Pipeline commands executed by POSIX shells must enable the pipefail option so that a failure in any stage of a pipeline makes the whole command fail. Without pipefail, earlier command failures can be masked and CI/build steps or image contents may be left in an inconsistent or insecure state.
This check targets Dockerfile-style instructions: RUN commands that invoke a shell (bash, zsh, ash, /bin/bash, /bin/zsh, /bin/ash) and contain a pipe character (|) must have pipefail enabled either via a preceding SHELL instruction that includes -o pipefail or by enabling it in the RUN command itself. Resources will be flagged when a RUN with a pipeline is present and there is no prior SHELL instruction with -o pipefail and the RUN does not explicitly enable pipefail. PowerShell-style commands are excluded. Fixes include setting a global shell with pipefail or prefixing pipeline commands with set -o pipefail (see examples below).
Secure configuration with a global SHELL in a Dockerfile:
