Install ca-certificates in docker and use pipefail

[konstin]

A dockerfile using ubuntu instead of python as base image currently silently fails to install.

FROM ubuntu
RUN apt-get update && apt-get install -y curl --no-install-recommends
RUN curl -LsSf https://astral.sh/uv/install.sh | sh
RUN uv --version

$ docker buildx build --progress plain --no-cache .
[...]
#6 [3/4] RUN curl -LsSf https://astral.sh/uv/install.sh | sh
#6 0.144 curl: (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt
#6 DONE 0.2s

#7 [4/4] RUN uv --version
#7 0.113 /bin/sh: 1: uv: not found
#7 ERROR: process "/bin/sh -c uv --version" did not complete successfully: exit code: 127

There's two underlying problems: Pipefail, and missing ca-certificates.

In most shells, the source of a pipe erroring doesn't fail the entire command, so curl -LsSf https://astral.sh/uv/install.sh | sh passes even if the curl part fails. In bash, you can prefix the command with set -o pipefail && to change this behavior. But in the ubuntu docker container, dash is the default shell, not bash. dash doesn't have a pipefail option (in the version in ubuntu), so the best practice is RUN ["/bin/bash", "-c", "set -o pipefail && curl -LsSf https://astral.sh/uv/install.sh | sh"]. That's not very readable, so i'm going for RUN curl -LsSf https://astral.sh/uv/install.sh > /tmp/uv-installer.sh && sh /tmp/uv-installer.sh && rm /tmp/uv-installer.sh instead.

FROM ubuntu
RUN apt-get update && apt-get install -y curl --no-install-recommends
RUN curl -LsSf https://astral.sh/uv/install.sh > /tmp/uv-installer.sh && sh /tmp/uv-installer.sh && rm /tmp/uv-installer.sh \
RUN uv --version

$ docker buildx build --progress plain --no-cache .
[...]
#6 [3/3] RUN curl -LsSf https://astral.sh/uv/install.sh > /tmp/uv-installer.sh && sh /tmp/uv-installer.sh && rm /tmp/uv-installer.sh RUN uv --version
#6 0.179 curl: (77) error setting certificate file: /etc/ssl/certs/ca-certificates.crt
#6 ERROR: process "/bin/sh -c curl -LsSf https://astral.sh/uv/install.sh > /tmp/uv-installer.sh && sh /tmp/uv-installer.sh && rm /tmp/uv-installer.sh RUN uv --version" did not complete successfully: exit code: 77

The source for this error is ca-certificates missing, which is a recommended package. We need to drop --no-install-recommends and the installation passes again.

[zanieb]

Should we just actually request the packages we need alongside curl instead of installing all recommended packages?

[charliermarsh]

Yeah I think --no-install-recommends is a best practice in Docker.

[zanieb]

Can we just ADD the file from the remote URL if we're doing this? Does that even require curl?

[konstin]

I tried that, but cargo-dist requires curl or wget to download the uv archive.

[konstin]

Do we know what the packages we're unselecting and do we know that unlike ca-certificates, we don't need them? I've also checked with https://docs.docker.com/build/building/best-practices/#apt-get and they don't feature --no-install-recommends (but do add && rm -rf /var/lib/apt/lists/* which we're missing).

[zanieb]

I mean... as described the image works fine — you changed the base image and it failed. I agree we could do better though.

--no-install-recommends is included in Hadolint: https://github.com/hadolint/hadolint/wiki/DL3015