.hadolint.yaml

# DL3008/DL3018: version-pinning apt/apk packages is intentionally not done —
#   the build images track distro security updates and pinned versions are
#   a build-time footgun once the pinned version ages out of the mirror.
# DL3003: WORKDIR is preferred over `cd`, but several Dockerfiles chain a `cd`
#   into a multi-command RUN for a one-off directory switch that WORKDIR would
#   otherwise leak into every later layer.
# SC2016: several RUN lines single-quote a literal `$ORIGIN` (RPATH/RUSTFLAGS
#   values meant for the dynamic linker, e.g. `-rpath,$ORIGIN`) so this shell
#   must NOT expand it -- that is the whole point of the single quotes.
# SC2012: `ls` output is parsed against controlled build-output paths (e.g.
#   counting/globbing `/build/lib/*.so*`), not arbitrary user-supplied
#   filenames, so the usual "ls output isn't safe to parse" caveat doesn't hold.
ignored:
  - DL3008
  - DL3018
  - DL3003
  - SC2016
  - SC2012