docker-compose-standards

Rule Details

• Name: docker_compose_best_practices

• Description: Enforces best practices in docker-compose files to ensure maintainability, security, and consistency

Filters

• file name: docker-compose\\.ya?ml$
• event: (file_create|file_modify)

Rejections

• Conditions:
  • pattern ^\\s*version\\s*: – The 'version' field is deprecated in Docker Compose files. Compose files are now version-less by default.

Rejections

• Conditions:
  • pattern ^( |\t) – Inconsistent indentation detected. Use 2 spaces for indentation.

Rejections

• Conditions:
  • pattern ^\\s*links\\s*: – The 'links' key is deprecated. Use networks and service names for inter-service communication.

Rejections

• Conditions:
  • pattern ^\\s*image\\s*:\\s*[^:]+$ – Specify an explicit image tag to ensure consistency.

Rejections

• Conditions:
  • pattern ^\\s*privileged\\s*:\\s*true – Running services in privileged mode is discouraged for security reasons.

Rejections

• Conditions:
  • pattern ^\\s*services\\s*:\\s*[^\\n]+\\n(?!.*\\blimits\\b) – Define resource limits for each service to prevent resource exhaustion.

Suggestions

• Guidance: To adhere to Docker Compose best practices:

1. Omit the 'version' field: Compose files are version-less by default.

   services:
     web:
       image: nginx
   

2. Use consistent indentation: Use 2 spaces for indentation.

   services:
     web:
       image: nginx
   

3. Avoid 'links' key: Use networks and service names for service communication.

   services:
     web:
       image: nginx
       networks:
         - my-network
     db:
       image: mysql
       networks:
         - my-network
   networks:
     my-network:
   

4. Specify explicit image tags: Prevent unintended updates by defining image tags.

   services:
     web:
       image: nginx:1.21.0
   

5. Avoid privileged mode: Do not use 'privileged: true'. Grant specific capabilities if necessary.

   services:
     web:
       image: nginx
       cap_add:
         - NET_ADMIN