False alarm of USER command in Dockerfile for docker-cis compliance

[chrisleekr]

Description

When I run the command to get docker-cis, I am getting the following error, which is not true.

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Desired Behavior

No error for USER command

Actual Behavior

Error with USER command

Reproduction Steps

1. Create a Dockerfile

FROM node:16-alpine3.16

# Set Dockerfile user as node
RUN chown node:node /srv
USER node

WORKDIR /srv

2. Build a docker image

docker build --pull --no-cache -t trivy-test:latest

3. Run trivy

trivy image --exit-code 1 -s HIGH,CRITICAL --compliance docker-cis --report all trivy-test:latest


2023-05-17T13:52:53.804+1000	INFO	Container image config scanners: ["config" "secret"]
2023-05-17T13:52:53.804+1000	INFO	Vulnerability scanning is enabled
2023-05-17T13:52:53.804+1000	INFO	Misconfiguration scanning is enabled
2023-05-17T13:52:55.266+1000	INFO	Detected OS: alpine
2023-05-17T13:52:55.266+1000	INFO	Detecting Alpine vulnerabilities...
2023-05-17T13:52:55.266+1000	INFO	Number of language-specific files: 1
2023-05-17T13:52:55.266+1000	INFO	Detecting node-pkg vulnerabilities...
2023-05-17T13:52:55.268+1000	INFO	Detected config files: 1

trivy-test:latest (dockerfile)

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Target

Container Image

Scanner

Misconfiguration

Output Format

Table

Mode

Standalone

Debug Output

trivy image --debug --exit-code 1 -s HIGH,CRITICAL --compliance docker-cis --report all trivy-test:latest

2023-05-17T13:56:37.668+1000	DEBUG	Severities: ["HIGH" "CRITICAL"]
2023-05-17T13:56:37.677+1000	DEBUG	cache dir:  /Users/chrislee/Library/Caches/trivy
2023-05-17T13:56:37.677+1000	DEBUG	DB update was skipped because the local DB is the latest
2023-05-17T13:56:37.677+1000	DEBUG	DB Schema: 2, UpdatedAt: 2023-05-17 00:11:32.87015838 +0000 UTC, NextUpdate: 2023-05-17 06:11:32.87015798 +0000 UTC, DownloadedAt: 2023-05-17 01:28:57.506716 +0000 UTC
2023-05-17T13:56:37.677+1000	INFO	Container image config scanners: ["config" "secret"]
2023-05-17T13:56:37.677+1000	INFO	Vulnerability scanning is enabled
2023-05-17T13:56:37.677+1000	DEBUG	Vulnerability type:  [os library]
2023-05-17T13:56:37.677+1000	INFO	Misconfiguration scanning is enabled
2023-05-17T13:56:37.678+1000	DEBUG	Policies successfully loaded from disk
2023-05-17T13:56:37.724+1000	DEBUG	Image ID: sha256:1feabaa226aafbfb2af2d206743fbacf26aa92343dbbd46fe03edb74f1cc20d3
2023-05-17T13:56:37.724+1000	DEBUG	Diff IDs: [sha256:dc65b23a4b7c4b9ed9f634d3a1dd4cc10bbf0251e85480648acf7f22061b3949 sha256:bfaeed9de01182bb5f041142b463ecdd08562e201ec518ab85ee610363e89e7a sha256:f70ccc0ca0f8e8bcf56916f5df22dd3495cfc3cac3e19243ac47922f384dc226 sha256:b774e90beaf7a777a35048a6ead2c3bf72533fffb8bcc94c3740721b433efd5a sha256:959b484e6cbfa28b4561546bd6f34f3540714756053de328a22eaabef82bf44c sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef]
2023-05-17T13:56:37.724+1000	DEBUG	Base Layers: [sha256:dc65b23a4b7c4b9ed9f634d3a1dd4cc10bbf0251e85480648acf7f22061b3949 sha256:bfaeed9de01182bb5f041142b463ecdd08562e201ec518ab85ee610363e89e7a sha256:f70ccc0ca0f8e8bcf56916f5df22dd3495cfc3cac3e19243ac47922f384dc226 sha256:b774e90beaf7a777a35048a6ead2c3bf72533fffb8bcc94c3740721b433efd5a]
2023-05-17T13:56:37.768+1000	INFO	Detected OS: alpine
2023-05-17T13:56:37.768+1000	INFO	Detecting Alpine vulnerabilities...
2023-05-17T13:56:37.768+1000	DEBUG	alpine: os version: 3.16
2023-05-17T13:56:37.768+1000	DEBUG	alpine: package repository: 3.16
2023-05-17T13:56:37.768+1000	DEBUG	alpine: the number of packages: 16
2023-05-17T13:56:37.769+1000	INFO	Number of language-specific files: 1
2023-05-17T13:56:37.769+1000	INFO	Detecting node-pkg vulnerabilities...
2023-05-17T13:56:37.769+1000	DEBUG	Detecting library vulnerabilities, type: node-pkg, path:
2023-05-17T13:56:37.773+1000	INFO	Detected config files: 1
2023-05-17T13:56:37.773+1000	DEBUG	Scanned config file: trivy-test:latest

trivy-test:latest (dockerfile)

Tests: 1 (SUCCESSES: 0, FAILURES: 1, EXCEPTIONS: 0)
Failures: 1 (HIGH: 1, CRITICAL: 0)

HIGH: Specify at least 1 USER command in Dockerfile with non-root user as argument
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Operating System

macOS Ventrua

Version

Version: 0.41.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2023-05-17 00:11:32.87015838 +0000 UTC
  NextUpdate: 2023-05-17 06:11:32.87015798 +0000 UTC
  DownloadedAt: 2023-05-17 01:28:57.506716 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2023-04-02 01:00:15.268533668 +0000 UTC
  NextUpdate: 2023-04-05 01:00:15.268532768 +0000 UTC
  DownloadedAt: 2023-04-02 13:31:44.15727 +0000 UTC
Policy Bundle:
  Digest: sha256:97988c6fc189faa28aa7fc2fc93fb2605c46d2f6ae4092a70e03697ba1d6e620
  DownloadedAt: 2023-05-17 01:28:59.823439 +0000 UTC

Checklist

• Run trivy --reset
• Read the troubleshooting

[knqyf263]

@DmitriyLewen Can you please take a look?

[DmitriyLewen]

Hello @chrisleekr
Thanks for your report!

I created #4428 for this bug.