jassouline/jasapp repository overview

⁠Jasapp - Linter for Dockerfiles and Kubernetes Manifests

Jasapp is a static analysis tool (linter) for configuration files, specifically Dockerfiles and Kubernetes manifests. It helps identify syntax errors, best practice violations, potential security vulnerabilities, and performance issues. Jasapp is inspired by Hadolint⁠ and provides a set of equivalent rules, but written in Python. It also provides a scoring system to assess the overall quality of the analyzed files.

⁠Features

• Dockerfile Analysis: Jasapp analyzes Dockerfiles and reports errors and warnings based on a set of built-in rules. These rules cover:
  • Syntax (STX): Verifies syntax, formatting, and instruction order.
  • Security (SEC): Detects security best practice violations.
  • Performance (PERF): Identifies potential optimizations for image size and build speed.
• Kubernetes Manifest Analysis: Jasapp can also analyze Kubernetes manifest files (YAML) and detect structural, security, and best practice issues.
• Hadolint Equivalent Rules: Jasapp implements rules similar to those of Hadolint, allowing for an easy transition for Hadolint users.
• Scoring System: Jasapp calculates a quality score for each analyzed file, based on the number and severity of the detected errors. This score provides a quick indication of the file's quality.
• Rule Customization:
  • Ignore Rules: Ability to ignore specific rules with the --ignore option.
  • Make Rules Mandatory: Ability to configure the tool to consider certain errors as blocking (coming soon).
  • Add New Rules: Jasapp is designed to be extensible. New rules can be easily added by inheriting from the BaseRule class.
• Different Output Formats: Supports multiple output formats for errors, including:
  • console (default)
  • json
  • checkstyle
  • codeclimate
  • gitlab_codeclimate
  • gnu
  • codacy
  • sonarqube
  • sarif
• Configurable Exit Code: The --exit-code option allows setting the exit code to 1 if errors with severity warning or error are detected.

⁠Installation

⁠Prerequisites

• Python 3.11 or higher
• pip

⁠Local Installation (Development Mode)

1. Clone the repository:

   git clone https://gitlab.com/jassouline/jasapp.git
   cd jasapp
   

   Copy

2. Create a virtual environment (recommended):

   python3 -m venv .venv
   source .venv/bin/activate
   

   Copy

3. Install the dependencies:

   pip install -r requirements.txt .
   

   Copy

⁠Installation from PyPI

pip install jasapp

⁠Using with Docker

docker run --rm jassouline/jasapp --type dockerfile --score path_to_your_dockerfile

⁠Usage

⁠Command Syntax:

jasapp <file> --type <type> [options]

⁠Arguments:

• <file> : Path to the file to analyze (Dockerfile or Kubernetes manifest)
• --type <type> : File type (required) : dockerfile or kubernetes

⁠Options:

• --score : Displays the quality score of the file (between 0 and 100)
• --ignore <rule1> <rule2> ... : ignores the specified rules (e.g., --ignore STX0001 STX0002)
• --format <format> : specified the output format for errors (default : console). Available formats are : console, json, checkstyle, codeclimate, gitlab_codeclimate, gnu, codacy, sonarqube, sarif
• --exit-code : returns an exit code of 1 if errors with severity warning or error area detected, 0 otherwise.
• --version : displays the current version of jasapp

⁠Examples:

• Analyze a Dockerfile and display the score:

jasapp examples/dockerfile/example.Dockerfile --type dockerfile --score

• Analyze a Kubernetes manifest with JSON output format:

jasapp examples/kubernetes/example.yaml --type kubernetes --format json

• Ignore rules STX0001 and PERF0001:

jasapp examples/dockerfile/example.Dockerfile --type dockerfile --ignore STX0001 PERF0001

• Use the --exit-code option to integrate Jasapp into a CI/CD pipeline:

jasapp examples/dockerfile/example.Dockerfile --type dockerfile --exit-code

⁠Dockerfile

⁠Performance

⁠Security

⁠Syntax

⁠Kubernetes

⁠Performance

⁠Security

⁠Syntax