feat: add pipfile support to docker image

[lwywoo]

• Ready for review
• Follows CONTRIBUTING rules
• Reviewed by Snyk internal team

What does this PR do?

Add pipfile support to dockerfile

Test Locally

docker build -t pipfiletest -f Dockerfile.python-3 . docker run -it -e SNYK_TOKEN=<INSERT_TOKEN> -v $PWD:/project pipfiletest:latest -d test

https://github.com/snyk/snyk/issues/786

[adrukh]

I wonder if this command would change the state of whatever gets executed afterwards. Not sure how to test this with confidence, maybe just install at the full path without cd?

[lwywoo]

Initially tried to install with full path but was getting:
✔ Successfully created virtual environment! Virtualenv location: /home/node/.local/share/virtualenvs/node-lHasYD0_ Creating a Pipfile for this project… Installing /project/Pipfile… WARNING: Invalid requirement, parse error at "'/project'" ✘ Installation Failed Failed to run the process ... Failed to test pip project

Will serarch the docs to see if I can find a more efficent way to do this

[adrukh]

Thanks! Don’t think this is a ‘no go’, just worth seeing if we can keep the simplicity

[garethr]

To enter the directory, and then return from whence you came, you could replace this with:

pushd "${PROJECT_PATH}"

Then after running pipenv run popd

[garethr]

Using pipenv install here has some interesting side effects that I don't think are desirable here. Consider the case you have a Pipfile and a Pipfile.lock.

My understanding is that pipenv install will install all dependencies, and update pipfile.lock with the versions it used. So it's not checking what you've checked in.

pipenv sync will install the exact versions specified in pipfile.lock and I think is a better solution when you detect a lock file.

The logic I have for this in the experimental images I'm plating with is https://github.com/garethr/snyk-images/blob/master/docker-entrypoint.sh#L14-L35

[lwywoo]

Thanks for the info, will update the PR :)

[dkontorovskyy]

Why not use glob to match python custom requirements.txt files?

[miiila]

@dkontorovskyy Would you match all .txt files? Or just requirements-something?

[dkontorovskyy]

All *req*.txt files

[miiila]

@dkontorovskyy I thought about it more and I'm probably for keeping it for requirements.txt only (or parametrize it somehow). Because we would need to check, if something matching req.txt and we would need find that particular name (I don't know, how to do it in shell), because we would need to provided the full name. Additionally - not sure what to do if there would be multiple req.txt files.

[garethr]

Note that the new, experimental, set of images supports these use cases out of the box.

https://github.com/snyk/snyk-images

• It correctly detects Pipfile and can test Pipfile baseed projects
• It supports an environment variable which can be used to override the defaults

More details in the README: https://github.com/snyk/snyk-images#running-bootstrap-commands

It may be worth trying that out.

[lili2311]

Will add this support in this PR: #925 please come over to review here instead @garethr @adrukh