Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Scratch Base Accepted for Docker Checks #2512

Merged
merged 4 commits into from
Feb 21, 2022
Merged

Scratch Base Accepted for Docker Checks #2512

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6f29c27
resolve checkov-1764
njgibbon Jan 17, 2022
c8153f4
Merge remote-tracking branch 'upstream/master'
njgibbon Jan 17, 2022
d8ff62b
conflict
njgibbon Feb 21, 2022
0c86529
fix - enable usage of scratch as valid safe docker image
njgibbon Feb 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion checkov/dockerfile/checks/ReferenceLatestTag.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ def scan_entity_conf(self, conf):
base_image = multi_stage[1]
stages.append(multi_stage[2])

if ":" not in base_image and base_image not in stages:
if ":" not in base_image and base_image not in stages and base_image != "scratch":
return CheckResult.FAILED, content
elif base_image.endswith(":latest"):
return CheckResult.FAILED, content
Expand Down
5 changes: 5 additions & 0 deletions tests/dockerfile/checks/example_ReferenceLatestTag/success_multi_stage_scratch/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
FROM scratch as base
COPY test.sh /test.sh

FROM base
LABEL maintainer=checkov
1 change: 1 addition & 0 deletions tests/dockerfile/checks/example_ReferenceLatestTag/success_scratch/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
FROM scratch
7 changes: 5 additions & 2 deletions tests/dockerfile/checks/test_ReferenceLatestTag.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,11 @@ def test(self):
passing_resources = {
"/success/Dockerfile.",
"/success_multi_stage/Dockerfile.",
"/success_multi_stage_capital/Dockerfile."
"/success_multi_stage_capital/Dockerfile.",
"/success_scratch/Dockerfile.",
"/success_multi_stage_scratch/Dockerfile."
}

failing_resources = {
"/failure_default_version_tag/Dockerfile.FROM",
"/failure_latest_version_tag/Dockerfile.FROM",
Expand All @@ -28,7 +31,7 @@ def test(self):
passed_check_resources = set([c.resource for c in report.passed_checks])
failed_check_resources = set([c.resource for c in report.failed_checks])

self.assertEqual(summary["passed"], 3)
self.assertEqual(summary["passed"], 5)
self.assertEqual(summary["failed"], 2)
self.assertEqual(summary["skipped"], 0)
self.assertEqual(summary["parsing_errors"], 0)
Expand Down