docker/trivy-config
Scans Dockerfiles for HIGH and CRITICAL misconfigurations, including a root user and exposed secrets.
Part of the docker configuration, at the recommended level. It runs at the push stage, once per scope. It runs trivy.
A root user turns any bug in the service into full control of the container.
What to do
Section titled “What to do”Change the file the way the message says. Accept one advisory with gspot ignore docker/trivy-config --rule <id> --reason "...".
Example
Section titled “Example”A Dockerfile whose final stage runs as root reports a finding. Create an unprivileged user, and switch to it with USER before the application starts.
Turn it off
Section titled “Turn it off”Turn it off for some files, or one of its lint rules, with a reason:
gspot ignore docker/trivy-config --paths "<glob>" --reason "<why>"gspot ignore docker/trivy-config --rule <rule> --reason "<why>"