Problem
Missing auto-confirm flags can trigger interactive prompts that stall non-interactive builds. Action: use explicit confirmation flags in all package-manager commands executed in CI and Docker builds.
Description
Container builds must be deterministic. Interactive prompts turn builds into timeout-driven workflows instead of code-driven workflows. Action: enforce non-interactive package installs in lint rules and review templates.
Different package managers use different confirmation flags such as -y, --yes, and --noconfirm. Inconsistent command style causes avoidable failures across base images. Action: standardize approved install patterns for each distro and document them in service templates.
Auto-confirm is only part of predictable package hygiene. Pair it with explicit package lists, minimal dependency policy, and cache cleanup to keep layers small and reproducible. Action: require this full install pattern in production Dockerfiles.
Use this rollout checklist to avoid build hangs:
- Require auto-confirm flags for every package install command.
- Block interactive installers in CI and production image builds.
- Combine auto-confirm with minimal dependency options and cleanup.
- Keep a distro-specific command reference in shared templates.
Treat verification as part of the rule, not optional cleanup. Action: automate a static check, a build check, and a runtime smoke check in the default CI pipeline so regressions are caught before review.
- Static check: fail when the disallowed pattern appears in Dockerfile or manifest.
- Build check: run a minimal image build to confirm the secure pattern is valid.
- Runtime check: start the workload and assert expected behavior with one deterministic probe.
Examples of code
Problematic code
FROM ubuntu:24.04
RUN apt-get update && apt-get install --no-install-recommends build-essentialVerified code
FROM ubuntu:24.04
RUN apt-get update && apt-get install -y --no-install-recommends build-essential