Experiment: Lint Dockerfiles using hadolint

[kke]

Uses https://github.com/hadolint/hadolint

Seems to create quite a lot of issues locally

[github-actions]

Hadolint: failure

images/kube-proxy/v1.28.2/Dockerfile:5 DL3018 warning: Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`
images/kube-proxy/v1.28.2/Dockerfile:12 DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check
images/kube-proxy/v1.28.2/Dockerfile:12 DL3047 info: Avoid use of wget without progress bar. Use `wget --progress=dot:giga <url>`. Or consider using `-q` or `-nv` (shorthands for `--quiet` or `--no-verbose`).
images/kube-proxy/v1.28.2/Dockerfile:33 DL3008 warning: Pin versions in apt get install. Instead of `apt-get install <package>` use `apt-get install <package>=<version>`
images/kube-proxy/v1.28.2/Dockerfile:33 DL3005 error: Do not use apt-get dist-upgrade
images/kube-proxy/v1.28.2/Dockerfile:33 DL3015 info: Avoid additional packages by specifying `--no-install-recommends`
images/kube-proxy/v1.28.2/Dockerfile:55 DL3006 warning: Always tag the version of an image explicitly

[kke]

A bit ugly, I guess it could be scripted to create proper review comments. Maybe https://github.com/reviewdog/action-hadolint would be easier to set up.

[twz123]

Can we disable some warnings?

DL3018 warning: Pin versions in apk add. Instead of apk add <package> use apk add <package>=<version>

You really only want that if you have some bot that maintains the package versions, or if you're using your own mirror. Otherwise, this will break the build, as old packages get garbage collected from the main Alpine repos.

DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check

or disable this check yes, please 😄

DL3008 warning: Pin versions in apt get install. Instead of apt-get install <package> use apt-get install <package>=<version>

Not sure about the Ubuntu package repos. How long do they provide older packages?

[twz123]

I get this is only for testing the workflow added in this PR, but that will also trigger a rebuild when this PR gets merged, overwriting the already built tag in the registry. We need to remove that before merging.