Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(misconf): add support of buildkit instructions when building dockerfile from image config #5990

Conversation

DmitriyLewen
Copy link
Contributor

Description

Buildkit has different format for COPY, ADD and RUN commands:

➜ cat Dockerfile 
FROM alpine

ADD ./foo.txt /foo.txt
COPY ./foo /foo
RUN ls -hl /foo
USER foo
HEALTHCHECK --interval=10s --timeout=3s --retries=0 CMD curl -sS 127.0.0.1 || exit 1%   

➜ docker image history 5989
IMAGE          CREATED             CREATED BY                                      SIZE      COMMENT
19c56c9f1c3c   About an hour ago   HEALTHCHECK &{["CMD-SHELL" "curl -sS 127.0.0…   0B        buildkit.dockerfile.v0
<missing>      About an hour ago   USER foo                                        0B        buildkit.dockerfile.v0
<missing>      About an hour ago   RUN /bin/sh -c ls -hl /foo # buildkit           0B        buildkit.dockerfile.v0
<missing>      About an hour ago   COPY ./foo /foo # buildkit                      3B        buildkit.dockerfile.v0
<missing>      About an hour ago   ADD ./foo.txt /foo.txt # buildkit               3B        buildkit.dockerfile.v0
<missing>      7 months ago        /bin/sh -c #(nop)  CMD ["/bin/sh"]              0B        
<missing>      7 months ago        /bin/sh -c #(nop) ADD file:289c2fac17119508c…   7.66MB  

We need to add support for these formats when decoding image config into the dockerfile to detect incorrect configurations.

Related issues

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

@DmitriyLewen DmitriyLewen self-assigned this Jan 24, 2024
@DmitriyLewen DmitriyLewen marked this pull request as ready for review January 24, 2024 10:28
@knqyf263 knqyf263 added this pull request to the merge queue Jan 25, 2024
Merged via the queue into aquasecurity:main with commit adfde63 Jan 25, 2024
12 checks passed
@DmitriyLewen DmitriyLewen deleted the feat/buildkit-support-for-imgconfig-dockerfile branch February 6, 2024 04:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

feat(image): Buildkit support for misconfiguration scanning
2 participants