From e3558be988a174cf8335b2411d784e1e1a2b2fbd Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Thu, 28 May 2020 06:24:54 +0200
Subject: [PATCH 01/12] First lint + fix implemented

---
 Makefile                  | 18 +++++++++++
 base-notebook/Dockerfile  | 11 +++++--
 docs/contributing/lint.md | 64 +++++++++++++++++++++++++++++++++++++++
 docs/index.rst            |  1 +
 4 files changed, 92 insertions(+), 2 deletions(-)
 create mode 100644 docs/contributing/lint.md

diff --git a/Makefile b/Makefile
index 239a63f0..78de4a4e 100644
--- a/Makefile
+++ b/Makefile
@@ -24,6 +24,9 @@ endif
 
 ALL_IMAGES:=$(ALL_STACKS)
 
+# Linter
+HADOLINT="${HOME}/hadolint"
+
 help:
 # http://marmelab.com/blog/2016/02/29/auto-documented-makefile.html
 	@echo "jupyter/docker-stacks"
@@ -71,6 +74,21 @@ dev/%: ## run a foreground container for a stack
 dev-env: ## install libraries required to build docs and run tests
 	pip install -r requirements-dev.txt
 
+lint/%: ARGS?=
+lint/%: ## lint the dockerfile(s) for a stack
+	@echo "Linting Dockerfiles in $(notdir $@)..."
+	git ls-files --exclude='Dockerfile*' --ignored $(notdir $@) | grep -v ppc64 | xargs -L 1 $(HADOLINT) $(ARGS)
+	@echo "Linting done!"
+
+lint-all: $(foreach I,$(ALL_IMAGES),lint/$(I) ) ## lint all stacks
+
+lint-install: ## install hadolint
+	@echo "Installing hadolint at $(HADOLINT) ..."
+	@curl -sL -o $(HADOLINT) "https://github.com/hadolint/hadolint/releases/download/v1.17.6/hadolint-$(shell uname -s)-$(shell uname -m)"
+	$(shell chmod 700 ${HADOLINT})
+	@echo "Installation done!"
+	@$(HADOLINT) --version
+
 img-clean: img-rm-dang img-rm ## clean dangling and jupyter images
 
 img-list: ## list jupyter images
diff --git a/base-notebook/Dockerfile b/base-notebook/Dockerfile
index b7146073..b6bdad9a 100644
--- a/base-notebook/Dockerfile
+++ b/base-notebook/Dockerfile
@@ -6,6 +6,7 @@
 # OS/ARCH: linux/amd64
 ARG ROOT_CONTAINER=ubuntu:bionic-20200403@sha256:b58746c8a89938b8c9f5b77de3b8cf1fe78210c696ab03a1442e235eea65d84f
 ARG BASE_CONTAINER=$ROOT_CONTAINER
+# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -13,11 +14,15 @@ ARG NB_USER="jovyan"
 ARG NB_UID="1000"
 ARG NB_GID="100"
 
+# Fix DL4006
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 USER root
 
 # Install all OS dependencies for notebook server that starts but lacks all
 # features (e.g., download as all possible file formats)
 ENV DEBIAN_FRONTEND noninteractive
+# hadolint ignore=DL3008
 RUN apt-get update \
  && apt-get install -yq --no-install-recommends \
     wget \
@@ -76,8 +81,8 @@ ENV MINICONDA_VERSION=4.8.2 \
     MINICONDA_MD5=87e77f097f6ebb5127c77662dfc3165e \
     CONDA_VERSION=4.8.2
 
-RUN cd /tmp && \
-    wget --quiet https://repo.continuum.io/miniconda/Miniconda3-py37_${MINICONDA_VERSION}-Linux-x86_64.sh && \
+WORKDIR /tmp
+RUN wget --quiet https://repo.continuum.io/miniconda/Miniconda3-py37_${MINICONDA_VERSION}-Linux-x86_64.sh && \
     echo "${MINICONDA_MD5} *Miniconda3-py37_${MINICONDA_VERSION}-Linux-x86_64.sh" | md5sum -c - && \
     /bin/bash Miniconda3-py37_${MINICONDA_VERSION}-Linux-x86_64.sh -f -b -p $CONDA_DIR && \
     rm Miniconda3-py37_${MINICONDA_VERSION}-Linux-x86_64.sh && \
@@ -137,3 +142,5 @@ RUN fix-permissions /etc/jupyter/
 
 # Switch back to jovyan to avoid accidental container runs as root
 USER $NB_UID
+
+WORKDIR $HOME
\ No newline at end of file
diff --git a/docs/contributing/lint.md b/docs/contributing/lint.md
new file mode 100644
index 00000000..d6273db2
--- /dev/null
+++ b/docs/contributing/lint.md
@@ -0,0 +1,64 @@
+# Image Lint
+
+We are using the [Hadolint][LK1] tool to analyse each `Dockerfile` to comply with [Docker best practices][LK2].
+
+## Install
+
+There is a specific make target to install the linter.
+By default `hadolint` will be installed in `${HOME}/hadolint`.
+
+```bash
+$ make lint-install
+
+# Installing hadolint at /Users/romain/hadolint ...
+# Installation done!
+# Haskell Dockerfile Linter v1.17.6-0-gc918759
+```
+
+## Lint
+
+The linter can be run per stack `make lint/<stack>`
+
+```bash
+$ make lint/scipy-notebook  
+
+# Linting Dockerfiles in scipy-notebook...
+# scipy-notebook/Dockerfile:4 DL3006 Always tag the version of an image explicitly
+# scipy-notebook/Dockerfile:11 DL3008 Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
+# scipy-notebook/Dockerfile:18 SC2086 Double quote to prevent globbing and word splitting.
+# scipy-notebook/Dockerfile:68 SC2086 Double quote to prevent globbing and word splitting.
+# scipy-notebook/Dockerfile:68 DL3003 Use WORKDIR to switch to a directory
+# scipy-notebook/Dockerfile:79 SC2086 Double quote to prevent globbing and word splitting.
+# make: *** [lint/scipy-notebook] Error 1
+```
+
+Optionally you can pass arguments to the linter.
+
+```bash
+# Use a different export format
+$ make lint/scipy-notebook ARGS="--format codeclimate"  
+```
+
+To lint all the stacks.
+
+```bash
+$ make lint-all
+```
+
+## Ignore Rules
+
+Sometimes it's necessary to ignore [some rules][LK3]. The preferred way is to do it in the `Dockerfile`.
+
+> It is also possible to ignore rules by using a special comment directly above the Dockerfile instruction you want to make an exception for. Ignore rule comments look like `# hadolint ignore=DL3001,SC1081.` For example:
+
+```dockerfile
+# hadolint ignore=DL3006
+FROM ubuntu
+
+# hadolint ignore=DL3003,SC1035
+RUN cd /tmp && echo "hello!"
+```
+
+[LK1]: https://github.com/hadolint/hadolint
+[LK2]: https://docs.docker.com/develop/develop-images/dockerfile_best-practices
+[LK3]: https://github.com/hadolint/hadolint#rules
diff --git a/docs/index.rst b/docs/index.rst
index c255a720..b32aa43d 100644
--- a/docs/index.rst
+++ b/docs/index.rst
@@ -47,6 +47,7 @@ Table of Contents
    contributing/packages
    contributing/recipes
    contributing/translations
+   contributing/lint
    contributing/tests
    contributing/features
    contributing/stacks

From 6f2e7cb5838456991f81d8c1da8311910cf5434b Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Thu, 28 May 2020 06:29:27 +0200
Subject: [PATCH 02/12] Linting in travis

---
 .travis.yml | 3 ++-
 Makefile    | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 720984b1..22ff5a7a 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -26,10 +26,11 @@ jobs:
       install:
       - pip install --upgrade pip
       - make dev-env
+      - make-lint-install
       script:
       - set -e
       - make docs
-      - make build-test-all DARGS="--build-arg TEST_ONLY_BUILD=1"
+      - make lint-build-test-all DARGS="--build-arg TEST_ONLY_BUILD=1"
 
 stages:
     - name: diff-test
diff --git a/Makefile b/Makefile
index 78de4a4e..073e4a20 100644
--- a/Makefile
+++ b/Makefile
@@ -82,6 +82,8 @@ lint/%: ## lint the dockerfile(s) for a stack
 
 lint-all: $(foreach I,$(ALL_IMAGES),lint/$(I) ) ## lint all stacks
 
+lint-build-test-all: $(foreach I,$(ALL_IMAGES),lint/$(I) arch_patch/$(I) build/$(I) test/$(I) ) ## lint, build and test all stacks
+
 lint-install: ## install hadolint
 	@echo "Installing hadolint at $(HADOLINT) ..."
 	@curl -sL -o $(HADOLINT) "https://github.com/hadolint/hadolint/releases/download/v1.17.6/hadolint-$(shell uname -s)-$(shell uname -m)"

From 7b48e43b7472a5a9ae7e030cc24e572f4763c1bf Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Fri, 29 May 2020 19:33:24 +0200
Subject: [PATCH 03/12] Fix hadolint deviations

---
 Makefile                        |  2 +-
 all-spark-notebook/Dockerfile   | 19 +++++++++-------
 datascience-notebook/Dockerfile | 40 ++++++++++++++++++++-------------
 minimal-notebook/Dockerfile     |  2 ++
 pyspark-notebook/Dockerfile     | 26 ++++++++++++++-------
 r-notebook/Dockerfile           |  4 +++-
 scipy-notebook/Dockerfile       | 25 +++++++++++----------
 tensorflow-notebook/Dockerfile  |  5 +++--
 8 files changed, 76 insertions(+), 47 deletions(-)

diff --git a/Makefile b/Makefile
index 1cee3d81..c730a368 100644
--- a/Makefile
+++ b/Makefile
@@ -79,7 +79,7 @@ dev-env: ## install libraries required to build docs and run tests
 lint/%: ARGS?=
 lint/%: ## lint the dockerfile(s) for a stack
 	@echo "Linting Dockerfiles in $(notdir $@)..."
-	git ls-files --exclude='Dockerfile*' --ignored $(notdir $@) | grep -v ppc64 | xargs -L 1 $(HADOLINT) $(ARGS)
+	@git ls-files --exclude='Dockerfile*' --ignored $(notdir $@) | grep -v ppc64 | xargs -L 1 $(HADOLINT) $(ARGS)
 	@echo "Linting done!"
 
 lint-all: $(foreach I,$(ALL_IMAGES),lint/$(I) ) ## lint all stacks
diff --git a/all-spark-notebook/Dockerfile b/all-spark-notebook/Dockerfile
index 29c0f0ba..d01a0d4e 100644
--- a/all-spark-notebook/Dockerfile
+++ b/all-spark-notebook/Dockerfile
@@ -1,6 +1,7 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/pyspark-notebook
+# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -12,6 +13,7 @@ ENV R_LIBS_USER $SPARK_HOME/R/lib
 RUN fix-permissions $R_LIBS_USER
 
 # R pre-requisites
+# hadolint ignore=DL3008
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     fonts-dejavu \
@@ -30,22 +32,23 @@ RUN conda install --quiet --yes \
     'r-sparklyr=1.2*' \
     && \
     conda clean --all -f -y && \
-    fix-permissions $CONDA_DIR && \
-    fix-permissions /home/$NB_USER
+    fix-permissions "${CONDA_DIR}" && \
+    fix-permissions "/home/${NB_USER}"
 
 # Apache Toree kernel
+# hadolint ignore=DL3013
 RUN pip install --no-cache-dir \
     https://dist.apache.org/repos/dist/release/incubator/toree/0.3.0-incubating/toree-pip/toree-0.3.0.tar.gz \
     && \
     jupyter toree install --sys-prefix && \
-    rm -rf /home/$NB_USER/.local && \
-    fix-permissions $CONDA_DIR && \
-    fix-permissions /home/$NB_USER
+    rm -rf "/home/${NB_USER}/.local" && \
+    fix-permissions "${CONDA_DIR}" && \
+    fix-permissions "/home/${NB_USER}"
 
 # Spylon-kernel
 RUN conda install --quiet --yes 'spylon-kernel=0.4*' && \
     conda clean --all -f -y && \
     python -m spylon_kernel install --sys-prefix && \
-    rm -rf /home/$NB_USER/.local && \
-    fix-permissions $CONDA_DIR && \
-    fix-permissions /home/$NB_USER
+    rm -rf "/home/${NB_USER}/.local" && \
+    fix-permissions "${CONDA_DIR}" && \
+    fix-permissions "/home/${NB_USER}"
diff --git a/datascience-notebook/Dockerfile b/datascience-notebook/Dockerfile
index c7989245..0bd7aa82 100644
--- a/datascience-notebook/Dockerfile
+++ b/datascience-notebook/Dockerfile
@@ -1,6 +1,7 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/scipy-notebook
+# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -9,9 +10,13 @@ LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
 # be skipped to shorten build time.
 ARG TEST_ONLY_BUILD
 
+# Fix DL4006
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 USER root
 
 # R pre-requisites
+# hadolint ignore=DL3008
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     fonts-dejavu \
@@ -25,21 +30,24 @@ ENV JULIA_DEPOT_PATH=/opt/julia
 ENV JULIA_PKGDIR=/opt/julia
 ENV JULIA_VERSION=1.4.1
 
-RUN mkdir /opt/julia-${JULIA_VERSION} && \
-    cd /tmp && \
-    wget -q https://julialang-s3.julialang.org/bin/linux/x64/`echo ${JULIA_VERSION} | cut -d. -f 1,2`/julia-${JULIA_VERSION}-linux-x86_64.tar.gz && \
+WORKDIR /tmp
+
+# TODO
+# hadolint ignore=SC2046
+RUN mkdir "/opt/julia-${JULIA_VERSION}" && \
+    wget -q https://julialang-s3.julialang.org/bin/linux/x64/$(echo "${JULIA_VERSION}" | cut -d. -f 1,2)"/julia-${JULIA_VERSION}-linux-x86_64.tar.gz" && \
     echo "fd6d8cadaed678174c3caefb92207a3b0e8da9f926af6703fb4d1e4e4f50610a *julia-${JULIA_VERSION}-linux-x86_64.tar.gz" | sha256sum -c - && \
-    tar xzf julia-${JULIA_VERSION}-linux-x86_64.tar.gz -C /opt/julia-${JULIA_VERSION} --strip-components=1 && \
-    rm /tmp/julia-${JULIA_VERSION}-linux-x86_64.tar.gz
+    tar xzf "julia-${JULIA_VERSION}-linux-x86_64.tar.gz" -C "/opt/julia-${JULIA_VERSION}" --strip-components=1 && \
+    rm "/tmp/julia-${JULIA_VERSION}-linux-x86_64.tar.gz"
 RUN ln -fs /opt/julia-*/bin/julia /usr/local/bin/julia
 
 # Show Julia where conda libraries are \
 RUN mkdir /etc/julia && \
     echo "push!(Libdl.DL_LOAD_PATH, \"$CONDA_DIR/lib\")" >> /etc/julia/juliarc.jl && \
     # Create JULIA_PKGDIR \
-    mkdir $JULIA_PKGDIR && \
-    chown $NB_USER $JULIA_PKGDIR && \
-    fix-permissions $JULIA_PKGDIR
+    mkdir "${JULIA_PKGDIR}" && \
+    chown "${NB_USER}" "${JULIA_PKGDIR}" && \
+    fix-permissions "${JULIA_PKGDIR}"
 
 USER $NB_UID
 
@@ -66,8 +74,8 @@ RUN conda install --quiet --yes \
     'rpy2=3.1*' \
     && \
     conda clean --all -f -y && \
-    fix-permissions $CONDA_DIR && \
-    fix-permissions /home/$NB_USER
+    fix-permissions "${CONDA_DIR}" && \
+    fix-permissions "/home/${NB_USER}"
 
 # Add Julia packages. Only add HDF5 if this is not a test-only build since
 # it takes roughly half the entire build time of all of the images on Travis
@@ -77,10 +85,12 @@ RUN conda install --quiet --yes \
 # to the system share location. Avoids problems with runtime UID change not
 # taking effect properly on the .local folder in the jovyan home dir.
 RUN julia -e 'import Pkg; Pkg.update()' && \
-    (test $TEST_ONLY_BUILD || julia -e 'import Pkg; Pkg.add("HDF5")') && \
+    (test "${TEST_ONLY_BUILD}" || julia -e 'import Pkg; Pkg.add("HDF5")') && \
     julia -e "using Pkg; pkg\"add IJulia\"; pkg\"precompile\"" && \
     # move kernelspec out of home \
-    mv $HOME/.local/share/jupyter/kernels/julia* $CONDA_DIR/share/jupyter/kernels/ && \
-    chmod -R go+rx $CONDA_DIR/share/jupyter && \
-    rm -rf $HOME/.local && \
-    fix-permissions $JULIA_PKGDIR $CONDA_DIR/share/jupyter
+    mv "${HOME}/.local/share/jupyter/kernels/julia*" "${CONDA_DIR}/share/jupyter/kernels/" && \
+    chmod -R go+rx "${CONDA_DIR}/share/jupyter" && \
+    rm -rf "${HOME}/.local" && \
+    fix-permissions "${JULIA_PKGDIR}" "${CONDA_DIR}/share/jupyter"
+
+WORKDIR $HOME
\ No newline at end of file
diff --git a/minimal-notebook/Dockerfile b/minimal-notebook/Dockerfile
index fe845c43..3cf6c3df 100644
--- a/minimal-notebook/Dockerfile
+++ b/minimal-notebook/Dockerfile
@@ -1,6 +1,7 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/base-notebook
+# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -8,6 +9,7 @@ LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
 USER root
 
 # Install all OS dependencies for fully functional notebook server
+# hadolint ignore=DL3008
 RUN apt-get update && apt-get install -yq --no-install-recommends \
     build-essential \
     emacs-nox \
diff --git a/pyspark-notebook/Dockerfile b/pyspark-notebook/Dockerfile
index 8e3d5a70..308d055b 100644
--- a/pyspark-notebook/Dockerfile
+++ b/pyspark-notebook/Dockerfile
@@ -1,28 +1,36 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/scipy-notebook
+# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
 
+# Fix DL4006
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 USER root
 
 # Spark dependencies
 ENV APACHE_SPARK_VERSION=2.4.5 \
     HADOOP_VERSION=2.7
-
+# hadolint ignore=DL3008
 RUN apt-get -y update && \
     apt-get install --no-install-recommends -y openjdk-8-jre-headless ca-certificates-java && \
     rm -rf /var/lib/apt/lists/*
 
 # Using the preferred mirror to download Spark
-RUN cd /tmp && \
-    wget -q $(wget -qO- https://www.apache.org/dyn/closer.lua/spark/spark-${APACHE_SPARK_VERSION}/spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz\?as_json | \
+WORKDIR /tmp
+# TODO
+# hadolint ignore=SC2046
+RUN wget -q $(wget -qO- "https://www.apache.org/dyn/closer.lua/spark/spark-${APACHE_SPARK_VERSION}/spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz\?as_json" | \
     python -c "import sys, json; content=json.load(sys.stdin); print(content['preferred']+content['path_info'])") && \
     echo "2426a20c548bdfc07df288cd1d18d1da6b3189d0b78dee76fa034c52a4e02895f0ad460720c526f163ba63a17efae4764c46a1cd8f9b04c60f9937a554db85d2 *spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz" | sha512sum -c - && \
-    tar xzf spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz -C /usr/local --owner root --group root --no-same-owner && \
-    rm spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz
-RUN cd /usr/local && ln -s spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION} spark
+    tar xzf "spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz" -C /usr/local --owner root --group root --no-same-owner && \
+    rm "spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz"
+
+WORKDIR /usr/local
+RUN ln -s "spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}" spark
 
 # Configure Spark
 ENV SPARK_HOME=/usr/local/spark
@@ -35,5 +43,7 @@ USER $NB_UID
 # Install pyarrow
 RUN conda install --quiet -y 'pyarrow' && \
     conda clean --all -f -y && \
-    fix-permissions $CONDA_DIR && \
-    fix-permissions /home/$NB_USER
+    fix-permissions "${CONDA_DIR}" && \
+    fix-permissions "/home/${NB_USER}"
+
+WORKDIR $HOME
\ No newline at end of file
diff --git a/r-notebook/Dockerfile b/r-notebook/Dockerfile
index 641b0ed5..f2b54956 100644
--- a/r-notebook/Dockerfile
+++ b/r-notebook/Dockerfile
@@ -1,6 +1,7 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/minimal-notebook
+# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -8,6 +9,7 @@ LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
 USER root
 
 # R pre-requisites
+# hadolint ignore=DL3008
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     fonts-dejavu \
@@ -47,7 +49,7 @@ RUN conda install --quiet --yes \
     'unixodbc=2.3.*' \
     && \
     conda clean --all -f -y && \
-    fix-permissions $CONDA_DIR
+    fix-permissions "${CONDA_DIR}"
 
 # Install e1071 R package (dependency of the caret R package)
 RUN conda install --quiet --yes r-e1071
diff --git a/scipy-notebook/Dockerfile b/scipy-notebook/Dockerfile
index aa631f49..f49fef60 100644
--- a/scipy-notebook/Dockerfile
+++ b/scipy-notebook/Dockerfile
@@ -1,6 +1,7 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/minimal-notebook
+# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -8,6 +9,7 @@ LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
 USER root
 
 # ffmpeg for matplotlib anim & dvipng for latex labels
+# hadolint ignore=DL3008
 RUN apt-get update && \
     apt-get install -y --no-install-recommends ffmpeg dvipng && \
     rm -rf /var/lib/apt/lists/*
@@ -59,24 +61,23 @@ RUN conda install --quiet --yes \
     jupyter lab build -y && \
     jupyter lab clean -y && \
     npm cache clean --force && \
-    rm -rf /home/$NB_USER/.cache/yarn && \
-    rm -rf /home/$NB_USER/.node-gyp && \
-    fix-permissions $CONDA_DIR && \
-    fix-permissions /home/$NB_USER
+    rm -rf "/home/${NB_USER}/.cache/yarn" && \
+    rm -rf "/home/${NB_USER}/.node-gyp" && \
+    fix-permissions "${CONDA_DIR}" && \
+    fix-permissions "/home/${NB_USER}"
 
 # Install facets which does not have a pip or conda package at the moment
-RUN cd /tmp && \
-    git clone https://github.com/PAIR-code/facets.git && \
-    cd facets && \
-    jupyter nbextension install facets-dist/ --sys-prefix && \
-    cd && \
+WORKDIR /tmp
+RUN git clone https://github.com/PAIR-code/facets.git && \
+    jupyter nbextension install facets/facets-dist/ --sys-prefix && \
     rm -rf /tmp/facets && \
-    fix-permissions $CONDA_DIR && \
-    fix-permissions /home/$NB_USER
+    fix-permissions "${CONDA_DIR}" && \
+    fix-permissions "/home/${NB_USER}"
 
 # Import matplotlib the first time to build the font cache.
 ENV XDG_CACHE_HOME /home/$NB_USER/.cache/
 RUN MPLBACKEND=Agg python -c "import matplotlib.pyplot" && \
-    fix-permissions /home/$NB_USER
+    fix-permissions "/home/${NB_USER}"
 
 USER $NB_UID
+WORKDIR $HOME
\ No newline at end of file
diff --git a/tensorflow-notebook/Dockerfile b/tensorflow-notebook/Dockerfile
index 880905fe..0d2a2fa0 100644
--- a/tensorflow-notebook/Dockerfile
+++ b/tensorflow-notebook/Dockerfile
@@ -1,6 +1,7 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/scipy-notebook
+# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -8,5 +9,5 @@ LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
 # Install Tensorflow
 RUN pip install --quiet --no-cache-dir \
     'tensorflow==2.2.0' && \
-    fix-permissions $CONDA_DIR && \
-    fix-permissions /home/$NB_USER
+    fix-permissions "${CONDA_DIR}" && \
+    fix-permissions "/home/${NB_USER}"

From 593698985fd3234170986f1c1c5b7f879759b710 Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Fri, 29 May 2020 21:27:18 +0200
Subject: [PATCH 04/12] Fixes

---
 .travis.yml                     | 2 +-
 datascience-notebook/Dockerfile | 4 ++--
 pyspark-notebook/Dockerfile     | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 22ff5a7a..92484906 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ jobs:
       script:
       - set -e
       - if [ $(make n-docs-diff) -ne 0 ]; then make docs; fi;
-      - if [ $(make n-other-diff) -ne 0 ]; then make build-test-all DARGS="--build-arg TEST_ONLY_BUILD=1"; fi;
+      - if [ $(make n-other-diff) -ne 0 ]; then make make lint-build-test-all DARGS="--build-arg TEST_ONLY_BUILD=1"; fi;
     - stage: push-tx
       install:
       - pip install --upgrade pip
diff --git a/datascience-notebook/Dockerfile b/datascience-notebook/Dockerfile
index 0bd7aa82..05b1186e 100644
--- a/datascience-notebook/Dockerfile
+++ b/datascience-notebook/Dockerfile
@@ -85,10 +85,10 @@ RUN conda install --quiet --yes \
 # to the system share location. Avoids problems with runtime UID change not
 # taking effect properly on the .local folder in the jovyan home dir.
 RUN julia -e 'import Pkg; Pkg.update()' && \
-    (test "${TEST_ONLY_BUILD}" || julia -e 'import Pkg; Pkg.add("HDF5")') && \
+    (test $TEST_ONLY_BUILD || julia -e 'import Pkg; Pkg.add("HDF5")') && \
     julia -e "using Pkg; pkg\"add IJulia\"; pkg\"precompile\"" && \
     # move kernelspec out of home \
-    mv "${HOME}/.local/share/jupyter/kernels/julia*" "${CONDA_DIR}/share/jupyter/kernels/" && \
+    mv "${HOME}/.local/share/jupyter/kernels/julia"* "${CONDA_DIR}/share/jupyter/kernels/" && \
     chmod -R go+rx "${CONDA_DIR}/share/jupyter" && \
     rm -rf "${HOME}/.local" && \
     fix-permissions "${JULIA_PKGDIR}" "${CONDA_DIR}/share/jupyter"
diff --git a/pyspark-notebook/Dockerfile b/pyspark-notebook/Dockerfile
index 308d055b..6342516d 100644
--- a/pyspark-notebook/Dockerfile
+++ b/pyspark-notebook/Dockerfile
@@ -23,7 +23,7 @@ RUN apt-get -y update && \
 WORKDIR /tmp
 # TODO
 # hadolint ignore=SC2046
-RUN wget -q $(wget -qO- "https://www.apache.org/dyn/closer.lua/spark/spark-${APACHE_SPARK_VERSION}/spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz\?as_json" | \
+RUN wget -q $(wget -qO- https://www.apache.org/dyn/closer.lua/spark/spark-${APACHE_SPARK_VERSION}/spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz\?as_json | \
     python -c "import sys, json; content=json.load(sys.stdin); print(content['preferred']+content['path_info'])") && \
     echo "2426a20c548bdfc07df288cd1d18d1da6b3189d0b78dee76fa034c52a4e02895f0ad460720c526f163ba63a17efae4764c46a1cd8f9b04c60f9937a554db85d2 *spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz" | sha512sum -c - && \
     tar xzf "spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz" -C /usr/local --owner root --group root --no-same-owner && \

From 3f61c9cb56f5b389cce766f18c9193032ee70a82 Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Fri, 29 May 2020 21:35:32 +0200
Subject: [PATCH 05/12] Travis typo ...

---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index 92484906..a534c1d8 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -15,7 +15,7 @@ jobs:
       script:
       - set -e
       - if [ $(make n-docs-diff) -ne 0 ]; then make docs; fi;
-      - if [ $(make n-other-diff) -ne 0 ]; then make make lint-build-test-all DARGS="--build-arg TEST_ONLY_BUILD=1"; fi;
+      - if [ $(make n-other-diff) -ne 0 ]; then make lint-build-test-all DARGS="--build-arg TEST_ONLY_BUILD=1"; fi;
     - stage: push-tx
       install:
       - pip install --upgrade pip

From feb2e44022aeb5116c8d60656963915b2adb68b9 Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Fri, 29 May 2020 21:47:13 +0200
Subject: [PATCH 06/12] Fix lint

---
 docs/contributing/lint.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/contributing/lint.md b/docs/contributing/lint.md
index d6273db2..3dde76ae 100644
--- a/docs/contributing/lint.md
+++ b/docs/contributing/lint.md
@@ -17,7 +17,7 @@ $ make lint-install
 
 ## Lint
 
-The linter can be run per stack `make lint/<stack>`
+The linter can be run per stack `make lint/<stack>`.
 
 ```bash
 $ make lint/scipy-notebook  
@@ -49,7 +49,7 @@ $ make lint-all
 
 Sometimes it's necessary to ignore [some rules][LK3]. The preferred way is to do it in the `Dockerfile`.
 
-> It is also possible to ignore rules by using a special comment directly above the Dockerfile instruction you want to make an exception for. Ignore rule comments look like `# hadolint ignore=DL3001,SC1081.` For example:
+> It is also possible to ignore rules by using a special comment directly above the Dockerfile instruction you want to make an exception for. Ignore rule comments look like `# hadolint ignore=DL3001,SC1081`. For example:
 
 ```dockerfile
 # hadolint ignore=DL3006

From 078b7d88716170f8e4a121223229bf791f988153 Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Fri, 29 May 2020 22:00:27 +0200
Subject: [PATCH 07/12] Travis fix ...

---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index a534c1d8..a1498e78 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,6 +12,7 @@ jobs:
       install:
       - pip install --upgrade pip
       - make dev-env
+      - make-lint-install
       script:
       - set -e
       - if [ $(make n-docs-diff) -ne 0 ]; then make docs; fi;

From de31f9f9d0be5350297a3976614e4cedc0ad2d41 Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Fri, 29 May 2020 22:04:44 +0200
Subject: [PATCH 08/12] Travis fix

---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index a1498e78..763376d7 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -12,7 +12,7 @@ jobs:
       install:
       - pip install --upgrade pip
       - make dev-env
-      - make-lint-install
+      - make lint-install
       script:
       - set -e
       - if [ $(make n-docs-diff) -ne 0 ]; then make docs; fi;
@@ -27,7 +27,7 @@ jobs:
       install:
       - pip install --upgrade pip
       - make dev-env
-      - make-lint-install
+      - make lint-install
       script:
       - set -e
       - make docs

From ccc9ed3b6d34323649af36eb2da92ffdf6d81b58 Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Fri, 29 May 2020 22:47:57 +0200
Subject: [PATCH 09/12] Fix makefile

---
 Makefile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Makefile b/Makefile
index c730a368..106ebcfd 100644
--- a/Makefile
+++ b/Makefile
@@ -89,9 +89,9 @@ lint-build-test-all: $(foreach I,$(ALL_IMAGES),lint/$(I) arch_patch/$(I) build/$
 lint-install: ## install hadolint
 	@echo "Installing hadolint at $(HADOLINT) ..."
 	@curl -sL -o $(HADOLINT) "https://github.com/hadolint/hadolint/releases/download/v1.17.6/hadolint-$(shell uname -s)-$(shell uname -m)"
-	$(shell chmod 700 ${HADOLINT})
+	@chmod 700 $(HADOLINT)
 	@echo "Installation done!"
-	@$(HADOLINT) --version
+	@$(HADOLINT) --version	
 
 img-clean: img-rm-dang img-rm ## clean dangling and jupyter images
 

From 2ce0b49fb553810d0a5013f2d0df6b48bc9afe3a Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Sat, 30 May 2020 05:44:53 +0200
Subject: [PATCH 10/12] Final review

---
 base-notebook/Dockerfile        |  2 +-
 datascience-notebook/Dockerfile |  3 +--
 docs/contributing/lint.md       | 18 +++++++++++-------
 pyspark-notebook/Dockerfile     |  3 +--
 scipy-notebook/Dockerfile       |  6 ++++--
 5 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/base-notebook/Dockerfile b/base-notebook/Dockerfile
index a8afccea..5836c649 100644
--- a/base-notebook/Dockerfile
+++ b/base-notebook/Dockerfile
@@ -143,4 +143,4 @@ RUN fix-permissions /etc/jupyter/
 # Switch back to jovyan to avoid accidental container runs as root
 USER $NB_UID
 
-WORKDIR $HOME
\ No newline at end of file
+WORKDIR $HOME
diff --git a/datascience-notebook/Dockerfile b/datascience-notebook/Dockerfile
index 05b1186e..5c4ce909 100644
--- a/datascience-notebook/Dockerfile
+++ b/datascience-notebook/Dockerfile
@@ -32,7 +32,6 @@ ENV JULIA_VERSION=1.4.1
 
 WORKDIR /tmp
 
-# TODO
 # hadolint ignore=SC2046
 RUN mkdir "/opt/julia-${JULIA_VERSION}" && \
     wget -q https://julialang-s3.julialang.org/bin/linux/x64/$(echo "${JULIA_VERSION}" | cut -d. -f 1,2)"/julia-${JULIA_VERSION}-linux-x86_64.tar.gz" && \
@@ -93,4 +92,4 @@ RUN julia -e 'import Pkg; Pkg.update()' && \
     rm -rf "${HOME}/.local" && \
     fix-permissions "${JULIA_PKGDIR}" "${CONDA_DIR}/share/jupyter"
 
-WORKDIR $HOME
\ No newline at end of file
+WORKDIR $HOME
diff --git a/docs/contributing/lint.md b/docs/contributing/lint.md
index 3dde76ae..65f06de3 100644
--- a/docs/contributing/lint.md
+++ b/docs/contributing/lint.md
@@ -1,10 +1,10 @@
 # Image Lint
 
-We are using the [Hadolint][LK1] tool to analyse each `Dockerfile` to comply with [Docker best practices][LK2].
+To comply with [Docker best practices][LK2], we are using the [Hadolint][LK1] tool to analyse each `Dockerfile` .
 
-## Install
+## Installation
 
-There is a specific make target to install the linter.
+There is a specific `make` target to install the linter.
 By default `hadolint` will be installed in `${HOME}/hadolint`.
 
 ```bash
@@ -17,7 +17,9 @@ $ make lint-install
 
 ## Lint
 
-The linter can be run per stack `make lint/<stack>`.
+### Per Stack
+
+The linter can be run per stack.
 
 ```bash
 $ make lint/scipy-notebook  
@@ -39,15 +41,17 @@ Optionally you can pass arguments to the linter.
 $ make lint/scipy-notebook ARGS="--format codeclimate"  
 ```
 
-To lint all the stacks.
+### All the Stacks
+
+The linter can be run against all the stacks.
 
 ```bash
 $ make lint-all
 ```
 
-## Ignore Rules
+## Ignoring Rules
 
-Sometimes it's necessary to ignore [some rules][LK3]. The preferred way is to do it in the `Dockerfile`.
+Sometimes it is necessary to ignore [some rules][LK3]. The preferred way to do it is to flag ignored rules in the `Dockerfile`.
 
 > It is also possible to ignore rules by using a special comment directly above the Dockerfile instruction you want to make an exception for. Ignore rule comments look like `# hadolint ignore=DL3001,SC1081`. For example:
 
diff --git a/pyspark-notebook/Dockerfile b/pyspark-notebook/Dockerfile
index 6342516d..dcb766b3 100644
--- a/pyspark-notebook/Dockerfile
+++ b/pyspark-notebook/Dockerfile
@@ -21,7 +21,6 @@ RUN apt-get -y update && \
 
 # Using the preferred mirror to download Spark
 WORKDIR /tmp
-# TODO
 # hadolint ignore=SC2046
 RUN wget -q $(wget -qO- https://www.apache.org/dyn/closer.lua/spark/spark-${APACHE_SPARK_VERSION}/spark-${APACHE_SPARK_VERSION}-bin-hadoop${HADOOP_VERSION}.tgz\?as_json | \
     python -c "import sys, json; content=json.load(sys.stdin); print(content['preferred']+content['path_info'])") && \
@@ -46,4 +45,4 @@ RUN conda install --quiet -y 'pyarrow' && \
     fix-permissions "${CONDA_DIR}" && \
     fix-permissions "/home/${NB_USER}"
 
-WORKDIR $HOME
\ No newline at end of file
+WORKDIR $HOME
diff --git a/scipy-notebook/Dockerfile b/scipy-notebook/Dockerfile
index f49fef60..64bb7626 100644
--- a/scipy-notebook/Dockerfile
+++ b/scipy-notebook/Dockerfile
@@ -75,9 +75,11 @@ RUN git clone https://github.com/PAIR-code/facets.git && \
     fix-permissions "/home/${NB_USER}"
 
 # Import matplotlib the first time to build the font cache.
-ENV XDG_CACHE_HOME /home/$NB_USER/.cache/
+ENV XDG_CACHE_HOME="/home/${NB_USER}/.cache/"
+
 RUN MPLBACKEND=Agg python -c "import matplotlib.pyplot" && \
     fix-permissions "/home/${NB_USER}"
 
 USER $NB_UID
-WORKDIR $HOME
\ No newline at end of file
+
+WORKDIR $HOME

From 5e6645d1373554cbda985e6f0845445b2cf25f19 Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Mon, 1 Jun 2020 06:23:44 +0200
Subject: [PATCH 11/12] Ignore DL3006 and DL3008 by default

---
 .hadolint.yaml                  |  3 +++
 all-spark-notebook/Dockerfile   |  2 --
 base-notebook/Dockerfile        |  2 --
 datascience-notebook/Dockerfile |  2 --
 docs/contributing/lint.md       | 22 ++++++++++++++++------
 minimal-notebook/Dockerfile     |  2 --
 pyspark-notebook/Dockerfile     |  3 +--
 r-notebook/Dockerfile           |  2 --
 scipy-notebook/Dockerfile       |  2 --
 tensorflow-notebook/Dockerfile  |  1 -
 10 files changed, 20 insertions(+), 21 deletions(-)
 create mode 100644 .hadolint.yaml

diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 00000000..6f37c3a7
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,3 @@
+ignored:
+    - DL3006
+    - DL3008
\ No newline at end of file
diff --git a/all-spark-notebook/Dockerfile b/all-spark-notebook/Dockerfile
index d01a0d4e..401a2d0a 100644
--- a/all-spark-notebook/Dockerfile
+++ b/all-spark-notebook/Dockerfile
@@ -1,7 +1,6 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/pyspark-notebook
-# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -13,7 +12,6 @@ ENV R_LIBS_USER $SPARK_HOME/R/lib
 RUN fix-permissions $R_LIBS_USER
 
 # R pre-requisites
-# hadolint ignore=DL3008
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     fonts-dejavu \
diff --git a/base-notebook/Dockerfile b/base-notebook/Dockerfile
index 5836c649..354b36c6 100644
--- a/base-notebook/Dockerfile
+++ b/base-notebook/Dockerfile
@@ -6,7 +6,6 @@
 # OS/ARCH: linux/amd64
 ARG ROOT_CONTAINER=ubuntu:bionic-20200403@sha256:b58746c8a89938b8c9f5b77de3b8cf1fe78210c696ab03a1442e235eea65d84f
 ARG BASE_CONTAINER=$ROOT_CONTAINER
-# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -22,7 +21,6 @@ USER root
 # Install all OS dependencies for notebook server that starts but lacks all
 # features (e.g., download as all possible file formats)
 ENV DEBIAN_FRONTEND noninteractive
-# hadolint ignore=DL3008
 RUN apt-get update \
  && apt-get install -yq --no-install-recommends \
     wget \
diff --git a/datascience-notebook/Dockerfile b/datascience-notebook/Dockerfile
index 5c4ce909..82803f57 100644
--- a/datascience-notebook/Dockerfile
+++ b/datascience-notebook/Dockerfile
@@ -1,7 +1,6 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/scipy-notebook
-# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -16,7 +15,6 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 USER root
 
 # R pre-requisites
-# hadolint ignore=DL3008
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     fonts-dejavu \
diff --git a/docs/contributing/lint.md b/docs/contributing/lint.md
index 65f06de3..7ce07bdd 100644
--- a/docs/contributing/lint.md
+++ b/docs/contributing/lint.md
@@ -1,6 +1,6 @@
 # Image Lint
 
-To comply with [Docker best practices][LK2], we are using the [Hadolint][LK1] tool to analyse each `Dockerfile` .
+To comply with [Docker best practices][dbp], we are using the [Hadolint][hadolint] tool to analyse each `Dockerfile` .
 
 ## Installation
 
@@ -51,18 +51,28 @@ $ make lint-all
 
 ## Ignoring Rules
 
-Sometimes it is necessary to ignore [some rules][LK3]. The preferred way to do it is to flag ignored rules in the `Dockerfile`.
+Sometimes it is necessary to ignore [some rules][rules]. 
+The following rules are ignored by default and sor for all images in the `.hadolint.yaml` file.
+
+- [`DL3006`][DL3006]: We use a specific policy to manage image tags. 
+  - `base-notebook` `FROM` clause is fixed but based on an argument (`ARG`). 
+  - Building downstream images from (`FROM`) the latest is done on purpose.
+- [`DL3008`][DL3008]: System packages are always updated (`apt-get`) to the latest version.
+
+For other rules, the preferred way to do it is to flag ignored rules in the `Dockerfile`.
 
 > It is also possible to ignore rules by using a special comment directly above the Dockerfile instruction you want to make an exception for. Ignore rule comments look like `# hadolint ignore=DL3001,SC1081`. For example:
 
 ```dockerfile
-# hadolint ignore=DL3006
+
 FROM ubuntu
 
 # hadolint ignore=DL3003,SC1035
 RUN cd /tmp && echo "hello!"
 ```
 
-[LK1]: https://github.com/hadolint/hadolint
-[LK2]: https://docs.docker.com/develop/develop-images/dockerfile_best-practices
-[LK3]: https://github.com/hadolint/hadolint#rules
+[hadolint]: https://github.com/hadolint/hadolint
+[dbp]: https://docs.docker.com/develop/develop-images/dockerfile_best-practices
+[rules]: https://github.com/hadolint/hadolint#rules
+[DL3006]: https://github.com/hadolint/hadolint/wiki/DL3006
+[DL3008]: https://github.com/hadolint/hadolint/wiki/DL3008
\ No newline at end of file
diff --git a/minimal-notebook/Dockerfile b/minimal-notebook/Dockerfile
index 3cf6c3df..fe845c43 100644
--- a/minimal-notebook/Dockerfile
+++ b/minimal-notebook/Dockerfile
@@ -1,7 +1,6 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/base-notebook
-# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -9,7 +8,6 @@ LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
 USER root
 
 # Install all OS dependencies for fully functional notebook server
-# hadolint ignore=DL3008
 RUN apt-get update && apt-get install -yq --no-install-recommends \
     build-essential \
     emacs-nox \
diff --git a/pyspark-notebook/Dockerfile b/pyspark-notebook/Dockerfile
index dcb766b3..83f0b161 100644
--- a/pyspark-notebook/Dockerfile
+++ b/pyspark-notebook/Dockerfile
@@ -1,7 +1,6 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/scipy-notebook
-# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -14,7 +13,7 @@ USER root
 # Spark dependencies
 ENV APACHE_SPARK_VERSION=2.4.5 \
     HADOOP_VERSION=2.7
-# hadolint ignore=DL3008
+
 RUN apt-get -y update && \
     apt-get install --no-install-recommends -y openjdk-8-jre-headless ca-certificates-java && \
     rm -rf /var/lib/apt/lists/*
diff --git a/r-notebook/Dockerfile b/r-notebook/Dockerfile
index f2b54956..3be64c85 100644
--- a/r-notebook/Dockerfile
+++ b/r-notebook/Dockerfile
@@ -1,7 +1,6 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/minimal-notebook
-# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -9,7 +8,6 @@ LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
 USER root
 
 # R pre-requisites
-# hadolint ignore=DL3008
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     fonts-dejavu \
diff --git a/scipy-notebook/Dockerfile b/scipy-notebook/Dockerfile
index 64bb7626..b498e534 100644
--- a/scipy-notebook/Dockerfile
+++ b/scipy-notebook/Dockerfile
@@ -1,7 +1,6 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/minimal-notebook
-# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
@@ -9,7 +8,6 @@ LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"
 USER root
 
 # ffmpeg for matplotlib anim & dvipng for latex labels
-# hadolint ignore=DL3008
 RUN apt-get update && \
     apt-get install -y --no-install-recommends ffmpeg dvipng && \
     rm -rf /var/lib/apt/lists/*
diff --git a/tensorflow-notebook/Dockerfile b/tensorflow-notebook/Dockerfile
index 0d2a2fa0..4533fbc6 100644
--- a/tensorflow-notebook/Dockerfile
+++ b/tensorflow-notebook/Dockerfile
@@ -1,7 +1,6 @@
 # Copyright (c) Jupyter Development Team.
 # Distributed under the terms of the Modified BSD License.
 ARG BASE_CONTAINER=jupyter/scipy-notebook
-# hadolint ignore=DL3006
 FROM $BASE_CONTAINER
 
 LABEL maintainer="Jupyter Project <jupyter@googlegroups.com>"

From 4d5bb32e56a13a3fc80222bcee03b9ef19450b23 Mon Sep 17 00:00:00 2001
From: Romain <cros.romain@gmail.com>
Date: Mon, 1 Jun 2020 06:26:21 +0200
Subject: [PATCH 12/12] New line at the end of the conf file

---
 .hadolint.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.hadolint.yaml b/.hadolint.yaml
index 6f37c3a7..a29f1e0e 100644
--- a/.hadolint.yaml
+++ b/.hadolint.yaml
@@ -1,3 +1,3 @@
 ignored:
     - DL3006
-    - DL3008
\ No newline at end of file
+    - DL3008