Example of bowtie2+subread

[enryH]

Hadolint (used by nf-core/tools) recommends to add

• --no-install-recommends
• specific version, which I took from debian.org/distrib/packages

Then the solution for ARM packages pinned looks like:

# ARM specific Dockerfile
FROM debian:13

WORKDIR /app


RUN apt-get update \
    && apt-get -y install --no-install-recommends \
    bowtie2=2.5.4-1+b2 \
    curl=8.14.1-2+deb13u2 \
    samtools=1.21-1 \
    subread=2.0.8+dfsg-1 \
    && rm -rf /var/lib/apt/lists/*


COPY scripts/ ./scripts/

Hadolint version: Haskell Dockerfile Linter 2.14.0

[enryH]

For completness, using the file as in the current instructions (using subread from the debian packages list)

FROM debian:13

WORKDIR /app

RUN apt-get update && apt-get -y install \
    bowtie2 \
    curl \
    samtools \
    subread 

COPY scripts/ ./scripts/

Hadolint says:

>>> hadolint Dockerfile
Dockerfile_before:6 DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
Dockerfile_before:6 DL3009 info: Delete the apt lists (/var/lib/apt/lists) after installing something
Dockerfile_before:6 DL3015 info: Avoid additional packages by specifying `--no-install-recommends`

[pcolaianni]

I was going to create an issue for pinning apt packages, but I found this one. Thanks Henry.

I support the --no-install-recommends, and maybe there are more goodies here: https://docs.docker.com/build/building/best-practices/

And I would pin packages even in non-ARM Dockerfiles. Just like we do when we install Python packages via requirements.txt or lock files.

Debian 12 (bookworm) offers subread 2.0.3; Debian 13 (trixie) offers version 2.0.8. https://subread.sourceforge.net/ shows that 2.1.1 is available since Aprile this year.

Package maintainers for each distro often do the work as volunteers, therefore packages versions might lag behind upstream releases.

In case you desire subread 2.1.1, at the moment you'd be forced to fetch it from sourceforge.