Repository: pantsbuild/pants

Issue:
hadolint `SIGSEGV`
I consistently see:
```console
$ coredumpctl --no-pager --reverse | head
TIME                           PID  UID  GID SIG     COREFILE EXE                                                                     SIZE
Mon 2021-11-29 11:01:52 PST 286277 1000 1000 SIGSEGV present  /tmp/process-executionAZKFnf/hadolint-Linux-x86_64                      6.0M
Mon 2021-11-29 11:01:51 PST 286203 1000 1000 SIGSEGV present  /tmp/process-executionHQJDB8/hadolint-Linux-x86_64                      6.0M
Mon 2021-11-29 11:01:49 PST 286134 1000 1000 SIGSEGV present  /tmp/process-executionE1cwer/hadolint-Linux-x86_64                      6.0M
Mon 2021-11-29 11:01:48 PST 286064 1000 1000 SIGSEGV present  /tmp/process-executionsrNyG4/hadolint-Linux-x86_64                      6.0M
Mon 2021-11-29 11:01:46 PST 285992 1000 1000 SIGSEGV present  /tmp/process-executionzvoGoN/hadolint-Linux-x86_64                      6.0M
Mon 2021-11-29 11:00:53 PST 285488 1000 1000 SIGSEGV present  /tmp/process-executionxnYVBE/hadolint-Linux-x86_64                      6.0M
Mon 2021-11-29 11:00:52 PST 285417 1000 1000 SIGSEGV present  /tmp/process-executionTJQQgF/hadolint-Linux-x86_64                      6.0M
Mon 2021-11-29 11:00:50 PST 285342 1000 1000 SIGSEGV present  /tmp/process-executionXSWbj2/hadolint-Linux-x86_64                      6.0M
Mon 2021-11-29 11:00:49 PST 285272 1000 1000 SIGSEGV present  /tmp/process-executionFekImI/hadolint-Linux-x86_64                      6.0M
```

I fiddled a bit and this is easy to repro if I just unset `$HOME`. I downloaded 2.6 (which we currently use) as well as all newer hadolint Linux binaries for the test:
```console
$ for hadolint in ./hadolint-2.*; do echo "$hadolint:"; (unset HOME; $hadolint /etc/hosts); echo $?; done
./hadolint-2.6.1-Linux-x86_64:
139
./hadolint-2.6-Linux-x86_64:
139
./hadolint-2.7-Linux-x86_64:
139
./hadolint-2.8-Linux-x86_64:
139
```
If I either set up an explicit config file or else set `HOME` to blank, things work fine:
+ explicit config:
```console
$ for hadolint in ./hadolint-2.*; do echo "$hadolint:"; (unset HOME; $hadolint --config <(echo "ignored:") /etc/hosts); echo $?; done
./hadolint-2.6.1-Linux-x86_64:
/etc/hosts:3:1 unexpected '1' expecting '#', '\', ADD, ARG, CMD, COPY, ENTRYPOINT, ENV, EXPOSE, FROM, HEALTHCHECK, LABEL, MAINTAINER, ONBUILD, RUN, SHELL, STOPSIGNAL, USER, VOLUME, WORKDIR, a pragma, at least one space, or end of input 
1
./hadolint-2.6-Linux-x86_64:
/etc/hosts:3:1 unexpected '1' expecting '#', '\', ADD, ARG, CMD, COPY, ENTRYPOINT, ENV, EXPOSE, FROM, HEALTHCHECK, LABEL, MAINTAINER, ONBUILD, RUN, SHELL, STOPSIGNAL, USER, VOLUME, WORKDIR, a pragma, at least one space, or end of input 
1
./hadolint-2.7-Linux-x86_64:
/etc/hosts:3:1 unexpected '1' expecting '#', '\', ADD, ARG, CMD, COPY, ENTRYPOINT, ENV, EXPOSE, FROM, HEALTHCHECK, LABEL, MAINTAINER, ONBUILD, RUN, SHELL, STOPSIGNAL, USER, VOLUME, WORKDIR, a pragma, at least one space, or end of input 
1
./hadolint-2.8-Linux-x86_64:
/etc/hosts:3:1 unexpected '1' expecting '#', '\', ADD, ARG, CMD, COPY, ENTRYPOINT, ENV, EXPOSE, FROM, HEALTHCHECK, LABEL, MAINTAINER, ONBUILD, RUN, SHELL, STOPSIGNAL, USER, VOLUME, WORKDIR, a pragma, at least one space, or end of input 
1
```
+ blank `HOME`:
```console
$ for hadolint in ./hadolint-2.*; do echo "$hadolint:"; (HOME= $hadolint /etc/hosts); echo $?; done
./hadolint-2.6.1-Linux-x86_64:
/etc/hosts:3:1 unexpected '1' expecting '#', '\', ADD, ARG, CMD, COPY, ENTRYPOINT, ENV, EXPOSE, FROM, HEALTHCHECK, LABEL, MAINTAINER, ONBUILD, RUN, SHELL, STOPSIGNAL, USER, VOLUME, WORKDIR, a pragma, at least one space, or end of input 
1
./hadolint-2.6-Linux-x86_64:
/etc/hosts:3:1 unexpected '1' expecting '#', '\', ADD, ARG, CMD, COPY, ENTRYPOINT, ENV, EXPOSE, FROM, HEALTHCHECK, LABEL, MAINTAINER, ONBUILD, RUN, SHELL, STOPSIGNAL, USER, VOLUME, WORKDIR, a pragma, at least one space, or end of input 
1
./hadolint-2.7-Linux-x86_64:
/etc/hosts:3:1 unexpected '1' expecting '#', '\', ADD, ARG, CMD, COPY, ENTRYPOINT, ENV, EXPOSE, FROM, HEALTHCHECK, LABEL, MAINTAINER, ONBUILD, RUN, SHELL, STOPSIGNAL, USER, VOLUME, WORKDIR, a pragma, at least one space, or end of input 
1
./hadolint-2.8-Linux-x86_64:
/etc/hosts:3:1 unexpected '1' expecting '#', '\', ADD, ARG, CMD, COPY, ENTRYPOINT, ENV, EXPOSE, FROM, HEALTHCHECK, LABEL, MAINTAINER, ONBUILD, RUN, SHELL, STOPSIGNAL, USER, VOLUME, WORKDIR, a pragma, at least one space, or end of input 
1
```
I'm not sure why I consistently get this on my local Linux machine but CI apparently does not.

At any rate - it seems like we should be disabling local machine config when running hadolint anyhow for reproducibility reasons.


Discussion:
Noticed when working the SIGABRT core dumps for #12831.

Resolving patch:
diff --git a/src/python/pants/backend/docker/lint/hadolint/rules.py b/src/python/pants/backend/docker/lint/hadolint/rules.py
--- a/src/python/pants/backend/docker/lint/hadolint/rules.py
+++ b/src/python/pants/backend/docker/lint/hadolint/rules.py
@@ -76,6 +76,19 @@ async def run_hadolint(request: HadolintRequest, hadolint: Hadolint) -> LintResu
         FallibleProcessResult,
         Process(
             argv=[downloaded_hadolint.exe, *generate_argv(dockerfile_infos, hadolint)],
+            # Hadolint tries to read a configuration file from a few locations on the system:
+            # https://github.com/hadolint/hadolint/blob/43d2bfe9f71dea9ddd203d5bdbd2cc1fb512e4dd/src/Hadolint/Config/Configfile.hs#L75-L101
+            #
+            # We don't want it to do this in order to have reproducible results machine to machine
+            # and there is also the problem that on some machines, an unset (as opposed to empty)
+            # HOME env var crashes hadolint with SIGSEGV.
+            # See: https://github.com/hadolint/hadolint/issues/741
+            #
+            # As such, we set HOME to blank so no system configuration is found and, as a side
+            # benefit, we don't crash.
+            #
+            # See https://github.com/pantsbuild/pants/issues/13735 for more details.
+            env={"HOME": ""},
             input_digest=input_digest,
             description=f"Run `hadolint` on {pluralize(len(dockerfile_infos), 'Dockerfile')}.",
             level=LogLevel.DEBUG,


Test patch: