From 8e92ed04db9ec73a52e789e8aaa3f6a1578e8400 Mon Sep 17 00:00:00 2001
From: Marko Bocevski <marko.bocevski@keitaro.com>
Date: Fri, 15 Jan 2021 22:24:16 +0100
Subject: [PATCH] Lint Dockerfiles

---
 .hadolint.yaml                   |  3 +++
 compose/postgresql/Dockerfile    |  2 +-
 compose/solr/Dockerfile          |  7 ++---
 examples/harvest/Dockerfile      |  8 +++---
 examples/s3filestore/Dockerfile  |  8 +++---
 images/ckan/2.7/Dockerfile       | 22 ++++++++-------
 images/ckan/2.7/Dockerfile.focal | 46 ++++++++++++++++++--------------
 images/ckan/2.8/Dockerfile       | 15 ++++++-----
 images/ckan/2.8/Dockerfile.focal | 30 ++++++++++++---------
 images/ckan/2.9/Dockerfile       | 15 ++++++-----
 images/ckan/2.9/Dockerfile.focal | 38 +++++++++++++++-----------
 images/datapusher/Dockerfile     |  9 ++++---
 12 files changed, 119 insertions(+), 84 deletions(-)
 create mode 100644 .hadolint.yaml

diff --git a/.hadolint.yaml b/.hadolint.yaml
new file mode 100644
index 0000000..502b578
--- /dev/null
+++ b/.hadolint.yaml
@@ -0,0 +1,3 @@
+ignored:
+  - DL3018
+  - DL3008
diff --git a/compose/postgresql/Dockerfile b/compose/postgresql/Dockerfile
index f7e9795..d2dee7f 100644
--- a/compose/postgresql/Dockerfile
+++ b/compose/postgresql/Dockerfile
@@ -10,4 +10,4 @@ ARG POSTGRES_PASSWORD
 ARG DS_RO_PASS
 
 # Include datastore setup scripts
-ADD ./postgresql/docker-entrypoint-initdb.d /docker-entrypoint-initdb.d
+COPY ./postgresql/docker-entrypoint-initdb.d /docker-entrypoint-initdb.d
diff --git a/compose/solr/Dockerfile b/compose/solr/Dockerfile
index f49dd33..6cdbae2 100644
--- a/compose/solr/Dockerfile
+++ b/compose/solr/Dockerfile
@@ -12,8 +12,8 @@ RUN mkdir -p /opt/solr/server/solr/$SOLR_CORE/conf
 RUN mkdir -p /opt/solr/server/solr/$SOLR_CORE/data
 
 # Adding Files
-ADD ./solr/solrconfig-$CKAN_VERSION.xml \
-https://raw.githubusercontent.com/ckan/ckan/ckan-$CKAN_VERSION/ckan/config/solr/schema.xml \
+COPY ./solr/solrconfig-$CKAN_VERSION.xml /opt/solr/server/solr/$SOLR_CORE/conf/
+ADD https://raw.githubusercontent.com/ckan/ckan/ckan-$CKAN_VERSION/ckan/config/solr/schema.xml \
 https://raw.githubusercontent.com/apache/lucene-solr/releases/lucene-solr/$SOLR_VERSION/solr/server/solr/configsets/basic_configs/conf/currency.xml \
 https://raw.githubusercontent.com/apache/lucene-solr/releases/lucene-solr/$SOLR_VERSION/solr/server/solr/configsets/basic_configs/conf/synonyms.txt \
 https://raw.githubusercontent.com/apache/lucene-solr/releases/lucene-solr/$SOLR_VERSION/solr/server/solr/configsets/basic_configs/conf/stopwords.txt \
@@ -28,7 +28,8 @@ RUN mv /opt/solr/server/solr/$SOLR_CORE/conf/solrconfig-$CKAN_VERSION.xml /opt/s
 # Giving ownership to Solr
 
 USER root
-RUN chown -R $SOLR_USER:$SOLR_USER /opt/solr/server/solr/$SOLR_CORE
+
+RUN chown -R "$SOLR_USER:$SOLR_USER" /opt/solr/server/solr/$SOLR_CORE
 
 # User
 USER $SOLR_USER:$SOLR_USER
diff --git a/examples/harvest/Dockerfile b/examples/harvest/Dockerfile
index 098508b..df3202f 100644
--- a/examples/harvest/Dockerfile
+++ b/examples/harvest/Dockerfile
@@ -3,8 +3,6 @@
 ###################
 FROM keitaro/ckan:2.9.1 as extbuild
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
-
 # Locations and tags, please use specific tags or revisions
 ENV HARVEST_GIT_URL=https://github.com/ckan/ckanext-harvest
 ENV HARVEST_GIT_BRANCH=v1.3.1
@@ -25,11 +23,15 @@ RUN pip wheel --wheel-dir=/wheels git+${HARVEST_GIT_URL}@${HARVEST_GIT_BRANCH}#e
 RUN pip wheel --wheel-dir=/wheels -r https://raw.githubusercontent.com/ckan/ckanext-harvest/${HARVEST_GIT_BRANCH}/pip-requirements.txt
 RUN curl -o /wheels/harvest.txt https://raw.githubusercontent.com/ckan/ckanext-harvest/${HARVEST_GIT_BRANCH}/pip-requirements.txt
 
+USER ckan
+
 ############
 ### MAIN ###
 ############
 FROM keitaro/ckan:2.9.1
 
+LABEL maintainer="Keitaro Inc <info@keitaro.com>"
+
 ENV CKAN__PLUGINS envvars image_view text_view recline_view datastore datapusher harvest ckan_harvester
 
 # Switch to the root user
@@ -41,7 +43,7 @@ COPY --from=extbuild /wheels /srv/app/ext_wheels
 RUN pip install --no-index --find-links=/srv/app/ext_wheels ckanext-harvest && \
     pip install --no-index --find-links=/srv/app/ext_wheels -r /srv/app/ext_wheels/harvest.txt && \
     # Configure plugins
-    ckan config-tool ${APP_DIR}/production.ini "ckan.plugins = ${CKAN__PLUGINS}" && \
+    ckan config-tool "${APP_DIR}/production.ini" "ckan.plugins = ${CKAN__PLUGINS}" && \
     chown -R ckan:ckan /srv/app
 
 # Remove wheels
diff --git a/examples/s3filestore/Dockerfile b/examples/s3filestore/Dockerfile
index 49994a2..7e45e25 100644
--- a/examples/s3filestore/Dockerfile
+++ b/examples/s3filestore/Dockerfile
@@ -3,8 +3,6 @@
 ###################
 FROM keitaro/ckan:2.8.6 as extbuild
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
-
 # Locations and tags, please use specific tags or revisions
 ENV S3FILESTORE_GIT_URL=https://github.com/keitaroinc/ckanext-s3filestore
 ENV S3FILESTORE_GIT_BRANCH=master
@@ -17,12 +15,14 @@ RUN pip wheel --wheel-dir=/wheels git+${S3FILESTORE_GIT_URL}@${S3FILESTORE_GIT_B
 RUN pip wheel --wheel-dir=/wheels -r https://raw.githubusercontent.com/keitaroinc/ckanext-s3filestore/${S3FILESTORE_GIT_BRANCH}/requirements.txt
 RUN curl -o /wheels/s3filestore.txt https://raw.githubusercontent.com/keitaroinc/ckanext-s3filestore/${S3FILESTORE_GIT_BRANCH}/requirements.txt
 
+USER ckan
+
 ############
 ### MAIN ###
 ############
 FROM keitaro/ckan:2.8.6
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
+LABEL maintainer="Keitaro Inc <info@keitaro.com>"
 
 ENV CKAN__PLUGINS envvars s3filestore image_view text_view recline_view datastore datapusher
 
@@ -34,7 +34,7 @@ COPY --from=extbuild /wheels /srv/app/ext_wheels
 # Install and enable the custom extensions
 RUN pip install --no-index --find-links=/srv/app/ext_wheels ckanext-s3filestore && \
     pip install --no-index --find-links=/srv/app/ext_wheels -r /srv/app/ext_wheels/s3filestore.txt && \
-    paster --plugin=ckan config-tool ${APP_DIR}/production.ini "ckan.plugins = ${CKAN__PLUGINS}" && \
+    paster --plugin=ckan config-tool "${APP_DIR}/production.ini" "ckan.plugins = ${CKAN__PLUGINS}" && \
     chown -R ckan:ckan /srv/app
 
 # Remove wheels
diff --git a/images/ckan/2.7/Dockerfile b/images/ckan/2.7/Dockerfile
index 12bbd17..190fd4a 100644
--- a/images/ckan/2.7/Dockerfile
+++ b/images/ckan/2.7/Dockerfile
@@ -36,7 +36,7 @@ RUN apk add --no-cache \
         libxslt-dev
 
 # Install version 9.x of postgresql-dev so that CKAN requirements can be built
-RUN apk add --repository http://dl-cdn.alpinelinux.org/alpine/v3.6/main \
+RUN apk add --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/v3.6/main \
         postgresql-dev~=9.6
 
 # Create the src directory
@@ -95,19 +95,20 @@ RUN pip wheel --wheel-dir=/wheels git+${ENVVARS_GIT_URL}@${ENVVARS_GIT_BRANCH}#e
 ############
 FROM alpine:3.13
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
+LABEL maintainer="Keitaro Inc <info@keitaro.com>"
+LABEL org.opencontainers.image.source https://github.com/keitaroinc/docker-ckan
 
 ENV APP_DIR=/srv/app
 ENV SRC_DIR=/srv/app/src
+ENV CKAN_DIR=${SRC_DIR}/ckan
 ENV DATA_DIR=/srv/app/data
 ENV PIP_SRC=${SRC_DIR}
 ENV CKAN_SITE_URL=http://localhost:5000
 ENV CKAN__PLUGINS envvars image_view text_view recline_view datastore datapusher
 
-WORKDIR ${APP_DIR}
-
 # Install necessary packages to run CKAN
-RUN apk add --no-cache git \
+RUN apk add --no-cache \ 
+        git \
         bash \
         gettext \
         curl \
@@ -119,7 +120,7 @@ RUN apk add --no-cache git \
         tzdata \
         apache2-utils && \
     # Install version 9.x of postgresql-client so that CKAN can run
-    apk add --repository http://dl-cdn.alpinelinux.org/alpine/v3.6/main \
+    apk add --no-cache --repository http://dl-cdn.alpinelinux.org/alpine/v3.6/main \
         postgresql-client~=9.6 && \
     # Create SRC_DIR
     mkdir -p ${SRC_DIR}
@@ -131,18 +132,19 @@ RUN curl -o ${SRC_DIR}/get-pip.py https://bootstrap.pypa.io/get-pip.py && \
 # Get artifacts from build stages
 COPY --from=ckanbuild /wheels /srv/app/wheels
 COPY --from=extbuild /wheels /srv/app/ext_wheels
-COPY --from=ckanbuild /srv/app/src/ckan /srv/app/src/ckan
+COPY --from=ckanbuild /srv/app/src/ckan ${CKAN_DIR}
 
 # Additional install steps for build stages artifacts
-RUN pip install --no-index --find-links=/srv/app/wheels uwsgi gevent
+RUN pip install --no-index --find-links=/srv/app/wheels uwsgi==2.0.19.1 gevent==20.6.2
 
 # Create a local user and group to run the app
 RUN addgroup -g 92 -S ckan && \
     adduser -u 92 -h /srv/app -H -D -S -G ckan ckan
 
+WORKDIR ${CKAN_DIR}
+
 # Install CKAN
 RUN pip install -e /srv/app/src/ckan && \
-    cd ${SRC_DIR}/ckan && \
     cp who.ini ${APP_DIR} && \
     pip install --no-index --find-links=/srv/app/wheels -r requirements.txt && \
     # Install default CKAN extensions
@@ -166,6 +168,8 @@ RUN rm -rf /srv/app/wheels /srv/app/ext_wheels
 # Copy necessary scripts
 COPY setup/app ${APP_DIR}
 
+WORKDIR ${APP_DIR}
+
 # Copy the alias script for paster to be ckan so it's compatible with 2.9
 COPY setup/bin/ckan /usr/bin/ckan
 
diff --git a/images/ckan/2.7/Dockerfile.focal b/images/ckan/2.7/Dockerfile.focal
index 5d69961..8b2cb2d 100644
--- a/images/ckan/2.7/Dockerfile.focal
+++ b/images/ckan/2.7/Dockerfile.focal
@@ -22,21 +22,21 @@ WORKDIR ${SRC_DIR}
 
 # Set the locale          
 RUN apt-get update
-RUN apt-get install -y locales
+RUN apt-get install --no-install-recommends -y locales
 RUN sed -i "/$LC_ALL/s/^# //g" /etc/locale.gen
 RUN dpkg-reconfigure --frontend=noninteractive locales 
 RUN update-locale LANG=${LC_ALL}
 
 # Instal apt-utils
-RUN apt-get install -y \
+RUN apt-get install --no-install-recommends -y \
         apt-utils
 
 # Packages to build CKAN requirements and plugins
-RUN apt-get install -y \
+RUN apt-get install --no-install-recommends -y \
         git \
-	    wget \
-	    gnupg \
+	gnupg \
         curl \
+        ca-certificates \
         python \
         linux-headers-generic \
         gcc-10 \
@@ -54,10 +54,11 @@ RUN apt-get install -y \
         libxslt-dev
 
 # Install version 9.x of postgresql-dev so that CKAN requirements can be built
-RUN wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+RUN curl -s -o - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add -
 RUN sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt/ focal-pgdg main" >> /etc/apt/sources.list.d/postgresql.list'
 RUN apt-get update
-RUN apt-get install -y \
+RUN apt-get install --no-install-recommends -y \
         postgresql-server-dev-9.6
 
 # Use gcc 10
@@ -99,9 +100,10 @@ ENV ENVVARS_GIT_URL=https://github.com/okfn/ckanext-envvars
 ENV ENVVARS_GIT_BRANCH=0.0.1
 
 RUN apt-get update && \
-    apt-get install -y \
+    apt-get install --no-install-recommends -y \
         git \
         curl \
+        ca-certificates \
         python \
         python-dev
 
@@ -120,7 +122,8 @@ RUN pip wheel --wheel-dir=/wheels git+${ENVVARS_GIT_URL}@${ENVVARS_GIT_BRANCH}#e
 ############
 FROM ubuntu:focal-20201106
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
+LABEL maintainer="Keitaro Inc <info@keitaro.com>"
+LABEL org.opencontainers.image.source https://github.com/keitaroinc/docker-ckan
 
 # Set timezone
 ENV TZ=UTC
@@ -131,7 +134,7 @@ ENV LC_ALL=en_US.UTF-8
 
 # Set the locale          
 RUN apt-get update && \
-    apt-get install -y locales && \
+    apt-get install --no-install-recommends -y locales && \
     sed -i "/$LC_ALL/s/^# //g" /etc/locale.gen && \
     dpkg-reconfigure --frontend=noninteractive locales && \
     update-locale LANG=${LC_ALL} && \
@@ -139,21 +142,21 @@ RUN apt-get update && \
 
 ENV APP_DIR=/srv/app
 ENV SRC_DIR=/srv/app/src
+ENV CKAN_DIR=${SRC_DIR}/ckan
 ENV DATA_DIR=/srv/app/data
 ENV PIP_SRC=${SRC_DIR}
 ENV CKAN_SITE_URL=http://localhost:5000
 ENV CKAN__PLUGINS envvars image_view text_view recline_view datastore datapusher
 
-WORKDIR ${APP_DIR}
-
 # Install necessary packages to run CKAN
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN apt-get update && \
-    apt-get install -y \
+    apt-get install --no-install-recommends -y \
         gettext \
         curl \
+        ca-certificates \
         git \
-	    wget \
-	    gnupg \
+	gnupg \
         python \
         libpython2.7 \
         libmagic1 \
@@ -164,10 +167,10 @@ RUN apt-get update && \
         apache2-utils && \
     rm -rf /var/lib/apt/lists/* && \
     # Install version 9.x of postgresql-client so that CKAN can run
-    wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - && \
+    curl -s -o - https://www.postgresql.org/media/keys/ACCC4CF8.asc | apt-key add - && \
     sh -c 'echo "deb http://apt.postgresql.org/pub/repos/apt/ focal-pgdg main" >> /etc/apt/sources.list.d/postgresql.list' && \
     apt-get update && \
-    apt-get install -y \
+    apt-get install --no-install-recommends -y \
         postgresql-client-9.6 && \
     rm -rf /var/lib/apt/lists/* && \
     # Create SRC_DIR
@@ -180,18 +183,19 @@ RUN curl -o ${SRC_DIR}/get-pip.py https://bootstrap.pypa.io/get-pip.py && \
 # Get artifacts from build stages
 COPY --from=ckanbuild /wheels /srv/app/wheels
 COPY --from=extbuild /wheels /srv/app/ext_wheels
-COPY --from=ckanbuild /srv/app/src/ckan /srv/app/src/ckan
+COPY --from=ckanbuild /srv/app/src/ckan ${CKAN_DIR}
 
 # Additional install steps for build stages artifacts
-RUN pip install --no-index --find-links=/srv/app/wheels uwsgi gevent
+RUN pip install --no-index --find-links=/srv/app/wheels uwsgi==2.0.19.1 gevent==20.6.2
 
 # Create a local user and group to run the app
 RUN groupadd -g 92 ckan && \
     useradd -rm -d /srv/app -s /bin/bash -g ckan -u 92 ckan
 
+WORKDIR ${CKAN_DIR}
+
 # Install CKAN
 RUN pip install -e /srv/app/src/ckan && \
-    cd ${SRC_DIR}/ckan && \
     cp who.ini ${APP_DIR} && \
     pip install --no-index --find-links=/srv/app/wheels -r requirements.txt && \
     # Install default CKAN extensions
@@ -213,6 +217,8 @@ RUN rm -rf /srv/app/wheels /srv/app/ext_wheels
 # Copy necessary scripts
 COPY setup/app ${APP_DIR}
 
+WORKDIR ${APP_DIR}
+
 # Copy the alias script for paster to be ckan so it's compatible with 2.9
 COPY setup/bin/ckan /usr/bin/ckan
 
diff --git a/images/ckan/2.8/Dockerfile b/images/ckan/2.8/Dockerfile
index cf7a111..c9abcbd 100644
--- a/images/ckan/2.8/Dockerfile
+++ b/images/ckan/2.8/Dockerfile
@@ -91,17 +91,17 @@ RUN pip wheel --wheel-dir=/wheels git+${ENVVARS_GIT_URL}@${ENVVARS_GIT_BRANCH}#e
 ############
 FROM alpine:3.13
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
+LABEL maintainer="Keitaro Inc <info@keitaro.com>"
+LABEL org.opencontainers.image.source https://github.com/keitaroinc/docker-ckan
 
 ENV APP_DIR=/srv/app
 ENV SRC_DIR=/srv/app/src
+ENV CKAN_DIR=${SRC_DIR}/ckan
 ENV DATA_DIR=/srv/app/data
 ENV PIP_SRC=${SRC_DIR}
 ENV CKAN_SITE_URL=http://localhost:5000
 ENV CKAN__PLUGINS envvars image_view text_view recline_view datastore datapusher
 
-WORKDIR ${APP_DIR}
-
 # Install necessary packages to run CKAN
 RUN apk add --no-cache git \
         bash \
@@ -125,18 +125,19 @@ RUN curl -o ${SRC_DIR}/get-pip.py https://bootstrap.pypa.io/get-pip.py && \
 # Get artifacts from build stages
 COPY --from=ckanbuild /wheels /srv/app/wheels
 COPY --from=extbuild /wheels /srv/app/ext_wheels
-COPY --from=ckanbuild /srv/app/src/ckan /srv/app/src/ckan
+COPY --from=ckanbuild /srv/app/src/ckan ${CKAN_DIR}
 
 # Additional install steps for build stages artifacts
-RUN pip install --no-index --find-links=/srv/app/wheels uwsgi gevent
+RUN pip install --no-index --find-links=/srv/app/wheels uwsgi==2.0.19.1 gevent==20.6.2
 
 # Create a local user and group to run the app
 RUN addgroup -g 92 -S ckan && \
     adduser -u 92 -h /srv/app -H -D -S -G ckan ckan
 
+WORKDIR ${CKAN_DIR}
+
 # Install CKAN
 RUN pip install -e /srv/app/src/ckan && \
-    cd ${SRC_DIR}/ckan && \
     cp who.ini ${APP_DIR} && \
     pip install --no-index --find-links=/srv/app/wheels -r requirements.txt && \
     # Install default CKAN extensions
@@ -160,6 +161,8 @@ RUN rm -rf /srv/app/wheels /srv/app/ext_wheels
 # Copy necessary scripts
 COPY setup/app ${APP_DIR}
 
+WORKDIR ${APP_DIR}
+
 # Copy the alias script for paster to be ckan so it's compatible with 2.9
 COPY setup/bin/ckan /usr/bin/ckan
 
diff --git a/images/ckan/2.8/Dockerfile.focal b/images/ckan/2.8/Dockerfile.focal
index c539e08..f34eea5 100644
--- a/images/ckan/2.8/Dockerfile.focal
+++ b/images/ckan/2.8/Dockerfile.focal
@@ -22,19 +22,20 @@ WORKDIR ${SRC_DIR}
 
 # Set the locale          
 RUN apt-get update
-RUN apt-get install -y locales
+RUN apt-get install --no-install-recommends -y locales
 RUN sed -i "/$LC_ALL/s/^# //g" /etc/locale.gen
 RUN dpkg-reconfigure --frontend=noninteractive locales 
 RUN update-locale LANG=${LC_ALL}
 
 # Instal apt-utils
-RUN apt-get install -y \
+RUN apt-get install --no-install-recommends -y \
         apt-utils
 
 # Packages to build CKAN requirements and plugins
-RUN apt-get install -y \
+RUN apt-get install --no-install-recommends -y \
         git \
         curl \
+        ca-certificates \
         python \
         libpq-dev \
         linux-headers-generic \
@@ -91,9 +92,10 @@ ENV ENVVARS_GIT_URL=https://github.com/okfn/ckanext-envvars
 ENV ENVVARS_GIT_BRANCH=0.0.1
 
 RUN apt-get update && \
-    apt-get install -y \
+    apt-get install --no-install-recommends -y \
         git \
         curl \
+        ca-certificates \
         python \
         python-dev
 
@@ -112,7 +114,8 @@ RUN pip wheel --wheel-dir=/wheels git+${ENVVARS_GIT_URL}@${ENVVARS_GIT_BRANCH}#e
 ############
 FROM ubuntu:focal-20201106
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
+LABEL maintainer="Keitaro Inc <info@keitaro.com>"
+LABEL org.opencontainers.image.source https://github.com/keitaroinc/docker-ckan
 
 # Set timezone
 ENV TZ=UTC
@@ -123,7 +126,7 @@ ENV LC_ALL=en_US.UTF-8
 
 # Set the locale          
 RUN apt-get update && \
-    apt-get install -y locales && \
+    apt-get install --no-install-recommends -y locales && \
     sed -i "/$LC_ALL/s/^# //g" /etc/locale.gen && \
     dpkg-reconfigure --frontend=noninteractive locales && \
     update-locale LANG=${LC_ALL} && \
@@ -131,18 +134,18 @@ RUN apt-get update && \
 
 ENV APP_DIR=/srv/app
 ENV SRC_DIR=/srv/app/src
+ENV CKAN_DIR=${SRC_DIR}/ckan
 ENV DATA_DIR=/srv/app/data
 ENV PIP_SRC=${SRC_DIR}
 ENV CKAN_SITE_URL=http://localhost:5000
 ENV CKAN__PLUGINS envvars image_view text_view recline_view datastore datapusher
 
-WORKDIR ${APP_DIR}
-
 # Install necessary packages to run CKAN
 RUN apt-get update && \
-    apt-get install -y \
+    apt-get install --no-install-recommends -y \
         gettext \
         curl \
+        ca-certificates \
         git \
         libpq5 \
         postgresql-client \
@@ -165,18 +168,19 @@ RUN curl -o ${SRC_DIR}/get-pip.py https://bootstrap.pypa.io/get-pip.py && \
 # Get artifacts from build stages
 COPY --from=ckanbuild /wheels /srv/app/wheels
 COPY --from=extbuild /wheels /srv/app/ext_wheels
-COPY --from=ckanbuild /srv/app/src/ckan /srv/app/src/ckan
+COPY --from=ckanbuild /srv/app/src/ckan ${CKAN_DIR}
 
 # Additional install steps for build stages artifacts
-RUN pip install --no-index --find-links=/srv/app/wheels uwsgi gevent
+RUN pip install --no-index --find-links=/srv/app/wheels uwsgi==2.0.19.1 gevent==20.6.2
 
 # Create a local user and group to run the app
 RUN groupadd -g 92 ckan && \
     useradd -rm -d /srv/app -s /bin/bash -g ckan -u 92 ckan
 
+WORKDIR ${CKAN_DIR}
+
 # Install CKAN
 RUN pip install -e /srv/app/src/ckan && \
-    cd ${SRC_DIR}/ckan && \
     cp who.ini ${APP_DIR} && \
     pip install --no-index --find-links=/srv/app/wheels -r requirements.txt && \
     # Install default CKAN extensions
@@ -198,6 +202,8 @@ RUN rm -rf /srv/app/wheels /srv/app/ext_wheels
 # Copy necessary scripts
 COPY setup/app ${APP_DIR}
 
+WORKDIR ${APP_DIR}
+
 # Copy the alias script for paster to be ckan so it's compatible with 2.9
 COPY setup/bin/ckan /usr/bin/ckan
 
diff --git a/images/ckan/2.9/Dockerfile b/images/ckan/2.9/Dockerfile
index 09ac216..a89d061 100644
--- a/images/ckan/2.9/Dockerfile
+++ b/images/ckan/2.9/Dockerfile
@@ -100,17 +100,17 @@ RUN pip wheel --wheel-dir=/wheels git+${ENVVARS_GIT_URL}@${ENVVARS_GIT_BRANCH}#e
 ############
 FROM alpine:3.13
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
+LABEL maintainer="Keitaro Inc <info@keitaro.com>"
+LABEL org.opencontainers.image.source https://github.com/keitaroinc/docker-ckan
 
 ENV APP_DIR=/srv/app
 ENV SRC_DIR=/srv/app/src
+ENV CKAN_DIR=${SRC_DIR}/ckan
 ENV DATA_DIR=/srv/app/data
 ENV PIP_SRC=${SRC_DIR}
 ENV CKAN_SITE_URL=http://localhost:5000
 ENV CKAN__PLUGINS envvars image_view text_view recline_view datastore datapusher
 
-WORKDIR ${APP_DIR}
-
 # Install necessary packages to run CKAN
 RUN apk add --no-cache git \
         bash \
@@ -136,18 +136,19 @@ RUN curl -o ${SRC_DIR}/get-pip.py https://bootstrap.pypa.io/get-pip.py && \
 # Get artifacts from build stages
 COPY --from=ckanbuild /wheels /srv/app/wheels
 COPY --from=extbuild /wheels /srv/app/ext_wheels
-COPY --from=ckanbuild /srv/app/src/ckan /srv/app/src/ckan
+COPY --from=ckanbuild /srv/app/src/ckan ${CKAN_DIR}
 
 # Additional install steps for build stages artifacts
-RUN pip install --no-index --find-links=/srv/app/wheels uwsgi gevent
+RUN pip install --no-index --find-links=/srv/app/wheels uwsgi==2.0.19.1 gevent==20.6.2
 
 # Create a local user and group to run the app
 RUN addgroup -g 92 -S ckan && \
     adduser -u 92 -h /srv/app -H -D -S -G ckan ckan
 
+WORKDIR ${CKAN_DIR}
+
 # Install CKAN
 RUN pip install -e /srv/app/src/ckan && \
-    cd ${SRC_DIR}/ckan && \
     cp who.ini ${APP_DIR} && \
     pip install --no-index --find-links=/srv/app/wheels -r requirements.txt && \
     # Install default CKAN extensions
@@ -174,6 +175,8 @@ RUN rm -rf /srv/app/wheels /srv/app/ext_wheels
 # Copy necessary scripts
 COPY setup/app ${APP_DIR}
 
+WORKDIR ${APP_DIR}
+
 # Create entrypoint directory for children image scripts
 ONBUILD RUN mkdir docker-entrypoint.d
 
diff --git a/images/ckan/2.9/Dockerfile.focal b/images/ckan/2.9/Dockerfile.focal
index 6d96f94..e285623 100644
--- a/images/ckan/2.9/Dockerfile.focal
+++ b/images/ckan/2.9/Dockerfile.focal
@@ -22,19 +22,20 @@ WORKDIR ${SRC_DIR}
 
 # Set the locale          
 RUN apt-get update
-RUN apt-get install -y locales
+RUN apt-get install --no-install-recommends -y locales
 RUN sed -i "/$LC_ALL/s/^# //g" /etc/locale.gen
 RUN dpkg-reconfigure --frontend=noninteractive locales 
 RUN update-locale LANG=${LC_ALL}
 
 # Instal apt-utils
-RUN apt-get install -y \
+RUN apt-get install --no-install-recommends -y \
         apt-utils
 
 # Packages to build CKAN requirements and plugins
-RUN apt-get install -y \
+RUN apt-get install --no-install-recommends -y \
         git \
         curl \
+        ca-certificates \
         python3 \
         libpq-dev \
         linux-headers-generic \
@@ -97,9 +98,10 @@ ENV ENVVARS_GIT_URL=https://github.com/okfn/ckanext-envvars
 ENV ENVVARS_GIT_BRANCH=0.0.1
 
 RUN apt-get update && \
-    apt-get install -y \
+    apt-get install --no-install-recommends -y \
         git \
         curl \
+        ca-certificates \
         python3 \
         python3-dev
 
@@ -121,7 +123,8 @@ RUN pip wheel --wheel-dir=/wheels git+${ENVVARS_GIT_URL}@${ENVVARS_GIT_BRANCH}#e
 ############
 FROM ubuntu:focal-20201106
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
+LABEL maintainer="Keitaro Inc <info@keitaro.com>"
+LABEL org.opencontainers.image.source https://github.com/keitaroinc/docker-ckan
 
 # Set timezone
 ENV TZ=UTC
@@ -132,7 +135,7 @@ ENV LC_ALL=en_US.UTF-8
 
 # Set the locale          
 RUN apt-get update && \
-    apt-get install -y locales && \
+    apt-get install --no-install-recommends -y locales && \
     sed -i "/$LC_ALL/s/^# //g" /etc/locale.gen && \
     dpkg-reconfigure --frontend=noninteractive locales && \
     update-locale LANG=${LC_ALL} && \
@@ -140,24 +143,24 @@ RUN apt-get update && \
 
 ENV APP_DIR=/srv/app
 ENV SRC_DIR=/srv/app/src
+ENV CKAN_DIR=${SRC_DIR}/ckan
 ENV DATA_DIR=/srv/app/data
 ENV PIP_SRC=${SRC_DIR}
 ENV CKAN_SITE_URL=http://localhost:5000
 ENV CKAN__PLUGINS envvars image_view text_view recline_view datastore datapusher
 
-WORKDIR ${APP_DIR}
-
 # Install necessary packages to run CKAN
 RUN apt-get update && \
-    apt-get install -y \
+    apt-get install --no-install-recommends -y \
         gettext \
-	    curl \
+	curl \
+        ca-certificates \
         libpq5 \
         git \
-	    postgresql-client \
+	postgresql-client \
         python3 \
-	    python3-distutils \
-	    libpython3.8 \
+	python3-distutils \
+	libpython3.8 \
         libmagic1 \
         libpcre3 \
         libxslt1.1 \
@@ -177,18 +180,19 @@ RUN curl -o ${SRC_DIR}/get-pip.py https://bootstrap.pypa.io/get-pip.py && \
 # Get artifacts from build stages
 COPY --from=ckanbuild /wheels /srv/app/wheels
 COPY --from=extbuild /wheels /srv/app/ext_wheels
-COPY --from=ckanbuild /srv/app/src/ckan /srv/app/src/ckan
+COPY --from=ckanbuild /srv/app/src/ckan ${CKAN_DIR}
 
 # Additional install steps for build stages artifacts
-RUN pip install --no-index --find-links=/srv/app/wheels uwsgi gevent
+RUN pip install --no-index --find-links=/srv/app/wheels uwsgi==2.0.19.1 gevent==20.6.2
 
 # Create a local user and group to run the app
 RUN groupadd -g 92 ckan && \
     useradd -rm -d /srv/app -s /bin/bash -g ckan -u 92 ckan
 
+WORKDIR ${CKAN_DIR}
+
 # Install CKAN
 RUN pip install -e /srv/app/src/ckan && \
-    cd ${SRC_DIR}/ckan && \
     cp who.ini ${APP_DIR} && \
     pip install --no-index --find-links=/srv/app/wheels -r requirements.txt && \
     # Install default CKAN extensions
@@ -213,6 +217,8 @@ RUN rm -rf /srv/app/wheels /srv/app/ext_wheels
 # Copy necessary scripts
 COPY setup/app ${APP_DIR}
 
+WORKDIR ${APP_DIR}
+
 # Create entrypoint directory for children image scripts
 ONBUILD RUN mkdir docker-entrypoint.d
 
diff --git a/images/datapusher/Dockerfile b/images/datapusher/Dockerfile
index 89d1ed9..86756cf 100644
--- a/images/datapusher/Dockerfile
+++ b/images/datapusher/Dockerfile
@@ -53,7 +53,8 @@ RUN pip wheel --wheel-dir=/wheels uwsgi==2.0.19.1 gevent==20.6.2 greenlet==0.4.1
 ############
 FROM alpine:3.13
 
-MAINTAINER Keitaro Inc <info@keitaro.com>
+LABEL maintainer="Keitaro Inc <info@keitaro.com>"
+LABEL org.opencontainers.image.source https://github.com/keitaroinc/docker-ckan
 
 ENV APP_DIR=/srv/app
 ENV JOB_CONFIG ${APP_DIR}/datapusher_settings.py
@@ -67,14 +68,14 @@ RUN apk add --no-cache \
         libxslt
 
 # Install pip
-RUN curl -o ${src_dir}/get-pip.py https://bootstrap.pypa.io/get-pip.py && \
-    python3 ${src_dir}/get-pip.py
+RUN curl -o /tmp/get-pip.py https://bootstrap.pypa.io/get-pip.py && \
+    python3 /tmp/get-pip.py
 
 # Get artifacts from build stages
 COPY --from=build /wheels /srv/app/wheels
 
 # Install uwsgi and gevent
-RUN pip install --no-index --find-links=/srv/app/wheels uwsgi gevent
+RUN pip install --no-index --find-links=/srv/app/wheels uwsgi==2.0.19.1 gevent==20.6.2
 
 # Create a local user and group to run the app
 RUN addgroup -g 92 -S ckan && \