From cf8884e913c1b2715e8f37a657dbcd59ee290d22 Mon Sep 17 00:00:00 2001
From: Jian Zeng <anonymousknight96@gmail.com>
Date: Tue, 13 Aug 2024 21:19:18 +0800
Subject: [PATCH] feat: adopt modern Dockerfile (#122)

* feat: adopt modern Dockerfile

Signed-off-by: Jian Zeng <anonymousknight96@gmail.com>

* fix(debian): RUN command with bash

Signed-off-by: Jian Zeng <anonymousknight96@gmail.com>

* refactor: prepare.sh is not needed anymore

Signed-off-by: Jian Zeng <anonymousknight96@gmail.com>

---------

Signed-off-by: Jian Zeng <anonymousknight96@gmail.com>
---
 apt-sync/Dockerfile         |  5 ++++-
 aptsync/Dockerfile          |  8 +++++---
 aptsync/apt-mirror          |  0
 base/Dockerfile.alpine      |  5 ++++-
 base/Dockerfile.alpine-edge |  5 ++++-
 base/Dockerfile.debian      | 18 +++++++++++++-----
 debian-cd/Dockerfile        | 13 +++++++++++--
 debian-cd/prepare.sh        |  9 ---------
 docker-ce/Dockerfile        |  8 +++++---
 fedora/Dockerfile           |  9 ++++++---
 ghcup/Dockerfile            | 22 ++++++++++++++++++++--
 ghcup/prepare.sh            | 16 ----------------
 github-release/Dockerfile   |  3 +--
 google-repo/Dockerfile      |  7 +++++--
 gsutil-rsync/Dockerfile     |  9 +++++----
 julia-storage/Dockerfile    | 13 ++++++++-----
 nix-channels/Dockerfile     | 20 +++++++++++---------
 pypi/Dockerfile             |  7 +++++--
 rclone/Dockerfile           | 11 +++++++----
 shadowmire/Dockerfile       | 11 +++++++----
 stackage/Dockerfile         | 19 +++++++++++++++++--
 stackage/prepare.sh         | 13 -------------
 tsumugu/Dockerfile          | 11 +++++++----
 winget-source/Dockerfile    | 10 +++++++---
 yukina/Dockerfile           | 11 +++++++----
 25 files changed, 159 insertions(+), 104 deletions(-)
 mode change 100644 => 100755 aptsync/apt-mirror
 delete mode 100755 debian-cd/prepare.sh
 delete mode 100644 ghcup/prepare.sh
 delete mode 100755 stackage/prepare.sh

diff --git a/apt-sync/Dockerfile b/apt-sync/Dockerfile
index b54919a..038a41a 100644
--- a/apt-sync/Dockerfile
+++ b/apt-sync/Dockerfile
@@ -1,7 +1,10 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="iBug <docker@ibugone.com>"
 LABEL bind_support=true
-RUN apk add --no-cache --update wget perl ca-certificates git python3 py3-requests && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache --update wget perl ca-certificates git python3 py3-requests
     mkdir -p /usr/local/lib/tunasync
+EOF
 ADD tunasync /usr/local/lib/tunasync
 ADD sync.sh sync.py /
diff --git a/aptsync/Dockerfile b/aptsync/Dockerfile
index 2653d40..dbd0708 100644
--- a/aptsync/Dockerfile
+++ b/aptsync/Dockerfile
@@ -4,8 +4,10 @@ LABEL bind_support=true
 ENV APTSYNC_NTHREADS=20 \
     APTSYNC_CREATE_DIR=true \
     APTSYNC_UNLINK=0
-RUN apk add --no-cache --update wget perl ca-certificates xz \
-        && mkdir -p /var/spool/apt-mirror/mirror /var/spool/apt-mirror/skel /etc/apt/
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache --update wget perl ca-certificates xz
+    mkdir -p /var/spool/apt-mirror/mirror /var/spool/apt-mirror/skel /etc/apt/
+EOF
 ADD ["apt-mirror", "/usr/local/bin/apt-mirror"]
-RUN chmod +x /usr/local/bin/apt-mirror
 ADD ["pre-sync.sh", "sync.sh", "/"]
diff --git a/aptsync/apt-mirror b/aptsync/apt-mirror
old mode 100644
new mode 100755
diff --git a/base/Dockerfile.alpine b/base/Dockerfile.alpine
index 6211bfc..ab79a2f 100644
--- a/base/Dockerfile.alpine
+++ b/base/Dockerfile.alpine
@@ -1,8 +1,11 @@
 FROM alpine:3.20
 LABEL maintainer="Jian Zeng <anonymousknight96 AT gmail.com>" \
       org.ustcmirror.images=true
-RUN apk add --no-cache bash tzdata su-exec && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache bash tzdata su-exec
     ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+EOF
 ADD ["entry.sh", "savelog", "/usr/local/bin/"]
 ADD ["pip.conf", "/etc/"]
 VOLUME ["/data", "/log"]
diff --git a/base/Dockerfile.alpine-edge b/base/Dockerfile.alpine-edge
index bc14627..7943fd5 100644
--- a/base/Dockerfile.alpine-edge
+++ b/base/Dockerfile.alpine-edge
@@ -1,8 +1,11 @@
 FROM alpine:edge
 LABEL maintainer="Yifan Gao<git AT yfgao.com>" \
       org.ustcmirror.images=true
-RUN apk add --no-cache bash tzdata su-exec && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache bash tzdata su-exec
     ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+EOF
 ADD ["entry.sh", "savelog", "/usr/local/bin/"]
 VOLUME ["/data", "/log"]
 CMD ["entry.sh"]
diff --git a/base/Dockerfile.debian b/base/Dockerfile.debian
index 80c6153..a9038d5 100644
--- a/base/Dockerfile.debian
+++ b/base/Dockerfile.debian
@@ -1,11 +1,19 @@
 FROM debian:bookworm-slim
 LABEL maintainer="Jian Zeng <anonymousknight96 AT gmail.com>" \
       org.ustcmirror.images=true
-RUN echo 'Asia/Shanghai' > /etc/timezone && dpkg-reconfigure -f noninteractive tzdata && \
-    apt-get update && apt-get install -y wget && \
-    wget -O /usr/local/bin/su-exec https://ftp.lug.ustc.edu.cn/misc/su-exec && chmod +x /usr/local/bin/su-exec && \
-    echo "592f25c51d0e4c90945ece8c4fa35018d20a1091ac109c98b66eb95deef211c7 /usr/local/bin/su-exec" | sha256sum -c - && \
-    apt-get purge -y --auto-remove wget && rm -rf /var/lib/apt/lists/*
+RUN --mount=type=cache,sharing=locked,target=/var/cache/apt \
+    --mount=type=cache,sharing=locked,target=/var/lib/apt <<EOF
+#!/bin/bash
+
+set -euo pipefail
+echo 'Asia/Shanghai' > /etc/timezone
+dpkg-reconfigure -f noninteractive tzdata
+apt-get update && apt-get install -y wget
+wget -O /usr/local/bin/su-exec https://ftp.lug.ustc.edu.cn/misc/su-exec
+chmod +x /usr/local/bin/su-exec
+echo "592f25c51d0e4c90945ece8c4fa35018d20a1091ac109c98b66eb95deef211c7 /usr/local/bin/su-exec" | sha256sum -c -
+apt-get purge -y --auto-remove wget
+EOF
 ADD ["entry.sh", "savelog", "/usr/local/bin/"]
 VOLUME ["/data", "/log"]
 CMD ["entry.sh"]
diff --git a/debian-cd/Dockerfile b/debian-cd/Dockerfile
index ea1cd42..9bb0d7f 100644
--- a/debian-cd/Dockerfile
+++ b/debian-cd/Dockerfile
@@ -2,7 +2,16 @@ FROM ustcmirror/base:alpine
 LABEL maintainer="Jian Zeng <anonymousknight96 AT gmail.com>"
 LABEL bind_support=true
 VOLUME ["/debian"]
-ADD ["sync.sh", "pre-sync.sh", "prepare.sh", "/"]
+ADD ["sync.sh", "pre-sync.sh", "/"]
 ADD ["jigdo-mirror", "cd-mirror", "/usr/local/bin/"]
 ADD jigdo-mirror.conf.in /etc/jigdo/
-RUN /prepare.sh && rm /prepare.sh
+RUN <<EOF
+set -euo pipefail
+apk add --no-cache wget ca-certificates rsync
+mkdir -p /etc/jigdo
+wget 'https://ftp.lug.ustc.edu.cn/misc/jigdo-bin-0.7.3.tar.bz2'
+echo "58b8a6885822e55f365c99131c906f16ceaaf657c566e10f410d026704cad157  jigdo-bin-0.7.3.tar.bz2" | sha256sum -c -
+tar xf jigdo-bin-0.7.3.tar.bz2 jigdo-bin-0.7.3/jigdo-file
+mv jigdo-bin-0.7.3/jigdo-file /usr/local/bin/
+rm -rf jigdo-bin-*
+EOF
diff --git a/debian-cd/prepare.sh b/debian-cd/prepare.sh
deleted file mode 100755
index 7bc9fb4..0000000
--- a/debian-cd/prepare.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/bash
-set -e
-apk add --no-cache wget ca-certificates rsync
-mkdir -p /etc/jigdo
-wget 'https://ftp.lug.ustc.edu.cn/misc/jigdo-bin-0.7.3.tar.bz2'
-echo "58b8a6885822e55f365c99131c906f16ceaaf657c566e10f410d026704cad157  jigdo-bin-0.7.3.tar.bz2" | sha256sum -c -
-tar xf jigdo-bin-0.7.3.tar.bz2 jigdo-bin-0.7.3/jigdo-file
-mv jigdo-bin-0.7.3/jigdo-file /usr/local/bin/
-rm -rf jigdo-bin-*
diff --git a/docker-ce/Dockerfile b/docker-ce/Dockerfile
index a4e1135..2142b1c 100644
--- a/docker-ce/Dockerfile
+++ b/docker-ce/Dockerfile
@@ -1,7 +1,9 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Keyu Tao <taoky@ustclug.org>"
-RUN apk add --no-cache --update wget perl ca-certificates git python3 py3-requests py3-pip py3-lxml && \
-    pip3 install pyquery && \
-    mkdir -p /usr/local/lib/tunasync
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache --update wget perl ca-certificates git python3 py3-requests py3-pip py3-lxml
+    pip3 install pyquery
+EOF
 ADD tunasync /usr/local/lib/tunasync
 ADD sync.sh /
diff --git a/fedora/Dockerfile b/fedora/Dockerfile
index dc1d73e..29fbe60 100644
--- a/fedora/Dockerfile
+++ b/fedora/Dockerfile
@@ -1,7 +1,10 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Shengjing Zhu <zsj950618@gmail.com>"
 LABEL bind_support=true
-RUN apk add --no-cache zsh curl rsync ca-certificates gawk grep bzip2 coreutils diffutils findutils \
-    && curl -fLo /usr/local/bin/quick-fedora-mirror https://pagure.io/quick-fedora-mirror/raw/master/f/quick-fedora-mirror \
-    && chmod +x /usr/local/bin/quick-fedora-mirror
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache zsh curl rsync ca-certificates gawk grep bzip2 coreutils diffutils findutils
+    curl -fLo /usr/local/bin/quick-fedora-mirror https://pagure.io/quick-fedora-mirror/raw/master/f/quick-fedora-mirror
+    chmod +x /usr/local/bin/quick-fedora-mirror
+EOF
 ADD ["pre-sync.sh", "sync.sh", "/"]
diff --git a/ghcup/Dockerfile b/ghcup/Dockerfile
index 53fc7ff..d9523b0 100644
--- a/ghcup/Dockerfile
+++ b/ghcup/Dockerfile
@@ -1,4 +1,22 @@
 FROM ustcmirror/base:debian
 LABEL maintainer="Kai Ma <ksqsf@mail.ustc.edu.cn>"
-ADD ["sync.sh", "prepare.sh", "ghcupsync.hs", "/"]
-RUN bash /prepare.sh && rm prepare.sh
+ADD ["sync.sh", "ghcupsync.hs", "/"]
+RUN --mount=type=cache,sharing=locked,target=/var/cache/apt \
+    --mount=type=cache,sharing=locked,target=/var/lib/apt <<EOF
+#!/bin/bash
+
+HASKELL_DEPS="ghc libghc-aeson-dev libghc-lens-dev libghc-lens-aeson-dev \
+              libghc-network-uri-dev libghc-split-dev libghc-typed-process-dev \
+              libghc-yaml-dev"
+# Please use ldd to check the dependencies of compiled binary
+HASKELL_KEEP="libyaml-0-2"
+
+apt-get update
+apt-get install -y aria2 ca-certificates git curl $HASKELL_DEPS $HASKELL_KEEP
+
+# compile with Haskell language extensions
+ghc -O2 -XScopedTypeVariables -XOverloadedStrings ghcupsync.hs
+
+rm -rf /ghcupsync.* && apt-get purge -y --auto-remove $HASKELL_DEPS
+
+EOF
diff --git a/ghcup/prepare.sh b/ghcup/prepare.sh
deleted file mode 100644
index e92b893..0000000
--- a/ghcup/prepare.sh
+++ /dev/null
@@ -1,16 +0,0 @@
-#!/bin/bash
-set -e
-
-HASKELL_DEPS="ghc libghc-aeson-dev libghc-lens-dev libghc-lens-aeson-dev \
-              libghc-network-uri-dev libghc-split-dev libghc-typed-process-dev \
-              libghc-yaml-dev"
-# Please use ldd to check the dependencies of compiled binary
-HASKELL_KEEP="libyaml-0-2"
-
-apt-get update
-apt-get install -y aria2 ca-certificates git curl $HASKELL_DEPS $HASKELL_KEEP
-
-# compile with Haskell language extensions
-ghc -O2 -XScopedTypeVariables -XOverloadedStrings ghcupsync.hs
-
-rm -rf /ghcupsync.* && apt-get purge -y --auto-remove $HASKELL_DEPS && rm -rf /var/lib/apt/lists/*
diff --git a/github-release/Dockerfile b/github-release/Dockerfile
index 6230eb7..0a5a93f 100644
--- a/github-release/Dockerfile
+++ b/github-release/Dockerfile
@@ -1,7 +1,6 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Yulong Ming <myl.ustc@gmail.com>"
 LABEL bind_support=true
-RUN apk add --no-cache python3 py3-requests py3-yaml && \
-    mkdir -p /usr/local/lib/tunasync
+RUN apk add --no-cache python3 py3-requests py3-yaml
 ADD tunasync /usr/local/lib/tunasync
 ADD sync.sh /
diff --git a/google-repo/Dockerfile b/google-repo/Dockerfile
index f10c9a4..aa8bf30 100644
--- a/google-repo/Dockerfile
+++ b/google-repo/Dockerfile
@@ -1,6 +1,9 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Keyu Tao <taoky AT lug.ustc.edu.cn>"
-RUN apk add --no-cache git curl python3 openssh-client gnupg && \
-    curl -fLo /usr/local/bin/repo https://storage.googleapis.com/git-repo-downloads/repo && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache git curl python3 openssh-client gnupg
+    curl -fLo /usr/local/bin/repo https://storage.googleapis.com/git-repo-downloads/repo
     chmod +x /usr/local/bin/repo
+EOF
 ADD ["pre-sync.sh", "sync.sh", "/"]
diff --git a/gsutil-rsync/Dockerfile b/gsutil-rsync/Dockerfile
index 211c11a..955d384 100644
--- a/gsutil-rsync/Dockerfile
+++ b/gsutil-rsync/Dockerfile
@@ -1,9 +1,10 @@
 FROM ustcmirror/base:alpine
 LABEL maintainer="Yao Wei (魏銘廷) <mwei@lxde.org>"
 
-RUN apk add --no-cache python3 py-setuptools openssl libffi && \
-    apk add --no-cache --virtual .build-deps gcc musl-dev python3-dev py3-pip openssl-dev libffi-dev && \
-    pip3 install --upgrade pip && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache python3 py-setuptools openssl libffi py3-pip
+    pip3 install --upgrade pip
     pip3 --no-cache-dir install gsutil
-
+EOF
 ADD pre-sync.sh sync.sh /
diff --git a/julia-storage/Dockerfile b/julia-storage/Dockerfile
index 654c380..f927e5e 100644
--- a/julia-storage/Dockerfile
+++ b/julia-storage/Dockerfile
@@ -2,11 +2,14 @@
 FROM ustcmirror/base:alpine
 
 ENV JULIA_DEPOT_PATH="/opt/julia/depot"
-RUN apk update && apk add --no-cache curl python3 gnupg py3-pip && \
-        pip3 install jill && jill install 1.5 --confirm && \
-        ln -s /opt/julias/julia-1.5 /opt/julia && \
-        julia -e 'using Pkg; pkg"add StorageMirrorServer@0.2.1"' && \
-        chmod a+rx -R $JULIA_DEPOT_PATH
+RUN <<EOF
+    apk update
+    apk add --no-cache curl python3 gnupg py3-pip
+    pip3 install jill && jill install 1.5 --confirm
+    ln -s /opt/julias/julia-1.5 /opt/julia
+    julia -e 'using Pkg; pkg"add StorageMirrorServer@0.2.1"'
+    chmod a+rx -R $JULIA_DEPOT_PATH
+EOF
 
 ADD startup.jl /opt/julia/etc/julia/startup.jl
 ADD ["pre-sync.sh", "sync.sh", "/"]
diff --git a/nix-channels/Dockerfile b/nix-channels/Dockerfile
index 42f16e2..a240637 100644
--- a/nix-channels/Dockerfile
+++ b/nix-channels/Dockerfile
@@ -1,17 +1,19 @@
 FROM ustcmirror/base:alpine
 
-RUN \
+RUN <<EOF
+    set -euo pipefail
     # Install Nix. To simplify management we only copy binaries and create
     # symlinks, and do no further configuration
-    wget https://nixos.org/releases/nix/nix-2.3.2/nix-2.3.2-x86_64-linux.tar.xz -O /tmp/nix.tar.xz && \
-    mkdir /tmp/nix.unpack && \
-    tar xpf /tmp/nix.tar.xz -C /tmp/nix.unpack && \
-    mkdir /nix && \
-    cp -dpr /tmp/nix.unpack/*/store /nix/store && \
-    ln -s /nix/store/*-nix-*/bin/* /usr/local/bin && \
-    rm -rf /tmp/nix.tar.xz /tmp/nix.unpack && \
+    wget https://nixos.org/releases/nix/nix-2.3.2/nix-2.3.2-x86_64-linux.tar.xz -O /tmp/nix.tar.xz
+    mkdir /tmp/nix.unpack
+    tar xpf /tmp/nix.tar.xz -C /tmp/nix.unpack
+    mkdir /nix
+    cp -dpr /tmp/nix.unpack/*/store /nix/store
+    ln -s /nix/store/*-nix-*/bin/* /usr/local/bin
+    rm -rf /tmp/nix.tar.xz /tmp/nix.unpack
     # ca-certificates required by nix
-    apk add --no-cache ca-certificates python3 py3-requests py3-pip py3-lxml py3-tz && \
+    apk add --no-cache ca-certificates python3 py3-requests py3-pip py3-lxml py3-tz
     pip3 install pyquery minio==6.0.2
+EOF
 
 ADD [ "sync.sh", "nix-channels.py", "/" ]
diff --git a/pypi/Dockerfile b/pypi/Dockerfile
index c8aa646..94c6bf8 100644
--- a/pypi/Dockerfile
+++ b/pypi/Dockerfile
@@ -4,7 +4,10 @@ ENV PYPI_MASTER=https://pypi.python.org \
     BANDERSNATCH_WORKERS=3 \
     BANDERSNATCH_STOP_ON_ERROR=true \
     BANDERSNATCH_TIMEOUT=20
-RUN apk add --no-cache python3 python3-dev py3-pip musl-dev gcc libxml2 libxslt libxml2-dev libxslt-dev && \
-    pip3 --no-cache-dir install bandersnatch && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache python3 python3-dev py3-pip musl-dev gcc libxml2 libxslt libxml2-dev libxslt-dev
+    pip3 --no-cache-dir install bandersnatch
     apk del --purge python3-dev musl-dev gcc libxml2-dev libxslt-dev
+EOF
 ADD sync.sh pre-sync.sh /
diff --git a/rclone/Dockerfile b/rclone/Dockerfile
index fbb2367..942b5dd 100644
--- a/rclone/Dockerfile
+++ b/rclone/Dockerfile
@@ -6,10 +6,13 @@ ARG RCLONE_VERSION=v1.50.2
 ENV RCLONE_DELETE_AFTER=true \
     RCLONE_DELETE_EXCLUDED=true
 
-RUN apk add --no-cache wget ca-certificates && \
-    cd /tmp/ && wget -q "https://downloads.rclone.org/$RCLONE_VERSION/rclone-$RCLONE_VERSION-linux-amd64.zip" && \
-    unzip /tmp/rclone*.zip && \
-    mv /tmp/rclone-*/rclone /usr/local/bin/ && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache wget ca-certificates
+    cd /tmp/ && wget -q "https://downloads.rclone.org/$RCLONE_VERSION/rclone-$RCLONE_VERSION-linux-amd64.zip"
+    unzip /tmp/rclone*.zip
+    mv /tmp/rclone-*/rclone /usr/local/bin/
     rm -rf /tmp/* && apk del wget
+EOF
 
 ADD sync.sh /
diff --git a/shadowmire/Dockerfile b/shadowmire/Dockerfile
index 4b4ce34..3c41d34 100644
--- a/shadowmire/Dockerfile
+++ b/shadowmire/Dockerfile
@@ -2,10 +2,13 @@ FROM ustcmirror/base:alpine
 LABEL maintainer="Keyu Tao <taoky AT ustclug.org>"
 ARG COMMIT=0a6a958e49ed1ce287596f04414fc21faf4ffac8
 
-RUN apk add --no-cache wget ca-certificates python3 py3-click py3-requests py3-tqdm && \
-    cd /tmp/ && wget -q "https://raw.githubusercontent.com/taoky/shadowmire/$COMMIT/shadowmire.py" && \
-    mv /tmp/shadowmire.py /usr/local/bin/shadowmire && \
-    chmod +x /usr/local/bin/shadowmire && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache wget ca-certificates python3 py3-click py3-requests py3-tqdm
+    cd /tmp/ && wget -q "https://raw.githubusercontent.com/taoky/shadowmire/$COMMIT/shadowmire.py"
+    mv /tmp/shadowmire.py /usr/local/bin/shadowmire
+    chmod +x /usr/local/bin/shadowmire
     rm -rf /tmp/* && apk del wget
+EOF
 
 ADD sync.sh /
diff --git a/stackage/Dockerfile b/stackage/Dockerfile
index c79bbe0..9e4efca 100644
--- a/stackage/Dockerfile
+++ b/stackage/Dockerfile
@@ -1,5 +1,20 @@
 FROM ustcmirror/base:debian
 LABEL maintainer="Jiahao Li <gloit042@gmail.com>"
 LABEL maintainer="Keyu Tao <taoky@ustclug.org>"
-ADD ["sync.sh", "prepare.sh", "stackage.hs", "/"]
-RUN bash /prepare.sh && rm prepare.sh
+ADD ["sync.sh", "stackage.hs", "/"]
+RUN --mount=type=cache,sharing=locked,target=/var/cache/apt \
+    --mount=type=cache,sharing=locked,target=/var/lib/apt <<EOF
+#!/bin/bash
+
+HASKELL_DEPS="ghc libghc-yaml-dev libghc-process-extras-dev \
+              libghc-aeson-dev libghc-split-dev"
+# Please use ldd to check the dependencies of compiled binary
+HASKELL_KEEP="libyaml-0-2"
+
+apt-get update
+apt-get install -y aria2 ca-certificates git $HASKELL_DEPS $HASKELL_KEEP
+ghc -O2 stackage.hs
+
+rm -rf stackage.* && apt-get purge --auto-remove -y $HASKELL_DEPS
+
+EOF
diff --git a/stackage/prepare.sh b/stackage/prepare.sh
deleted file mode 100755
index 53fc91c..0000000
--- a/stackage/prepare.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/bash
-set -e
-
-HASKELL_DEPS="ghc libghc-yaml-dev libghc-process-extras-dev \
-              libghc-aeson-dev libghc-split-dev"
-# Please use ldd to check the dependencies of compiled binary
-HASKELL_KEEP="libyaml-0-2"
-
-apt-get update
-apt-get install -y aria2 ca-certificates git $HASKELL_DEPS $HASKELL_KEEP
-ghc -O2 stackage.hs
-
-rm -rf stackage.* && apt-get purge --auto-remove -y $HASKELL_DEPS && rm -rf /var/lib/apt/lists/*
diff --git a/tsumugu/Dockerfile b/tsumugu/Dockerfile
index 86d4398..0ae7b27 100644
--- a/tsumugu/Dockerfile
+++ b/tsumugu/Dockerfile
@@ -3,10 +3,13 @@ LABEL maintainer="Keyu Tao <taoky AT ustclug.org>"
 LABEL bind_support=true
 ARG TSUMUGU_VERSION=20240811
 
-RUN apk add --no-cache wget ca-certificates && \
-    cd /tmp/ && wget -q "https://github.com/taoky/tsumugu/releases/download/${TSUMUGU_VERSION}/tsumugu" && \
-    mv /tmp/tsumugu /usr/local/bin/ && \
-    chmod +x /usr/local/bin/tsumugu && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache wget ca-certificates
+    cd /tmp/ && wget -q "https://github.com/taoky/tsumugu/releases/download/${TSUMUGU_VERSION}/tsumugu"
+    mv /tmp/tsumugu /usr/local/bin/
+    chmod +x /usr/local/bin/tsumugu
     rm -rf /tmp/* && apk del wget
+EOF
 
 ADD sync.sh /
diff --git a/winget-source/Dockerfile b/winget-source/Dockerfile
index d413c7a..f59334c 100644
--- a/winget-source/Dockerfile
+++ b/winget-source/Dockerfile
@@ -5,9 +5,13 @@ LABEL bind_support=true
 RUN apk add --no-cache nodejs
 
 ADD ["package.json", "package-lock.json", "/"]
-RUN apk add --no-cache npm python3 && \
-    npm ci --prefix / --only=production && \
-    npm cache clean --force && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache npm python3
+    npm ci --prefix / --only=production
+    npm cache clean --force
     apk del --purge --no-cache npm python3
+EOF
+RUN 
 
 ADD ["sync.sh", "sync-repo.js", "sysexits.js", "utilities.js", "/"]
diff --git a/yukina/Dockerfile b/yukina/Dockerfile
index 4b46a78..e2b4e0a 100644
--- a/yukina/Dockerfile
+++ b/yukina/Dockerfile
@@ -3,10 +3,13 @@ LABEL maintainer="Keyu Tao <taoky AT ustclug.org>"
 LABEL bind_support=true
 ARG YUKINA_VERSION=20240811
 
-RUN apk add --no-cache wget ca-certificates zstd && \
-    cd /tmp/ && wget -q "https://github.com/taoky/yukina/releases/download/${YUKINA_VERSION}/yukina" && \
-    mv /tmp/yukina /usr/local/bin/ && \
-    chmod +x /usr/local/bin/yukina && \
+RUN <<EOF
+    set -euo pipefail
+    apk add --no-cache wget ca-certificates zstd
+    cd /tmp/ && wget -q "https://github.com/taoky/yukina/releases/download/${YUKINA_VERSION}/yukina"
+    mv /tmp/yukina /usr/local/bin/
+    chmod +x /usr/local/bin/yukina
     rm -rf /tmp/* && apk del wget
+EOF
 
 ADD sync.sh /