Use more descriptive long-form options for curl, tar, and checksum validation (#6496)

Author: lbussell

CONTRIBUTING.md

@@ -75,7 +75,16 @@ The [`build-and-test.ps1`](https://github.com/dotnet/dotnet-docker/blob/main/bui
 
 ### Editing Dockerfiles
 
-The [Dockerfiles](https://github.com/search?q=repo%3Adotnet%2Fdotnet-docker+path%3Asrc%2F**%2FDockerfile&type=code&ref=advsearch) contained in this repo are generated from a set of [Cottle](https://cottle.readthedocs.io/en/stable/page/01-overview.html) based [templates](https://github.com/dotnet/dotnet-docker/tree/main/eng/dockerfile-templates). A single template generates the set of Dockerfiles that are similar (e.g. all Windows sdk Dockerfiles for a particular .NET version).  This ensures consistency across the various Dockerfiles and eases the burden of making changes to the Dockerfiles.  Instead of editing the Dockerfiles directly, the templates should be updated and then the Dockerfiles should get regenerated by running the [generate Dockerfiles script](https://github.com/dotnet/dotnet-docker/blob/main/eng/dockerfile-templates/Get-GeneratedDockerfiles.ps1).
+The [Dockerfiles](https://github.com/search?q=repo%3Adotnet%2Fdotnet-docker+path%3Asrc%2F**%2FDockerfile&type=code&ref=advsearch) contained in this repo are generated from a set of [Cottle](https://cottle.readthedocs.io/en/stable/page/01-overview.html) based [templates](https://github.com/dotnet/dotnet-docker/tree/main/eng/dockerfile-templates). A single template generates the set of Dockerfiles that are similar (e.g. all Windows sdk Dockerfiles for a particular .NET version). This ensures consistency across the various Dockerfiles and eases the burden of making changes to the Dockerfiles. Instead of editing the Dockerfiles directly, the templates should be updated and then the Dockerfiles should get regenerated by running the [generate Dockerfiles script](https://github.com/dotnet/dotnet-docker/blob/main/eng/dockerfile-templates/Get-GeneratedDockerfiles.ps1).
+
+#### Dockerfile style guide
+
+Use the following formatting guidelines when authoring Dockerfiles in this repo:
+
+- Separate instructions with an empty newline.
+- Separate stages with two empty newlines.
+- Prefer to use long-form command line options for better readability.
+- Leave an empty newline at the end of the Dockerfile.
 
 ### Editing READMEs
 

eng/dockerfile-templates/Dockerfile.linux.download-file

@@ -16,6 +16,6 @@
     set isAlpine to find(OS_VERSION, "alpine") >= 0 ^
     set shaFunction to ARGS["sha-function"] ^
     set shaFunction to when(shaFunction, shaFunction, "512")
-}}{{if isAlpine:wget {{headerArgs}}-O^else:curl {{headerArgs}}-fSL --output}} {{ARGS["out-file"]}} {{if isInternal:"{{ARGS["url"]}}"^else:{{ARGS["url"]}}}}{{if ARGS["sha"]: \
+}}{{if isAlpine:wget {{headerArgs}}--output-document^else:curl {{headerArgs}}--fail --show-error --location --output}} {{ARGS["out-file"]}} {{if isInternal:"{{ARGS["url"]}}"^else:{{ARGS["url"]}}}}{{if ARGS["sha"]: \
 && {{ARGS["sha-var-name"]}}='{{ARGS["sha"]}}' \
 && echo "${{ARGS["sha-var-name"]}}  {{ARGS["out-file"]}}" | sha{{shaFunction}}sum -c -}}

eng/dockerfile-templates/Dockerfile.linux.extract-tarball

@@ -5,5 +5,5 @@
         file: Tarball to extract
         extract-paths: Paths within the tarball to extract
         dest-dir: Destination directory
-}}tar -oxzf {{ARGS["file"]}}{{if ARGS["dest-dir"]: -C {{ARGS["dest-dir"]}}}}{{if ARGS["extract-paths"]: {{join(ARGS["extract-paths"], " ")}}}} \
+}}tar --gzip --extract --no-same-owner --file {{ARGS["file"]}}{{if ARGS["dest-dir"]: --directory {{ARGS["dest-dir"]}}}}{{if ARGS["extract-paths"]: {{join(ARGS["extract-paths"], " ")}}}} \
 && rm {{ARGS["file"]}}

eng/dockerfile-templates/Dockerfile.linux.install-files

@@ -8,7 +8,7 @@
     set fileExtractionTemplate to when(ARGS["is-zip"], "Dockerfile.linux.extract-zip", "Dockerfile.linux.extract-tarball")
 }}{{
 if ARGS["create-install-dir"]
-    :mkdir -p {{ARGS["install-dir"]}} \
+    :mkdir --parents {{ARGS["install-dir"]}} \
 }}{{
 for i, file in ARGS["files"]:{{
     if i > 0 || ARGS["create-install-dir"]:&& }}{{

eng/dockerfile-templates/Dockerfile.windows.extract-zip

@@ -5,5 +5,5 @@
         file: Zip to extract
         extract-paths: Paths within the zip file to extract
         dest-dir: Destination directory
-}}tar -oxzf {{ARGS["file"]}}{{if ARGS["dest-dir"]: -C {{ARGS["dest-dir"]}}}}{{if ARGS["extract-paths"]: {{join(ARGS["extract-paths"], " ")}}}}; `
+}}tar --gzip --extract --no-same-owner --file {{ARGS["file"]}}{{if ARGS["dest-dir"]: --directory {{ARGS["dest-dir"]}}}}{{if ARGS["extract-paths"]: {{join(ARGS["extract-paths"], " ")}}}}; `
 Remove-Item -Force {{ARGS["file"]}}

eng/dockerfile-templates/runtime-deps/Dockerfile.chiseled-ubuntu

@@ -88,7 +88,7 @@ RUN {{InsertTemplate("Dockerfile.linux.non-root-user-staged", [
         "create-home": "true"
     ])}}
 
-RUN mkdir -p /rootfs/var/lib/dpkg/ \
+RUN mkdir --parents /rootfs/var/lib/dpkg/ \
     && chisel-wrapper --generate-dpkg-status /rootfs/var/lib/dpkg/status -- \
         --release ubuntu-{{osVersionNumber}} --root /rootfs \{{for index, pkg in pkgs:
             {{pkg}}{{if index < len(pkgs) - 1: \}}}}

eng/dockerfile-templates/runtime-deps/Dockerfile.distroless-mariner

@@ -34,7 +34,7 @@ RUN mkdir {{distrolessStagingDir}} \
 COPY --from={{baseImage}} /var/lib/rpmmanifest/container-manifest-2 /tmp/rpmmanifest
 RUN tmpManifestPath="/tmp/rpmmanifest" \
     && rpm --query --all --queryformat "%{NAME}\t%{VERSION}-%{RELEASE}\t%{INSTALLTIME}\t%{BUILDTIME}\t%{VENDOR}\t%{EPOCH}\t%{SIZE}\t%{ARCH}\t%{EPOCHNUM}\t%{SOURCERPM}\n" --root /staging | grep -v gpg-pubkey >> $tmpManifestPath \
-    && mkdir -p /staging/var/lib/rpmmanifest \
+    && mkdir --parents /staging/var/lib/rpmmanifest \
     # Remove duplicates that match on the first field (package name)
     && tac $tmpManifestPath | gawk '!x[$1]++' | sort > /staging/var/lib/rpmmanifest/container-manifest-2
 
@@ -49,12 +49,13 @@ RUN {{InsertTemplate("Dockerfile.linux.non-root-user-staged",
         ])}}
 
 # Clean up staging
-RUN rm -rf {{distrolessStagingDir}}/etc/tdnf \
-    && rm -rf {{distrolessStagingDir}}/run/* \
-    && rm -rf {{distrolessStagingDir}}/var/cache/tdnf \
-    && rm -rf {{distrolessStagingDir}}/var/lib/rpm \
-    && rm -rf {{distrolessStagingDir}}/usr/share/doc \
-    && rm -rf {{distrolessStagingDir}}/usr/share/man \
+RUN rm -rf \
+        {{distrolessStagingDir}}/etc/tdnf \
+        {{distrolessStagingDir}}/run/* \
+        {{distrolessStagingDir}}/var/cache/tdnf \
+        {{distrolessStagingDir}}/var/lib/rpm \
+        {{distrolessStagingDir}}/usr/share/doc \
+        {{distrolessStagingDir}}/usr/share/man \
     && find {{distrolessStagingDir}}/var/log -type f -size +0 -delete
 
 

eng/dockerfile-templates/runtime-deps/Dockerfile.linux.non-root-user

@@ -25,7 +25,7 @@
 
     set addUserCommand to when(isAlpine,
         "adduser",
-        "useradd -l") ^
+        "useradd --no-log-init") ^
     set addUserGroupArg to when(isAlpine,
         cat("--ingroup=", name),
         cat("--gid=", gid)) ^

eng/dockerfile-templates/runtime-deps/Dockerfile.linux.non-root-user-staged

@@ -22,8 +22,8 @@
     "no-create-home": ARGS["no-create-home"],
     "no-shell": isDistroless
 ])}} \{{if !ARGS["no-create-home"]:
-    && install -d -m 0755 -o {{uid}} -g {{gid}} "{{ARGS["staging-dir"]}}/home/{{ARGS["name"]}}" \}}{{if ARGS["create-dir"]:
-    && mkdir -p "{{ARGS["staging-dir"]}}/etc" \}}{{if ARGS["exclusive"]:
+    && install --directory --mode 0755 --owner {{uid}} --group {{gid}} "{{ARGS["staging-dir"]}}/home/{{ARGS["name"]}}" \}}{{if ARGS["create-dir"]:
+    && mkdir --parents "{{ARGS["staging-dir"]}}/etc" \}}{{if ARGS["exclusive"]:
     && rootOrAppRegex='@^\(root\|app\):' \
     && cat /etc/passwd | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/passwd" \
     && cat /etc/group | grep $rootOrAppRegex > "{{ARGS["staging-dir"]}}/etc/group"^

eng/dockerfile-templates/sdk/Dockerfile.linux.install-powershell

@@ -14,7 +14,7 @@ RUN powershell_version={{VARIABLES[cat("powershell|", dotnetVersion, "|build-ver
             "sha": VARIABLES[join(["powershell", dotnetVersion, shaPlatform, "sha"], "|")],
             "sha-var-name": "powershell_sha512"
         ], "    ")}} \
-    && mkdir -p /usr/share/powershell \
+    && mkdir --parents /usr/share/powershell \
     && dotnet tool install --add-source / --tool-path /usr/share/powershell --version $powershell_version PowerShell.{{nupkgPlatform}} \
     && dotnet nuget locals all --clear \
     && rm {{nupkgName}} \