professional.

[ Parent | on HN ]

Re:Using ARG in a Dockerfile – beware the gotcha by MereInterest on Tuesday May 14, 2024 @09:18AM (#40354941)

> I am not saying that Dockerfiles are good. But I also think that knowing the tool you use differentiates you from being a rookie to an experienced professional.

I agree in general, though I'd also add that a tool requiring somebody to know and avoid a large number of footguns is what differentiates a tool from being a prototype and being production-ready. While Docker has a large number of features, the number of gotchas makes it feel like something that should only be used in hobby projects, never in production.

In the end, I ended up making several scripts to automate the generation and execution of dockerfiles for my common use cases. I trust myself to proceed cautiously around the beartraps once. I don't trust myself to sprint through a field of beartraps if there's a short deadline.

[ Parent | on HN ]

Re:Using ARG in a Dockerfile – beware the gotcha by gorgoiler on Tuesday May 14, 2024 @06:44AM (#40353716)

That seems like a perfectly good idiom and it’s fantastic to hear that Dockerfiles support heredocs — I had no idea, thank you!

https://www.docker.com/blog/introduction-to-heredocs-in-dock...

It would still be possible to accidentally reference uninitialized environment variables in contexts other than RUN though. Having those be treated as errors would be useful.

[ Parent | on HN ]

Re:Using ARG in a Dockerfile – beware the gotcha by iainmerrick on Tuesday May 14, 2024 @06:24AM (#40353586)

So now you need to wrap all your RUN lines in here docs?

Better defaults and/or an easier way to change the defaults would be good!

The previous commenter is right -- it's all very well to say "just read all the docs" or "it's consistent with the way other tools work", but sometimes both the docs and the tools can be made less error-prone for users.

[ Parent | on HN ]