shopify / hansel

Hansel

Hansel generates empty linux packages. These packages can be installed to track dependencies manually added to a container image.

Usage

You can add hansel to an image, and generate + install tracking packages for dependencies in a single step:

FROM node:18-alpine

COPY --from=ghcr.io/shopify/hansel:latest /usr/bin/hansel /usr/bin/hansel
RUN hansel --name node --version "$(node -v | sed -e's/^v//g')" --install

You can use hansel in a multistep build to generate and install separately:

FROM ghcr.io/shopify/hansel:latest AS crumbs
RUN hansel --name rando-thing --version 1.2.3 --debian

FROM debian:bullseye
RUN curl -o /usr/bin/rando-thing https://rando.thing/v1.2.3/unsigned-blob-yolo
COPY --from=crumbs /rando-thing*.deb /tmp/rando-thing.deb
RUN dpkg -i /tmp/rando-thing.deb && \
    rm /tmp/rando-thing.deb

The name is inspired by Hansel and Gretel, as the packages are breadcrumbs left for container scanners to identify.

hansel's Issues

trigger release + verify examples

All of the examples reference a ghcr.io/shopify/hansel container that does not exist.

Run a release to publish that container, then make sure the examples actually work:

• in the README.md file
• in the _examples/** folder

public repo checklist

TODO before making the repo public:

• coding standards: reviewed with _amcleodca - the integration test is weird but acceptable
• CLA probot configured
• Documentation
  • README.md
  • add a cool demo.gif #9
  • CONTRIBUTING.md #6
  • Code of Conduct (via https://github.com/Shopify/.github/blob/main/CODE_OF_CONDUCT.md)
  • LICENSE.md
• verify examples #7
• delete comments from internal bots
• make public
• 🍨