Only One Entrypoint false negative

[ArtemkaKun]

IDs

AVD-DS-0007

Description

I think "Only One Entrypoint" check throws false misconfiguration error. I have only one ENTRYPOINT in my Dockerfile. The only second ENTRYPOINT I can think of - is the ENTRYPOINT from the base image, which I believe must be omitted in the check.

Reproduction Steps

Scan the following Dockerfile with the trivy `0.59.1`


FROM aquasec/trivy:0.59.1

RUN addgroup -S scannergroup && adduser -S scanneruser -G scannergroup

USER scanneruser

HEALTHCHECK --timeout=1s --retries=1 CMD trivy --version || exit 1

# NOTE: `--db-repository` is needed because sometimes GHCR hits the rate limit, and AWS will be used instead.
ENTRYPOINT ["trivy", "image", "--db-repository", "ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db", "--format", "table", "--exit-code", "1", "--ignore-unfixed", "--pkg-types", "os,library", "--severity", "CRITICAL,HIGH,MEDIUM,LOW", "--image-config-scanners", "misconfig,secret", "--scanners", "vuln,secret,misconfig"]

Target

Container Image

Scanner

Misconfiguration

Target OS

No response

Debug Output

See https://github.com/Articola-Tools/dockerfile-security-scanner/actions/runs/13185687866/job/36807092534?pr=11

Version

0.59.1

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[simar7]

hi @ArtemkaKun thanks for the report - this looks like a bug to me.

[simar7]

Track #8364