UndefinedVar build check behaviour for PATH-like variables

[Stikus]

According to docs:

Before you reference an environment variable or a build argument in a RUN instruction, you should ensure that the variable is declared in the Dockerfile, using the ARG or ENV instructions.

This is not correct statement - you can append $PATH without any declaration in Dockerfile, as well as some other variables like $LD_LIBRARY_PATH. But not PYTHONPATH:

PYTHONPATH="$SOFT/Stranger-${STRANGER_VERSION}/local/lib/python3.10/dist-packages:$PYTHONPATH"

results warning: UndefinedVar: Usage of undefined variable '$PYTHONPATH' (line 72)

Are there any settings for predefined variables (not in Dockerfile) or how is should be fixed?

Stack Overflow question about this problem.

[crazy-max]

you can append $PATH without any declaration in Dockerfile, as well as some other variables like $LD_LIBRARY_PATH

It depends if this ENV has already been declared in the base image.

results warning: UndefinedVar: Usage of undefined variable '$PYTHONPATH' (line 72)

This means PYTHONPATH has not been declared in your Dockerfile or the base image you're using.

[Stikus]

Does this check actually checks base image? Documentation doesn't have any info about it.

Is there any way to ignore only current case of this check (not all check entirely)? Something like https://github.com/hadolint/hadolint?tab=readme-ov-file#inline-ignores or https://github.com/koalaman/shellcheck/wiki/Ignore#ignoring-one-specific-instance-in-a-file

[crazy-max]

Does this check actually checks base image?

Yes it does

Documentation doesn't have any info about it.

Indeed we could add a callout about it (cc @dvdksn).

Is there any way to ignore only current case of this check (not all check entirely)? Something like https://github.com/hadolint/hadolint?tab=readme-ov-file#inline-ignores or https://github.com/koalaman/shellcheck/wiki/Ignore#ignoring-one-specific-instance-in-a-file

I recall this has been discussed internally but not sure what is the current state of it. @colinhemmings do we have this scoped to a milestone?

[colinhemmings]

@Stikus, yes, we have something similar to inline ignores on the roadmap, but we don't have a date for it just yet. I will make sure to keep you posted.

[Stikus]

Thanks for fast answer, maybe there are any workarounds - like PATH1=${PATH1:-}:/new-path1 or PYTHONPATH="$SOFT/Stranger-${STRANGER_VERSION}/local/lib/python3.10/dist-packages:${PYTHONPATH:-''}"? To ensure that user is aware about empty variable?

[serge2016]

Hello! I am also interested in workarounds... Which one is better?

[tonistiigi]

I think this can be closed. It is warning that you are using a variable that is always unset and that seems to be actually the case.

[Stikus]

@tonistiigi This variable is not always unset - it depends from base image and there are no universal syntax for both declared and undeclared state (like PATH1=${PATH1:-}:/new-path1) - so we cannot create universal Dockerfile and cannot ignore warning with inline ignore.

Quote from linked issue is correct:

In our case PYTHONPATH is actually blank in both cases - but it is legitimate pattern to append to the PYTHONPATH in case the base image adds at a later date.

If we remove appending - it can break when variable become defined, but image depends on base Ubuntu (in our case) and we cannot foresee it.

[cbatson]

What is the rationale for closing this? Would you please offer an explanation? Modifying a path-like environment variable that was previously undefined is a common, established pattern. As has already been well-articulated above, the author of a Dockerfile shouldn't need to care whether or not the base image defines the variable.