Metadata

ID: docker-best-practices/pip-no-cache

Language: Docker

Severity: Notice

Category: Best Practices

Description

This rule states that Dockerfiles should not use a cache when installing packages. When building Docker images, Docker has a built-in caching mechanism that reuses instructions from previous builds, which can speed up the build process. However, when installing packages, this can lead to outdated packages being used, which might have security vulnerabilities or bugs.

It is important to avoid using a cache when installing packages because it ensures that the latest version of a package is always used. This reduces the risk of security vulnerabilities and bugs, and ensures that your application has the most up-to-date and secure dependencies.

When installing packages with pip in a Dockerfile, use the --no-cache-dir option. This tells pip not to use a cache when installing packages, which ensures that the latest version of the package is always used. For example, instead of writing RUN pip install django, write RUN pip install --no-cache-dir django.

Non-Compliant Code Examples

FROM busybox
RUN pip install django
RUN pip3 install django

Compliant Code Examples

FROM busybox
RUN pip install --no-cache-dir django

원활한 통합. Datadog Code Security를 경험해 보세요

Datadog Code Security