github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/docker/policies/run_command_cd_instead_of_workdir.rego (about)

     1  # METADATA
     2  # title: "'RUN cd ...' to change directory"
     3  # description: "Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain."
     4  # scope: package
     5  # schemas:
     6  # - input: schema["dockerfile"]
     7  # related_resources:
     8  # - https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#workdir
     9  # custom:
    10  #   id: DS013
    11  #   avd_id: AVD-DS-0013
    12  #   severity: MEDIUM
    13  #   short_code: use-workdir-over-cd
    14  #   recommended_action: "Use WORKDIR to change directory"
    15  #   input:
    16  #     selector:
    17  #     - type: dockerfile
    18  package builtin.dockerfile.DS013
    19  
    20  import data.lib.docker
    21  
    22  get_cd[output] {
    23  	run := docker.run[_]
    24  	parts = regex.split(`\s*&&\s*`, run.Value[_])
    25  	startswith(parts[_], "cd ")
    26  	args := concat(" ", run.Value)
    27  	output := {
    28  		"args": args,
    29  		"cmd": run,
    30  	}
    31  }
    32  
    33  deny[res] {
    34  	output := get_cd[_]
    35  	msg := sprintf("RUN should not be used to change directory: '%s'. Use 'WORKDIR' statement instead.", [output.args])
    36  	res := result.new(msg, output.cmd)
    37  }