Metadata

ID: docker-best-practices/copy-reference-from

Language: Docker

Severity: Warning

Category: Best Practices

Description

This rule enforces that the COPY instruction must reference a valid build stage alias defined by a preceding FROM statement using the as keyword. Specifically, the --from flag in COPY should only point to an existing build stage alias, ensuring that the source files are correctly retrieved from the intended build context.

To avoid violations, always declare build stages with FROM <image> as <alias> before using COPY --from=<alias>. Verify that the alias used in COPY matches exactly with the alias declared in the earlier FROM statement. For example, using FROM debian:jesse as build followed by COPY --from=build ... ensures compliance and reliable builds.

Non-Compliant Code Examples

FROM debian:jesse as build

COPY --from=build some stuff ./

Compliant Code Examples

FROM debian:jesse as build

RUN stuff

FROM debian:jesse

COPY --from=build some stuff ./

원활한 통합. Datadog Code Security를 경험해 보세요

Datadog Code Security