trivy misconfiguration scan flags the same unpinned-base/root-user issues as hadolint, plus a missing HEALTHCHECK on two Dockerfiles

[laywill]

trivy's Dockerfile misconfiguration scanner (0.73.0) raises 8 findings across all four Dockerfiles in the repo, including tests/linux-checks.Dockerfile, which hadolint doesn't flag at all. Two of the three rules involved — unpinned FROM tag and root as the final user — are the same underlying issues hadolint already reports for default.Dockerfile and default.github.Dockerfile; the third, a missing HEALTHCHECK, is new and only fires on default.gitlab.Dockerfile and tests/linux-checks.Dockerfile.

trivy 0.73.0 report (progress-bar/DB-download noise omitted)

Report Summary

┌───────────────────────────────────────────────────────────────────────┬────────────┬─────────────────┬───────────────────┐
│                                Target                                 │    Type    │ Vulnerabilities │ Misconfigurations │
├───────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ src/usr/local/emhttp/plugins/ci-runner-farm/default.Dockerfile        │ dockerfile │        -        │         2         │
├───────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ src/usr/local/emhttp/plugins/ci-runner-farm/default.github.Dockerfile │ dockerfile │        -        │         2         │
├───────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ src/usr/local/emhttp/plugins/ci-runner-farm/default.gitlab.Dockerfile │ dockerfile │        -        │         2         │
├───────────────────────────────────────────────────────────────────────┼────────────┼─────────────────┼───────────────────┤
│ tests/linux-checks.Dockerfile                                         │ dockerfile │        -        │         2         │
└───────────────────────────────────────────────────────────────────────┴────────────┴─────────────────┴───────────────────┘

src/usr/local/emhttp/plugins/ci-runner-farm/default.Dockerfile (dockerfile)
DS-0001 (MEDIUM): Specify a tag in the 'FROM' statement for image 'myoung34/github-runner'
 src/usr/local/emhttp/plugins/ci-runner-farm/default.Dockerfile:8
   8 [ FROM myoung34/github-runner:latest

DS-0002 (HIGH): Last USER command in Dockerfile should not be 'root'
 src/usr/local/emhttp/plugins/ci-runner-farm/default.Dockerfile:10
  10 [ USER root

src/usr/local/emhttp/plugins/ci-runner-farm/default.github.Dockerfile (dockerfile)
DS-0001 (MEDIUM): Specify a tag in the 'FROM' statement for image 'myoung34/github-runner'
 src/usr/local/emhttp/plugins/ci-runner-farm/default.github.Dockerfile:8
   8 [ FROM myoung34/github-runner:latest

DS-0002 (HIGH): Last USER command in Dockerfile should not be 'root'
 src/usr/local/emhttp/plugins/ci-runner-farm/default.github.Dockerfile:10
  10 [ USER root

src/usr/local/emhttp/plugins/ci-runner-farm/default.gitlab.Dockerfile (dockerfile)
DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile

tests/linux-checks.Dockerfile (dockerfile)
DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile

Overlap with hadolint

For default.Dockerfile and default.github.Dockerfile, trivy's DS-0001 and DS-0002 are the same two facts as hadolint's DL3007 and DL3002 (unpinned myoung34/github-runner:latest, USER root as the last user) — same lines, same underlying Dockerfile content, different tool. If that pair is filed and resolved separately (see the hadolint issue), these two files should come out clean here too without any trivy-specific work.

default.gitlab.Dockerfile and tests/linux-checks.Dockerfile are different: neither has an explicit USER instruction at all, so they default to root, which is what trivy's DS-0002 phrasing ("Specify at least 1 USER command... with non-root user as argument") is reporting here — a different variant of the same rule than the "last USER should not be root" case above. hadolint has nothing to say about either file for this: default.gitlab.Dockerfile gets a clean bill from hadolint (bar the unrelated DL3008 apt-pinning finding), and tests/linux-checks.Dockerfile gets no hadolint findings at all.

DS-0026: missing HEALTHCHECK

Only on default.gitlab.Dockerfile and tests/linux-checks.Dockerfile. default.Dockerfile/default.github.Dockerfile already ship one (HEALTHCHECK --start-period=120s ... calling a generated runner-healthcheck.sh), which is presumably why trivy doesn't flag those two.

• default.gitlab.Dockerfile builds a job image (CMD ["/bin/bash"]) that GitLab Runner's Docker executor starts fresh per job and tears down when the job finishes — there's no long-running process for a HEALTHCHECK to poll, so I'd suppress this one rather than add a check that has nothing to check.
• tests/linux-checks.Dockerfile is a one-shot CI build image (RUN bash tests/check.sh as the last step, no long-running CMD) — same reasoning applies.

I haven't found a case in this repo where HEALTHCHECK on either image would do anything, but I'm flagging that as a read rather than something I've stress-tested against every way these images get used.

Suggested fix

Fixing the hadolint issue's DL3007/DL3002 findings resolves the trivy overlap on default.Dockerfile/default.github.Dockerfile as a side effect. For the remainder:

# .mega-linter.yml
REPOSITORY_TRIVY_ARGUMENTS: "--misconfig-scanners dockerfile --skip-check DS0002 --skip-check DS0026"

or the narrower per-file # trivy:ignore:DS-0002 / # trivy:ignore:DS-0026 comments directly above the FROM line in default.gitlab.Dockerfile and tests/linux-checks.Dockerfile, if per-file scoping is preferred over a repo-wide argument. I haven't verified the exact inline-ignore comment syntax trivy's Dockerfile scanner expects against this specific trivy version — worth confirming against --misconfig-scanners dockerfile docs before landing it, the REPOSITORY_TRIVY_ARGUMENTS route is the one I'm confident is correct.

I can open a PR for the suppressions once the hadolint issue's USER root/pinning questions are settled, since this one is mostly downstream of that.