This rule enforces that the COPY instruction must reference a valid build stage alias defined by a preceding FROM statement using the as keyword. Specifically, the --from flag in COPY should only point to an existing build stage alias, ensuring that the source files are correctly retrieved from the intended build context.
To avoid violations, always declare build stages with FROM <image> as <alias> before using COPY --from=<alias>. Verify that the alias used in COPY matches exactly with the alias declared in the earlier FROM statement. For example, using FROM debian:jesse as build followed by COPY --from=build ... ensures compliance and reliable builds.
Non-Compliant Code Examples
FROM debian:jesse as buildCOPY --from=build some stuff ./
Compliant Code Examples
FROM debian:jesse as buildRUN stuffFROM debian:jesseCOPY --from=build some stuff ./
シームレスな統合。 Datadog Code Security をお試しください
Datadog Code Security
このルールを試し、Datadog Code Security でコードを解析する
このルールの使用方法
1
2
rulesets:- docker-best-practices # Rules to enforce Docker best practices.
