-
Notifications
You must be signed in to change notification settings - Fork 33
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix(checks): improve argument handling in AVD-DS-0001 #326
Conversation
4aabad1
to
af9834e
Compare
checks/docker/latest_tag_test.rego
Outdated
r[_].msg == "Specify a tag in the 'FROM' statement for image 'foo'" | ||
} | ||
|
||
test_deny_multiply_args if { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
test_deny_multiply_args if { | |
test_deny_multiple_args if { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
r := deny with input as {"Stages": [ | ||
{"Name": "", "Commands": [{ | ||
"Cmd": "arg", | ||
"Value": ["TAG"], |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If the tag doesn't have a value doesn't it default to latest? Or this test is testing another case?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If image ref is alpine:$TAG
and the user has not specified an argument, then by default the argument will be an empty string and image ref will be the invalid string: alpine:
, so we can't say that the latest
tag is being used.
❯ cat Dockerfile
ARG TAG
FROM alpine:$TAG
❯ docker build --no-cache -t test-img . -f Dockerfile
...
--------------------
1 | ARG TAG
2 | >>> FROM alpine:$TAG
--------------------
ERROR: failed to solve: failed to parse stage name "alpine:": invalid reference format
But if the image ref is alpine$TAG
and the user has not specified an argument, then the ref will be equal to alpine
, which is a valid reference and the tag will be equal to latest
.
❯ cat Dockerfile
ARG TAG
FROM alpine$TAG%
❯ docker build --no-cache -t test-img . -f Dockerfile
[+] Building 0.0s (5/5) FINISHED docker:default
=> [internal] load build definition from Dockerfile 0.0s
=> => transferring dockerfile: 60B 0.0s
=> [internal] load metadata for docker.io/library/alpine:latest 0.0s
=> [internal] load .dockerignore 0.0s
=> => transferring context: 2B 0.0s
=> CACHED [1/1] FROM docker.io/library/alpine:latest
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah I see the difference now. Thanks!
Signed-off-by: Nikita Pivkin <[email protected]>
Related issues: