Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature Request: disable and reenable checks for multi-stage builds #2954

Open
sseide opened this issue Jan 29, 2025 · 0 comments
Open

Feature Request: disable and reenable checks for multi-stage builds #2954

sseide opened this issue Jan 29, 2025 · 0 comments
Labels
kind/enhancement New feature or request status/triage

Comments

@sseide
Copy link

sseide commented Jan 29, 2025

Description

Hello,

having some basic checks for Dockerfiles is good and helps developers writing better Dockerfiles.
But for multi-stage builds it might be needed to disable some checks for one stage and (re)enable it for others.

Example:
We use multi-stage builds to not expose some secrets needed to access external systems needed to build an image (Maven/NPM/Python registry and so on). The first stage gets the secret and can access the private registry to download/build the software needed.
The second stage just gets the compiled app and does not have access to the build args of the first stage.

With current check implementation i can either have the "SecretsUsedInArgOrEnv" check enabled complaining about it in the first stage (= false positive) or can disable it and do not see if someone accidentally injects secrets into the second stage (=possible false negative).

Updating the checks to allow switching these on and off for every stage (optional) would help.
Other solution might be to disable checks for only the next line inside the Dockerfile (e.g. similar to //NOSONAR flag for Sonarqube) might be a possible solution too.

Thanks

@sseide sseide added kind/enhancement New feature or request status/triage labels Jan 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/enhancement New feature or request status/triage
Projects
None yet
Development

No branches or pull requests

1 participant