如何在Docker容器中集成GitHub命令行工具Dependency-Check？

现有方案的问题分析 #

• 方案一：Dependency-Check仅安装在build阶段的镜像中，但最终运行的是base阶段的aspnet:6.0镜像，未将工具从build阶段复制到final阶段，导致容器启动后找不到工具。
• 方案二：本地项目的bin文件夹可能被.gitignore或.dockerignore规则排除，复制到容器时丢失；且复制路径逻辑不清晰，易出现权限或路径寻址问题。

可行方案一：多阶段构建中复制工具到最终镜像 #

修改Dockerfile，在final阶段从build阶段复制已下载的Dependency-Check，同时配置环境变量方便代码调用：

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 80
ENV ASPNETCORE_ENVIRONMENT=DEVELOPMENT
# 配置工具路径的环境变量，供代码调用时读取
ENV DEPENDENCY_CHECK_PATH="/app/dependency-check"

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src

RUN apt-get update && apt-get install -y unzip wget

# 下载、解压并整理Dependency-Check到统一路径
RUN mkdir /dependency-check \
    && wget https://github.com/jeremylong/DependencyCheck/releases/download/v8.3.1/dependency-check-8.3.1-release.zip -O /dependency-check/dependency-check.zip \
    && unzip /dependency-check/dependency-check.zip -d /dependency-check \
    && mv /dependency-check/dependency-check-8.3.1/* /dependency-check/ \
    && rm -rf /dependency-check/dependency-check-8.3.1 /dependency-check/dependency-check.zip

COPY ["DependencyCheckAPI/DependencyCheckAPI.csproj", "DependencyCheckAPI/"]
RUN dotnet restore "DependencyCheckAPI/DependencyCheckAPI.csproj"
COPY . .

WORKDIR "/src/DependencyCheckAPI"
RUN dotnet build "DependencyCheckAPI.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "DependencyCheckAPI.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
# 从build阶段复制工具到最终运行镜像
COPY --from=build /dependency-check /app/dependency-check
# 给可执行文件添加运行权限
RUN chmod +x /app/dependency-check/bin/dependency-check.sh

ENTRYPOINT ["dotnet", "DependencyCheckAPI.dll"]

方案说明 #

• 在build阶段完成工具的下载、解压和路径整理，确保结构统一
• final阶段通过COPY --from=build将工具复制到运行镜像中
• 添加chmod +x确保可执行文件具备运行权限
• 代码中可通过读取DEPENDENCY_CHECK_PATH环境变量动态拼接工具路径，避免硬编码

可行方案二：使用官方Dependency-Check镜像作为工具源 #

利用官方维护的Dependency-Check镜像，避免手动下载解压的繁琐：

# 从官方镜像获取预配置好的Dependency-Check
FROM owasp/dependency-check:8.3.1 AS dc-base

FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 80
ENV ASPNETCORE_ENVIRONMENT=DEVELOPMENT
ENV DEPENDENCY_CHECK_PATH="/opt/dependency-check"

FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src

COPY ["DependencyCheckAPI/DependencyCheckAPI.csproj", "DependencyCheckAPI/"]
RUN dotnet restore "DependencyCheckAPI.csproj"
COPY . .

WORKDIR "/src/DependencyCheckAPI"
RUN dotnet build "DependencyCheckAPI.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "DependencyCheckAPI.csproj" -c Release -o /app/publish /p:UseAppHost=false

FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
# 从官方镜像复制工具到最终镜像
COPY --from=dc-base /opt/dependency-check /opt/dependency-check
# 确保可执行权限
RUN chmod +x /opt/dependency-check/bin/dependency-check.sh

ENTRYPOINT ["dotnet", "DependencyCheckAPI.dll"]

方案说明 #

• 直接复用官方镜像的预配置环境，减少手动操作的出错概率
• 同样通过环境变量让代码动态寻址工具路径

额外注意事项 #

• 若坚持使用本地复制工具的方式，需检查.dockerignore和.gitignore文件，确保dependency-check-8.3.1-release/bin未被排除
• 代码中调用工具时，需使用容器内的绝对路径或通过环境变量动态获取，避免硬编码本地路径
• Linux容器中Dependency-Check的可执行文件为dependency-check.sh，Windows容器则为dependency-check.bat，需根据容器系统区分

内容的提问来源于stack exchange，提问作者Coder