Trivy fails to scan Dockerfile with `1.7-labs` version syntax #8829

nikpivkin · 2025-05-06T09:18:40Z

nikpivkin
May 6, 2025
Maintainer

Description

Trivy failed to scan Dockerfile version 1.7-labs, which adds an --exclude flag for the COPY instruction.

Desired Behavior

Dockerfile scanning will complete without errors

Actual Behavior

Dockerfile scan fails

Reproduction Steps

1. Create `Dockerfile`:

# syntax=docker/dockerfile:1.7-labs

FROM scratch

WORKDIR /app
COPY --exclude=./foo . .


2. Run trivy `trivy conf Dockerfile -d`

Target

Filesystem

Scanner

Misconfiguration

Output Format

None

Mode

None

Debug Output

❯ trivy conf Dockerfile -d
2025-05-06T15:10:31+06:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-05-06T15:10:31+06:00       DEBUG   Cache dir       dir="/Users/nikita/Library/Caches/trivy"
2025-05-06T15:10:31+06:00       DEBUG   Cache dir       dir="/Users/nikita/Library/Caches/trivy"
2025-05-06T15:10:31+06:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-05-06T15:10:31+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2025-05-06T15:10:31+06:00       DEBUG   [misconfig] Checks successfully loaded from disk
2025-05-06T15:10:31+06:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-05-06T15:10:31+06:00       DEBUG   Initializing scan cache...      type="memory"
2025-05-06T15:10:31+06:00       DEBUG   [fs] Analyzing...       root="Dockerfile"
2025-05-06T15:10:31+06:00       DEBUG   [fs] Random cache key will be used      err="failed to open git repository: stat /Users/nikita/projects/trivy-test/docker-cp-excl/Dockerfile/.git: not a directory"
2025-05-06T15:10:31+06:00       DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Dockerfile"
2025-05-06T15:10:31+06:00       ERROR   [dockerfile scanner] Failed to parse file       file_path="Dockerfile" err="parse dockerfile instruction: unknown flag: --exclude"
2025-05-06T15:10:31+06:00       DEBUG   OS is not detected.
2025-05-06T15:10:31+06:00       INFO    Detected config files   num=0
2025-05-06T15:10:31+06:00       DEBUG   Specified ignore file does not exist    file=".trivyignore"
2025-05-06T15:10:31+06:00       DEBUG   [vex] VEX filtering is disabled
2025-05-06T15:10:31+06:00       WARN    [report] Supported files for scanner(s) not found.      scanners=[misconfig]

Report Summary

┌────────┬──────┬───────────────────┐
│ Target │ Type │ Misconfigurations │
├────────┼──────┼───────────────────┤
│   -    │  -   │         -         │
└────────┴──────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

Operating System

macOS

Version

v0.62.0

Checklist

Run trivy clean --all
Read the troubleshooting

nikpivkin · 2025-05-06T09:22:17Z

nikpivkin
May 6, 2025
Maintainer Author

@aquasecurity/trivy labs is an experimental syntax that introduces features and changes that are not stable. Should we support this or ignore the new flags?

5 replies

DmitriyLewen May 6, 2025
Maintainer

It looks like supporting libs syntax will be a challenge for us.
docs say: Stable features in the labs channel follow semantic versioning, but early access features do not, and newer releases may be incompatible with previous versions...

So it looks like we need to support each version and its new features separately (correct me if I'm wrong).

So unless a lot of users have asked for it - I guess we can't support it now.
But it might make sense to add a warning that Trivy doesn't support libs syntax (or that we don't support syntaxes at all (e.g. # syntax=example.com/user/repo:tag@sha256:abcdef...).

nikpivkin Nov 6, 2025
Maintainer Author

@DmitriyLewen Another user encountered a similar problem here: #9758.

In fact, adding support for new flags is very easy; we just need to add some of the moby/buildkit build tags. I opened a PR with an example: #9761 . If the package that parses Dockerfiles allowed ignoring unknown flags, that would be the best approach.

DmitriyLewen Nov 7, 2025
Maintainer

But new github.com/moby/buildkit v0.25.1 supports flags, no?

➜  ./trivy -v
Version: 0.67.0-73-gd70d994d8

➜  ./trivy -d config /Users/dmitriy/work/tmp/8829/Dockerfile
2025-11-07T10:49:12+06:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-11-07T10:49:12+06:00       DEBUG   Cache dir       dir="/Users/dmitriy/Library/Caches/trivy"
2025-11-07T10:49:12+06:00       DEBUG   [cloud] No cloud config file found
2025-11-07T10:49:12+06:00       DEBUG   Cache dir       dir="/Users/dmitriy/Library/Caches/trivy"
2025-11-07T10:49:12+06:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-11-07T10:49:12+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2025-11-07T10:49:12+06:00       DEBUG   [notification] Running version check
2025-11-07T10:49:12+06:00       DEBUG   [misconfig] Checks successfully loaded from disk
2025-11-07T10:49:12+06:00       DEBUG   [rego] Overriding filesystem for checks
2025-11-07T10:49:12+06:00       DEBUG   [rego] Embedded libraries are loaded    count=17
2025-11-07T10:49:12+06:00       DEBUG   [rego] Embedded checks are loaded       count=519
2025-11-07T10:49:12+06:00       DEBUG   [rego] Checks from disk are loaded      count=536
2025-11-07T10:49:12+06:00       DEBUG   [rego] Overriding filesystem for data
2025-11-07T10:49:12+06:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-11-07T10:49:12+06:00       DEBUG   Initializing scan cache...      type="memory"
2025-11-07T10:49:12+06:00       DEBUG   [fs] Analyzing...       root="/Users/dmitriy/work/tmp/8829/Dockerfile"
2025-11-07T10:49:12+06:00       DEBUG   [fs] Random cache key will be used      err="failed to open git repository: stat /Users/dmitriy/work/tmp/8829/Dockerfile/.git: not a directory"
2025-11-07T10:49:12+06:00       DEBUG   Created process-specific temp directory path="/var/folders/8m/p1341n2941jbyc5gm7357x5c0000gn/T/trivy-74729"
2025-11-07T10:49:12+06:00       DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Dockerfile"
2025-11-07T10:49:12+06:00       DEBUG   [dockerfile scanner] Scanning files...  count=1
2025-11-07T10:49:12+06:00       DEBUG   [rego] Scanning inputs  count=1
2025-11-07T10:49:12+06:00       DEBUG   OS is not detected.
2025-11-07T10:49:12+06:00       INFO    Detected config files   num=1
2025-11-07T10:49:12+06:00       DEBUG   Scanned config file     file_path="Dockerfile"
2025-11-07T10:49:12+06:00       DEBUG   Specified ignore file does not exist    file=".trivyignore"
2025-11-07T10:49:12+06:00       DEBUG   [vex] VEX filtering is disabled

Report Summary

┌────────────┬────────────┬───────────────────┐
│   Target   │    Type    │ Misconfigurations │
├────────────┼────────────┼───────────────────┤
│ Dockerfile │ dockerfile │         2         │
└────────────┴────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


Dockerfile (dockerfile)

Tests: 27 (SUCCESSES: 25, FAILURES: 2)
Failures: 2 (UNKNOWN: 0, LOW: 1, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

AVD-DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

See https://avd.aquasec.com/misconfig/ds002
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


AVD-DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

See https://avd.aquasec.com/misconfig/ds026
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────


2025-11-07T10:49:12+06:00       DEBUG   Cleaning up temp directory      path="/var/folders/8m/p1341n2941jbyc5gm7357x5c0000gn/T/trivy-74729"

nikpivkin Nov 7, 2025
Maintainer Author

Not all flags are included in v0.25.1.

nikpivkin Nov 7, 2025
Maintainer Author

I have an idea on how to exclude unsupported flags, I'll open a PR.

nikpivkin · 2025-11-07T13:22:08Z

nikpivkin
Nov 7, 2025
Maintainer Author

Track #9768

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Trivy fails to scan Dockerfile with `1.7-labs` version syntax #8829

Uh oh!

{{title}}

Uh oh!

Replies: 2 comments 5 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Trivy fails to scan Dockerfile with 1.7-labs version syntax #8829

Uh oh!

nikpivkin May 6, 2025 Maintainer

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 2 comments · 5 replies

Uh oh!

nikpivkin May 6, 2025 Maintainer Author

Uh oh!

DmitriyLewen May 6, 2025 Maintainer

Uh oh!

nikpivkin Nov 6, 2025 Maintainer Author

Uh oh!

DmitriyLewen Nov 7, 2025 Maintainer

Uh oh!

nikpivkin Nov 7, 2025 Maintainer Author

Uh oh!

nikpivkin Nov 7, 2025 Maintainer Author

Uh oh!

nikpivkin Nov 7, 2025 Maintainer Author

Trivy fails to scan Dockerfile with `1.7-labs` version syntax #8829

nikpivkin
May 6, 2025
Maintainer

Replies: 2 comments 5 replies

nikpivkin
May 6, 2025
Maintainer Author

DmitriyLewen May 6, 2025
Maintainer

nikpivkin Nov 6, 2025
Maintainer Author

DmitriyLewen Nov 7, 2025
Maintainer

nikpivkin Nov 7, 2025
Maintainer Author

nikpivkin Nov 7, 2025
Maintainer Author

nikpivkin
Nov 7, 2025
Maintainer Author