use-pipefail

curl | sh in a Dockerfile succeeds even when curl fails. How set -o pipefail makes Docker RUN pipelines fail loudly.

On this page

A shell pipeline's exit code is the exit code of its last command. So RUN curl -fsSL https://example.com/install.sh | sh succeeds as long as sh exits 0 — even if curl got a 404 and piped it nothing. The build goes green with the tool silently not installed. This rule flags RUN pipelines executed without pipefail.

What the rule catches

Dockerfile — a failed curl still builds green

FROM debian:12-slim
RUN curl -fsSL https://example.com/install.sh | sh

Scanning this file reports:

⚠ WARN [docker-doctor/use-pipefail]
  RUN instruction uses a pipe (|) but does not configure 'pipefail'. If a command in the pipe fails, the step may still succeed silently.

Why it matters

Silent partial failure is the worst kind in a build: the image ships and the problem surfaces at run time, far from the line that caused it. With set -o pipefail, a failure anywhere in the pipeline fails the RUN, which fails the build — turning a production surprise into an immediate, pointing-at-the-right-line build error. One flag converts wrong-but-green into red.

How to fix it

Prepend set -o pipefail && to pipe commands, use exec form with a shell that supports it (e.g., RUN ["/bin/bash", "-c", "set -o pipefail && ..."]), or set SHELL ["/bin/bash", "-o", "pipefail", "-c"] at the top of the stage.

Dockerfile — any failure in the pipe fails the build

FROM debian:12-slim
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
RUN curl -fsSL https://example.com/install.sh | sh

pipefail is a bash/ash feature, and Debian-family images run RUN under /bin/sh (dash), which doesn't support it — hence the SHELL instruction in the fix. On Alpine, BusyBox ash supports it, so RUN set -o pipefail && curl … | sh works per-line without changing SHELL. Setting SHELL once at the top covers every subsequent RUN in the stage.

Rule details

Rule key — docker-doctor/use-pipefail
Category — Best Practices
Default severity — warning
Applies to — Dockerfiles

Explain this rule from the CLI:

npx @docker-doctor/cli@latest rules explain docker-doctor/use-pipefail

Change its severity — or turn it off — in your config file:

// docker-doctor.config.ts
export default {
  rules: {
    "docker-doctor/use-pipefail": "off",
  },
};

Severity affects the health score: error findings cost more points than warning, and info costs the least.