Metadata

Id: dockerfile-copy-with-more-than-two-arguments-not-ending-with-slash

Platform: Dockerfile

Severity: Low

Category: Build Process

Learn More

• Provider Reference

Description

COPY commands that reference a storage path must end directory arguments with a trailing slash so the command targets the intended directory prefix rather than a single object. Omitting the slash can lead to ambiguous file selection and accidental inclusion or exclusion of files, causing data integrity problems or unintended data exposure.

This check inspects COPY commands with more than two arguments and verifies that the final argument (the source path) ends with a / character. Resources where the command has more than two elements and the last element does not end with / will be flagged. Ensure the source path is explicitly a directory by including the trailing slash. For example:

COPY INTO my_table FROM 's3://my-bucket/path/' CREDENTIALS=...;

Compliant Code Examples

FROM node:carbon
COPY package.json yarn.lock my_app/

FROM node:carbon1
COPY package.json yarn.lock

FROM ghcr.io/astral-sh/uv:0.9.2-python3.13-bookworm-slim AS builder
ENV TARGET_DIR="/mcp_tests"
COPY uv.lock pyproject.toml "${TARGET_DIR}/"

Non-Compliant Code Examples

FROM node:carbon2
COPY package.json yarn.lock my_app