Fix hadolint reports

.github/workflows/hadolint-check.yml

@@ -14,7 +14,14 @@ jobs:
     outputs:
       dockerfiles: ${{ steps.list.outputs.dockerfiles }}
     steps:
-      - name: Checkout repository
+      - name: Checkout repository (pull request)
+        if:  ${{ github.event_name == 'pull_request' }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Checkout repository (regular)
+        if:  ${{ github.event_name != 'pull_request' }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: List Dockerfiles
@@ -59,6 +66,7 @@ jobs:
           format: sarif
           output-file: hadolint-${{ steps.slug.outputs.name }}.sarif
           no-fail: true
+          config: ${{ github.workspace}}/ci/.hadolint.yaml
 
       - name: Upload SARIF to Code Scanning
         uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # 4.35.1

ci/.hadolint.yaml

@@ -0,0 +1,2 @@
+ignored:
+  - DL3008

server/docker/Dockerfile.android.ndk25-env

@@ -37,42 +37,43 @@ ARG ANDROID_SDK_FILENAME_35=android-sdk-linux-android-${ANDROID_SDK_VERSION_35}-
 ARG ANDROID_NDK25_FILENAME=android-ndk-r${ANDROID_NDK25_VERSION}-linux.tar.gz
 ARG R8_VERSION=8.7.0-dev
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN --mount=type=secret,id=DM_PACKAGES_URL,required=true \
-    mkdir -p ${ANDROID_HOME} && \
-    wget -q -O - $(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_NDK25_FILENAME} | tar xz -C ${ANDROID_ROOT} && \
-    wget -q -O - $(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_SDK_FILENAME_34} | tar xz -C ${ANDROID_HOME} --strip-components=1 && \
-    wget -q -O - $(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_SDK_FILENAME_35} | tar xz -C ${ANDROID_HOME} --strip-components=1 && \
-    rm -rf ${ANDROID_HOME}/extras && \
-    rm -rf ${ANDROID_NDK25_PATH}/prebuilt && \
-    rm -rf ${ANDROID_NDK25_PATH}/simpleperf && \
-    rm -rf ${ANDROID_NDK25_PATH}/shader-tools && \
-    rm -rf ${ANDROID_NDK25_PATH}/sources/third_party && \
-    rm -rf ${ANDROID_NDK25_PATH}/sources/cxx-stl && \
-    rm -rf ${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/i686-linux-android && \
-    rm -rf ${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/x86_64-linux-android && \
-    rm -rf ${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/bin/i686-* && \
-    rm -rf ${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/bin/x86_64-* && \
-    rm -rf ${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/x86_64-linux-android && \
-    rm -rf ${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/i686-linux-android && \
+    mkdir -p "${ANDROID_HOME}" && \
+    wget -q -O - "$(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_NDK25_FILENAME}" | tar xz -C "${ANDROID_ROOT}" && \
+    wget -q -O - "$(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_SDK_FILENAME_34}" | tar xz -C "${ANDROID_HOME}" --strip-components=1 && \
+    wget -q -O - "$(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_SDK_FILENAME_35}" | tar xz -C "${ANDROID_HOME}" --strip-components=1 && \
+    rm -rf "${ANDROID_HOME}/extras" && \
+    rm -rf "${ANDROID_NDK25_PATH}/prebuilt" && \
+    rm -rf "${ANDROID_NDK25_PATH}/simpleperf" && \
+    rm -rf "${ANDROID_NDK25_PATH}/shader-tools" && \
+    rm -rf "${ANDROID_NDK25_PATH}/sources/third_party" && \
+    rm -rf "${ANDROID_NDK25_PATH}/sources/cxx-stl" && \
+    rm -rf "${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/i686-linux-android" && \
+    rm -rf "${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/x86_64-linux-android" && \
+    rm -rf "${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/bin/i686-*" && \
+    rm -rf "${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/bin/x86_64-*" && \
+    rm -rf "${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/x86_64-linux-android" && \
+    rm -rf "${ANDROID_NDK25_PATH}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/i686-linux-android" && \
 # create the .android folder and give read+write permissions (the Android Gradle plugin will write to the folder)
 # It is not enough to give 'user' and 'group'. We unfortunately also need 'others'
-    mkdir ${ANDROID_SDK_HOME} && \
-    chmod ugo+rw -R ${ANDROID_SDK_HOME} && \
+    mkdir "${ANDROID_SDK_HOME}" && \
+    chmod ugo+rw -R "${ANDROID_SDK_HOME}" && \
 # fix permissions
-    chmod +r -R ${ANDROID_ROOT} && \
-    chmod +w -R ${ANDROID_HOME} && \
-    chmod -R 755 ${ANDROID_ROOT}/android-ndk-r${ANDROID_NDK25_VERSION} && \
+    chmod +r -R "${ANDROID_ROOT}" && \
+    chmod +w -R "${ANDROID_HOME}" && \
+    chmod -R 755 "${ANDROID_ROOT}/android-ndk-r${ANDROID_NDK25_VERSION}" && \
 # check that dx installed properly
-    which ${ANDROID_NDK25_BIN_PATH}/armv7a-linux-androideabi${ANDROID_NDK25_API_VERSION}-clang++ && \
-    which ${ANDROID_NDK25_BIN_PATH}/aarch64-linux-android${ANDROID_64_NDK25_API_VERSION}-clang++ && \
+    which "${ANDROID_NDK25_BIN_PATH}/armv7a-linux-androideabi${ANDROID_NDK25_API_VERSION}-clang++" && \
+    which "${ANDROID_NDK25_BIN_PATH}/aarch64-linux-android${ANDROID_64_NDK25_API_VERSION}-clang++" && \
 # check that aapt installed correctly
-    ${ANDROID_SDK_BUILD_TOOLS_PATH_34}/aapt2 version && \
+    "${ANDROID_SDK_BUILD_TOOLS_PATH_34}/aapt2" version && \
 # download and install R8 utility separatly. It's done in that way because
 # R8/D8 received fixes from time to time which not populated with build tools
 # It's ok that R8.jar downloaded but saved to D8.jar. Can't find D8 as separate utility.
 # R8 contains all classes of D8.
-    wget -O ${ANDROID_SDK_BUILD_TOOLS_PATH_34}/lib/d8.jar https://storage.googleapis.com/r8-releases/raw/${R8_VERSION}/r8.jar && \
-    wget -O ${ANDROID_SDK_BUILD_TOOLS_PATH_35}/lib/d8.jar https://storage.googleapis.com/r8-releases/raw/${R8_VERSION}/r8.jar
+    wget -q -O "${ANDROID_SDK_BUILD_TOOLS_PATH_34}/lib/d8.jar" "https://storage.googleapis.com/r8-releases/raw/${R8_VERSION}/r8.jar" && \
+    wget -q -O "${ANDROID_SDK_BUILD_TOOLS_PATH_35}/lib/d8.jar" "https://storage.googleapis.com/r8-releases/raw/${R8_VERSION}/r8.jar"
 
 FROM europe-west1-docker.pkg.dev/extender-426409/extender-public-registry/extender-android-env:1.7.0
 
@@ -131,6 +132,7 @@ ENV ANDROID_ROOT=${ANDROID_ROOT} \
 
 COPY --from=build ${ANDROID_ROOT} ${ANDROID_ROOT}
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 # android proguard was version 4.7, this is at least 5.2.1 which seems to work with OpenJDK 11
 RUN \
   apt-get update && \
@@ -141,5 +143,6 @@ RUN \
 # Since dotnet cannot really cross compile, we need to create a "ar" shim for "llvm-ar"
 # As long as it's in the path, it will be picked up
   echo '#!/usr/bin/env bash' > /usr/bin/ar && \
-  find /opt/platformsdk/android -iname "llvm-ar" | tail -1 | xargs xargs printf "%s \$*\n" $1 >> /usr/bin/ar && \
+  LLVM_AR=$(find /opt/platformsdk/android -iname "llvm-ar" | tail -1) && \
+  echo "${LLVM_AR} \$*" >> /usr/bin/ar && \
   chmod +x /usr/bin/ar

server/docker/Dockerfile.android.ndk25_sdk36-env

@@ -31,39 +31,40 @@ ARG ANDROID_64_NDK_API_VERSION
 ARG ANDROID_NDK_FILENAME=android-ndk-r${ANDROID_NDK_VERSION}-linux.tar.gz
 ARG R8_VERSION=8.13.19
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN --mount=type=secret,id=DM_PACKAGES_URL,required=true \
-    mkdir -p ${ANDROID_HOME} && \
-    wget -q -O - $(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_NDK_FILENAME} | tar xz -C ${ANDROID_ROOT} && \
-    wget -q -O - $(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_SDK_FILENAME} | tar xz -C ${ANDROID_HOME} --strip-components=1 && \
-    rm -rf ${ANDROID_HOME}/extras && \
-    rm -rf ${ANDROID_NDK_PATH}/prebuilt && \
-    rm -rf ${ANDROID_NDK_PATH}/simpleperf && \
-    rm -rf ${ANDROID_NDK_PATH}/shader-tools && \
-    rm -rf ${ANDROID_NDK_PATH}/sources/third_party && \
-    rm -rf ${ANDROID_NDK_PATH}/sources/cxx-stl && \
-    rm -rf ${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/i686-linux-android && \
-    rm -rf ${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/x86_64-linux-android && \
-    rm -rf ${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/bin/i686-* && \
-    rm -rf ${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/bin/x86_64-* && \
-    rm -rf ${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/x86_64-linux-android && \
-    rm -rf ${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/i686-linux-android && \
+    mkdir -p "${ANDROID_HOME}" && \
+    wget -q -O - "$(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_NDK_FILENAME}" | tar xz -C "${ANDROID_ROOT}" && \
+    wget -q -O - "$(cat /run/secrets/DM_PACKAGES_URL)/${ANDROID_SDK_FILENAME}" | tar xz -C "${ANDROID_HOME}" --strip-components=1 && \
+    rm -rf "${ANDROID_HOME}/extras" && \
+    rm -rf "${ANDROID_NDK_PATH}/prebuilt" && \
+    rm -rf "${ANDROID_NDK_PATH}/simpleperf" && \
+    rm -rf "${ANDROID_NDK_PATH}/shader-tools" && \
+    rm -rf "${ANDROID_NDK_PATH}/sources/third_party" && \
+    rm -rf "${ANDROID_NDK_PATH}/sources/cxx-stl" && \
+    rm -rf "${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/i686-linux-android" && \
+    rm -rf "${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/x86_64-linux-android" && \
+    rm -rf "${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/bin/i686-*" && \
+    rm -rf "${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/bin/x86_64-*" && \
+    rm -rf "${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/x86_64-linux-android" && \
+    rm -rf "${ANDROID_NDK_PATH}/toolchains/llvm/prebuilt/linux-x86_64/sysroot/usr/lib/i686-linux-android" && \
 # create the .android folder and give read+write permissions (the Android Gradle plugin will write to the folder)
 # It is not enough to give 'user' and 'group'. We unfortunately also need 'others'
-    mkdir ${ANDROID_SDK_HOME} && \
-    chmod ugo+rw -R ${ANDROID_SDK_HOME} && \
+    mkdir "${ANDROID_SDK_HOME}" && \
+    chmod ugo+rw -R "${ANDROID_SDK_HOME}" && \
 # fix permissions
-    chmod +r -R ${ANDROID_ROOT} && \
-    chmod +w -R ${ANDROID_HOME} && \
-    chmod -R 755 ${ANDROID_ROOT}/android-ndk-r${ANDROID_NDK_VERSION} && \
-    which ${ANDROID_NDK_BIN_PATH}/armv7a-linux-androideabi${ANDROID_NDK_API_VERSION}-clang++ && \
-    which ${ANDROID_NDK_BIN_PATH}/aarch64-linux-android${ANDROID_64_NDK_API_VERSION}-clang++ && \
+    chmod +r -R "${ANDROID_ROOT}" && \
+    chmod +w -R "${ANDROID_HOME}" && \
+    chmod -R 755 "${ANDROID_ROOT}/android-ndk-r${ANDROID_NDK_VERSION}" && \
+    which "${ANDROID_NDK_BIN_PATH}/armv7a-linux-androideabi${ANDROID_NDK_API_VERSION}-clang++" && \
+    which "${ANDROID_NDK_BIN_PATH}/aarch64-linux-android${ANDROID_64_NDK_API_VERSION}-clang++" && \
 # check that aapt installed correctly
-    ${ANDROID_SDK_BUILD_TOOLS_PATH}/aapt2 version && \
+    "${ANDROID_SDK_BUILD_TOOLS_PATH}/aapt2" version && \
 # download and install R8 utility separatly. It's done in that way because
 # R8/D8 received fixes from time to time which not populated with build tools
 # It's ok that R8.jar downloaded but saved to D8.jar. Can't find D8 as separate utility.
 # R8 contains all classes of D8.
-    wget -O ${ANDROID_SDK_BUILD_TOOLS_PATH}/lib/d8.jar https://storage.googleapis.com/r8-releases/raw/${R8_VERSION}/r8.jar
+    wget -q -O "${ANDROID_SDK_BUILD_TOOLS_PATH}/lib/d8.jar" "https://storage.googleapis.com/r8-releases/raw/${R8_VERSION}/r8.jar"
 
 FROM europe-west1-docker.pkg.dev/extender-426409/extender-public-registry/extender-android-env:1.7.0
 
@@ -106,6 +107,7 @@ ENV ANDROID_ROOT=${ANDROID_ROOT} \
 
 COPY --from=build ${ANDROID_ROOT} ${ANDROID_ROOT}
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 # android proguard was version 4.7, this is at least 5.2.1 which seems to work with OpenJDK 11
 RUN \
   apt-get update && \
@@ -116,5 +118,6 @@ RUN \
 # Since dotnet cannot really cross compile, we need to create a "ar" shim for "llvm-ar"
 # As long as it's in the path, it will be picked up
   echo '#!/usr/bin/env bash' > /usr/bin/ar && \
-  find /opt/platformsdk/android -iname "llvm-ar" | tail -1 | xargs xargs printf "%s \$*\n" $1 >> /usr/bin/ar && \
+  LLVM_AR=$(find /opt/platformsdk/android -iname "llvm-ar" | tail -1) && \
+  echo "${LLVM_AR} \$*" >> /usr/bin/ar && \
   chmod +x /usr/bin/ar

server/docker/Dockerfile.base-env

@@ -21,6 +21,7 @@ ARG JDK_ARCH=${JDK_ARCH/arm64/aarch64}
 ARG ZIG_ARCH=${TARGETARCH/amd64/x86_64}
 ARG ZIG_ARCH=${ZIG_ARCH/arm64/aarch64}
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN \
   apt-get update && \
   apt-get install -y --no-install-recommends \
@@ -36,27 +37,28 @@ ENV LANG=en_US.UTF-8 \
 # Java
 #
 RUN \
-  wget -q -O - https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25%2B36/OpenJDK25U-jdk_${JDK_ARCH}_linux_hotspot_25_36.tar.gz | tar xz -C /usr/local && \
-  ${JDK_HOME_DIR}/bin/java -version && \
-  ${JDK_HOME_DIR}/bin/javac -version
+  wget -q -O - "https://github.com/adoptium/temurin25-binaries/releases/download/jdk-25%2B36/OpenJDK25U-jdk_${JDK_ARCH}_linux_hotspot_25_36.tar.gz" | tar xz -C /usr/local && \
+  "${JDK_HOME_DIR}/bin/java" -version && \
+  "${JDK_HOME_DIR}/bin/javac" -version
 
 RUN \
-  mkdir -p ${ZIG_PATH} && \
-  wget -q -O - https://ziglang.org/download/${ZIG_VERSION}/zig-linux-${ZIG_ARCH}-${ZIG_VERSION}.tar.xz | tar xJ -C ${ZIG_PATH} --strip-components=1 && \
-  ${ZIG_PATH}/zig version
+  mkdir -p "${ZIG_PATH}" && \
+  wget -q -O - "https://ziglang.org/download/${ZIG_VERSION}/zig-linux-${ZIG_ARCH}-${ZIG_VERSION}.tar.xz" | tar xJ -C "${ZIG_PATH}" --strip-components=1 && \
+  "${ZIG_PATH}/zig" version
 
 # Added 1.9.1
 RUN \
-  mkdir -p ${DOTNET_ROOT} && \
-  mkdir -p ${NUGET_PACKAGES} && \
-  wget https://dot.net/v1/dotnet-install.sh -O ./dotnet-install.sh && \
+  mkdir -p "${DOTNET_ROOT}" && \
+  mkdir -p "${NUGET_PACKAGES}" && \
+  wget -q https://dot.net/v1/dotnet-install.sh -O ./dotnet-install.sh && \
   chmod +x ./dotnet-install.sh && \
-  ./dotnet-install.sh --channel 9.0.1xx --install-dir ${DOTNET_ROOT} && \
+  ./dotnet-install.sh --channel 9.0.1xx --install-dir "${DOTNET_ROOT}" && \
   rm ./dotnet-install.sh && \
-  find ${DOTNET_ROOT} -iname "dotnet" && \
-  ${DOTNET_ROOT}/dotnet --info && \
-  export DOTNET_VERSION=$(${DOTNET_ROOT}/dotnet --info | grep -A 1 'Host' | grep 'Version' | awk '{print $NF}') && \
-  echo ${DOTNET_VERSION} > ${DOTNET_VERSION_FILE}
+  find "${DOTNET_ROOT}" -iname "dotnet" && \
+  "${DOTNET_ROOT}/dotnet" --info && \
+  DOTNET_VERSION=$("${DOTNET_ROOT}/dotnet" --info | grep -A 1 'Host' | grep 'Version' | awk '{print $NF}') && \
+  export DOTNET_VERSION && \
+  echo "${DOTNET_VERSION}" > "${DOTNET_VERSION_FILE}"
 
 FROM ubuntu@sha256:ce4a593b4e323dcc3dd728e397e0a866a1bf516a1b7c31d6aa06991baec4f2e0
 
@@ -88,6 +90,8 @@ COPY --from=build ${ZIG_PATH} ${ZIG_PATH}
 COPY --from=build ${DOTNET_ROOT} ${DOTNET_ROOT}
 COPY --from=build ${NUGET_PACKAGES} ${NUGET_PACKAGES}
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 RUN \
   apt-get update && \
   apt-get install -y --no-install-recommends \
@@ -104,10 +108,10 @@ RUN \
 # Extender data cache
     mkdir -p /var/extender/cache/data && \
     chown extender: /var/extender && \
-    chown extender: $(which java) && \
+    chown extender: "$(which java)" && \
     chown -R extender: /var/extender/cache && \
-    chown -R extender: ${NUGET_PACKAGES} && \
-    chown -R extender: ${DOTNET_ROOT}
+    chown -R extender: "${NUGET_PACKAGES}" && \
+    chown -R extender: "${DOTNET_ROOT}"
 
 ENV LANG=en_US.UTF-8 \
     LANGUAGE=en_US:en \

server/docker/Dockerfile.build-env

@@ -7,4 +7,5 @@ RUN \
     wget \
     ca-certificates \
     unzip \
-    xz-utils
+    xz-utils && \
+  rm -rf /var/lib/apt/lists/*

server/docker/Dockerfile.emsdk.406-env

@@ -17,22 +17,24 @@ ARG EMSCRIPTEN_CONFIG
 ARG EMSCRIPTEN_CACHE
 ARG EMSCRIPTEN_BIN
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 RUN apt-get -qq -y update \
     && apt-get -qq install -y --no-install-recommends \
         python3 \
         python3-pip
 
 RUN --mount=type=secret,id=DM_PACKAGES_URL,required=true \
-  mkdir -p ${EMSCRIPTEN_TARGET_DIR} && \
-  wget -q -O - $(cat /run/secrets/DM_PACKAGES_URL)/emsdk-${EMSCRIPTEN_VERSION}-x86_64-linux.tar.gz | tar xz -C ${EMSCRIPTEN_TARGET_DIR} --strip-components=1
+  mkdir -p "${EMSCRIPTEN_TARGET_DIR}" && \
+  wget -q -O - "$(cat /run/secrets/DM_PACKAGES_URL)/emsdk-${EMSCRIPTEN_VERSION}-x86_64-linux.tar.gz" | tar xz -C "${EMSCRIPTEN_TARGET_DIR}" --strip-components=1
 
 RUN \
-  ${EMSCRIPTEN_TARGET_DIR}/emsdk activate sdk-${EMSCRIPTEN_VERSION}-64bit && \
-  EM_CONFIG=${EMSCRIPTEN_CONFIG} EM_CACHE=${EMSCRIPTEN_CACHE} python3 ${EMSCRIPTEN_BIN}/embuilder.py build SYSTEM MINIMAL && \
-  rm -fr ${EMSCRIPTEN_TARGET_DIR}/upstream/emscripten/tests && \
+  "${EMSCRIPTEN_TARGET_DIR}/emsdk" activate sdk-${EMSCRIPTEN_VERSION}-64bit && \
+  EM_CONFIG="${EMSCRIPTEN_CONFIG}" EM_CACHE="${EMSCRIPTEN_CACHE}" python3 "${EMSCRIPTEN_BIN}/embuilder.py" build SYSTEM MINIMAL && \
+  rm -fr "${EMSCRIPTEN_TARGET_DIR}/upstream/emscripten/tests" && \
 # The "sed" command below removes the /TEMP_DIR line from the generated configs
 # We replace it with a folder of our own
-  sed '/TEMP_DIR =/d' ${EMSCRIPTEN_CONFIG} && \
+  sed '/TEMP_DIR =/d' "${EMSCRIPTEN_CONFIG}" && \
   echo TEMP_DIR = \'${EMSCRIPTEN_TEMP_DIR}\' >> ${EMSCRIPTEN_CONFIG}
 
 

server/docker/Dockerfile.linux-env

@@ -27,7 +27,7 @@ RUN \
     lsb-release \
     software-properties-common \
     gnupg && \
-    wget https://apt.llvm.org/llvm.sh && \
+    wget -q https://apt.llvm.org/llvm.sh && \
     chmod +x llvm.sh && \
     ./llvm.sh ${CLANG_VERSION} && \
     rm llvm.sh && \

server/docker/Dockerfile.nssdk.2143-env

@@ -8,9 +8,11 @@ ARG NINTENDO_SDK_VERSION
 ARG NINTENDO_SDK_ROOT
 ARG SWITCH_SDK_FILENAME=nx64-sdk-${NINTENDO_SDK_VERSION}.tar.gz
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 RUN --mount=type=secret,id=DM_PACKAGES_URL,required=true \
-   mkdir -p ${NINTENDO_SDK_ROOT} && \
-   wget -q -O - $(cat /run/secrets/DM_PACKAGES_URL)/${SWITCH_SDK_FILENAME} | tar xz -C ${NINTENDO_SDK_ROOT}
+   mkdir -p "${NINTENDO_SDK_ROOT}" && \
+   wget -q -O - "$(cat /run/secrets/DM_PACKAGES_URL)/${SWITCH_SDK_FILENAME}" | tar xz -C "${NINTENDO_SDK_ROOT}" --strip-components=1
 
 FROM europe-west1-docker.pkg.dev/extender-426409/extender-public-registry/extender-wine-env:1.7.0
 

server/docker/Dockerfile.ps4.12500-env

@@ -8,10 +8,11 @@ ARG PS4_SDK_VERSION
 ARG PS4_SDK
 ARG PS4_SDK_FILENAME=ps4-sdk-${PS4_SDK_VERSION}.tar.gz
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 RUN --mount=type=secret,id=DM_PACKAGES_URL,required=true \
-  echo "PS4 ${PS4_SDK_FILENAME}" && \
-  mkdir -p ${PS4_SDK} && \
-  wget -q -O - $(cat /run/secrets/DM_PACKAGES_URL)/${PS4_SDK_FILENAME} | tar xz -C ${PS4_SDK} --strip-components=1
+  mkdir -p "${PS4_SDK}" && \
+  wget -q -O - "$(cat /run/secrets/DM_PACKAGES_URL)/${PS4_SDK_FILENAME}" | tar xz -C "${PS4_SDK}" --strip-components=1
 
 FROM europe-west1-docker.pkg.dev/extender-426409/extender-public-registry/extender-wine-env:1.7.0
 

server/docker/Dockerfile.ps5.12000-env

@@ -8,9 +8,11 @@ ARG PS5_SDK_VERSION
 ARG PS5_SDK
 ARG PS5_SDK_FILENAME=ps5-sdk-${PS5_SDK_VERSION}.tar.gz
 
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
 RUN --mount=type=secret,id=DM_PACKAGES_URL,required=true \
-  mkdir -p ${PS5_SDK} && \
-  wget -q -O - $(cat /run/secrets/DM_PACKAGES_URL)/${PS5_SDK_FILENAME} | tar xz -C ${PS5_SDK} --strip-components=1
+  mkdir -p "${PS5_SDK}" && \
+  wget -q -O - "$(cat /run/secrets/DM_PACKAGES_URL)/${PS5_SDK_FILENAME}" | tar xz -C "${PS5_SDK}" --strip-components=1
 
 FROM europe-west1-docker.pkg.dev/extender-426409/extender-public-registry/extender-wine-env:1.7.0