Do not use no-install-recommends

Docs > Plateforme de sécurité Datadog > Code Security > Static Code Analysis (SAST) > Règles SAST > Do not use no-install-recommends

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

ID: docker-best-practices/apt-get-no-install-recommends

Language: Docker

Severity: Warning

Category: Best Practices

Description

This rule enforces the use of the --no-install-recommends option when installing packages with apt-get in Dockerfiles. The --no-install-recommends flag ensures that only essential packages are installed, avoiding unnecessary recommended packages that can bloat the image size.

To comply with this rule, always include --no-install-recommends in your apt-get install commands, for example: apt-get install -y --no-install-recommends gcc.

Non-Compliant Code Examples

RUN apt-get install -y gcc
RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install git
RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install git

Compliant Code Examples

RUN apt-get install -y --no-install-recommends gcc
RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install --no-install-recommends git
RUN DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install --no-install-recommends git