dockerfile
r2cSelected rules from Hadolint, a Dockerfile linter, rewritten in Semgrep.
Run Locally
Rules (5)
returntocorpThe last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.
returntocorpThe last user in the container is 'root'. This is a security hazard because if an attacker gains control of the container they will have root access. Switch back to another user after running commands as 'root'.
returntocorpBy not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
returntocorpBy not specifying a USER, a program in the container may run as 'root'. This is a security hazard. If an attacker can control a process running as root, they may have control over the container. Ensure that the last USER in a Dockerfile is a USER other than 'root'.
returntocorpThis 'zypper install' is missing the '-y' switch. This might stall builds because it requires human intervention. Add the '-y' switch.