Dockerfile scan error on Env entries containing tab characters #9494

byteborg · 2025-09-18T14:52:37Z

byteborg
Sep 18, 2025

Description

The image postgres:17-alpine@sha256:170465e4803f7249557168732d89222da85164bbee649aefba4fe15a427643c5 contains a layer with an Env entry of "DOCKER_PG_LLVM_DEPS=llvm19-dev \t\tclang19"
Apparently the Dockerfile parser doesn't like it and barfs with an error.
It is unclear if the whole parsing process is broken or just the line is ignored.

Desired Behavior

Parse the Dockerfile from the image gracefully, issue a warning or error and state the consequence (eg. "Dockerfile cannot be parsed, it will be ignored in its entirety" or "Dockerfile line x cannot be parsed, just the entry/line will be ignored")

Actual Behavior

Dockerfile parser throws syntax error, appears to be platform-independent.
The logged error is 2025-09-18T16:45:49+02:00 ERROR [dockerfile scanner] Failed to parse file file_path="Dockerfile" err="dockerfile parse error: Syntax error - can't find = in \"clang19\". Must be of the form: name=value"

Reproduction Steps

trivy image postgres:17-alpine@sha256:170465e4803f7249557168732d89222da85164bbee649aefba4fe15a427643c5 --compliance docker-cis-1.6.0 --format json --disable-telemetry --no-progress

Target

Container Image

Scanner

Misconfiguration

Output Format

JSON

Mode

Standalone

Debug Output

$ trivy image postgres:17-alpine@sha256:170465e4803f7249557168732d89222da85164bbee649aefba4fe15a427643c5 --compliance docker-cis-1.6.0 --format json --disable-telemetry --no-progress --debug >/dev/null
2025-09-18T16:45:47+02:00	DEBUG	Default config file "file_path=trivy.yaml" not found, using built in values
2025-09-18T16:45:47+02:00	DEBUG	Cache dir	dir="/Users/karstenrohrbach/Library/Caches/trivy"
2025-09-18T16:45:47+02:00	DEBUG	Cache dir	dir="/Users/karstenrohrbach/Library/Caches/trivy"
2025-09-18T16:45:47+02:00	DEBUG	Compliance spec loaded from disk bundle	spec="docker-cis-1.6.0"
2025-09-18T16:45:47+02:00	DEBUG	Parsed severities	severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-09-18T16:45:47+02:00	DEBUG	Ignore statuses	statuses=[]
2025-09-18T16:45:47+02:00	DEBUG	DB update was skipped because the local DB is the latest
2025-09-18T16:45:47+02:00	DEBUG	DB info	schema=2 updated_at=2025-09-18T12:34:06.17902776Z next_update=2025-09-19T12:34:06.179027519Z downloaded_at=2025-09-18T14:39:33.883915Z
2025-09-18T16:45:47+02:00	INFO	[image] Container image config scanners	scanners=[misconfig secret]
2025-09-18T16:45:47+02:00	INFO	[vuln] Vulnerability scanning is enabled
2025-09-18T16:45:47+02:00	INFO	[misconfig] Misconfiguration scanning is enabled
2025-09-18T16:45:47+02:00	DEBUG	[notification] Running version check
2025-09-18T16:45:47+02:00	DEBUG	[misconfig] Checks successfully loaded from disk
2025-09-18T16:45:47+02:00	DEBUG	[rego] Overriding filesystem for checks
2025-09-18T16:45:47+02:00	DEBUG	[rego] Embedded libraries are loaded	count=17
2025-09-18T16:45:47+02:00	DEBUG	[rego] Embedded checks are loaded	count=519
2025-09-18T16:45:47+02:00	DEBUG	[notification] Version check completed	latest_version="0.66.0"
2025-09-18T16:45:47+02:00	DEBUG	[rego] Checks from disk are loaded	count=536
2025-09-18T16:45:47+02:00	DEBUG	[rego] Overriding filesystem for data
2025-09-18T16:45:47+02:00	DEBUG	Initializing scan cache...	type="fs"
2025-09-18T16:45:47+02:00	DEBUG	Created process-specific temp directory	path="/var/folders/xw/gs9kdkdn6jgc28sh6jlv__7r0000gn/T/trivy-19947"
2025-09-18T16:45:47+02:00	DEBUG	[image] Image found	image="postgres:17-alpine@sha256:170465e4803f7249557168732d89222da85164bbee649aefba4fe15a427643c5" source="docker"
2025-09-18T16:45:47+02:00	DEBUG	[image] Detected image ID	image_id="sha256:938863c825c3b3ddc576431081acf49444b5dd4e53b3f3dd0232be52518dd065"
2025-09-18T16:45:47+02:00	DEBUG	[image] Detected diff ID	diff_ids=[sha256:0b83d017db6efafadf6b3f18d087d2ce1d67d8f0e927dc7254b0ad088074cd3a sha256:74b80a0c1f313dd34c65c0bd75a580e8306bc4c6ad2a3fd0396381926890ffe9 sha256:36c5f6f0ac06ec3dcd9b8d30ebeb570c7189fb2216e474e2df047e977a2737d9 sha256:02e972585f5cb59178a8033907f55bc9550151aa23f0c8ee974d4800892765dc sha256:c2ace7a5d6f7ade7927c26c62209067c3a179a5a3a3ab5e94e90218cde566496 sha256:f7d5dc8d8af1878c6903e7b33822a27706739fd69b27159c0cbf148546fe3f2a sha256:db394ae9ee1d6c9a66618deba850ea3ae78fd1406a7fd996647f2eb245b331ee sha256:3fd24db6a55994cc2e4fbc8e78b727a9ab0dea0ad92552902d289d6e88c3f6c4 sha256:be63f70b62f8a6d7027188b7aa1ee557a4dbac7fcfeede21b97c66fb1c1511d1 sha256:ee714465d26db7bfbe7a389ed6adc4c15767ee4874f950a1099ccc102da5af67]
2025-09-18T16:45:47+02:00	DEBUG	[image] Detected base layers	diff_ids=[sha256:0b83d017db6efafadf6b3f18d087d2ce1d67d8f0e927dc7254b0ad088074cd3a]
2025-09-18T16:45:48+02:00	DEBUG	[image] Missing image ID in cache	image_id="sha256:938863c825c3b3ddc576431081acf49444b5dd4e53b3f3dd0232be52518dd065"
2025-09-18T16:45:48+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:0b83d017db6efafadf6b3f18d087d2ce1d67d8f0e927dc7254b0ad088074cd3a"
2025-09-18T16:45:48+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:74b80a0c1f313dd34c65c0bd75a580e8306bc4c6ad2a3fd0396381926890ffe9"
2025-09-18T16:45:48+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:02e972585f5cb59178a8033907f55bc9550151aa23f0c8ee974d4800892765dc"
2025-09-18T16:45:48+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:36c5f6f0ac06ec3dcd9b8d30ebeb570c7189fb2216e474e2df047e977a2737d9"
2025-09-18T16:45:48+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:c2ace7a5d6f7ade7927c26c62209067c3a179a5a3a3ab5e94e90218cde566496"
2025-09-18T16:45:49+02:00	DEBUG	[gobinary] Parsing dependency's build info settings	dependency="github.com/tianon/gosu" -ldflags=[]
2025-09-18T16:45:49+02:00	DEBUG	[gobinary] Unable to detect dependency version. `-ldflags` build info settings don't contain version flag. Empty version used.	dependency="github.com/tianon/gosu"
2025-09-18T16:45:49+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:f7d5dc8d8af1878c6903e7b33822a27706739fd69b27159c0cbf148546fe3f2a"
2025-09-18T16:45:49+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:db394ae9ee1d6c9a66618deba850ea3ae78fd1406a7fd996647f2eb245b331ee"
2025-09-18T16:45:49+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:3fd24db6a55994cc2e4fbc8e78b727a9ab0dea0ad92552902d289d6e88c3f6c4"
2025-09-18T16:45:49+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:be63f70b62f8a6d7027188b7aa1ee557a4dbac7fcfeede21b97c66fb1c1511d1"
2025-09-18T16:45:49+02:00	DEBUG	[image] Missing diff ID in cache	diff_id="sha256:ee714465d26db7bfbe7a389ed6adc4c15767ee4874f950a1099ccc102da5af67"
2025-09-18T16:45:49+02:00	DEBUG	[misconfig] Scanning files for misconfigurations...	scanner="Dockerfile"
2025-09-18T16:45:49+02:00	ERROR	[dockerfile scanner] Failed to parse file	file_path="Dockerfile" err="dockerfile parse error: Syntax error - can't find = in \"clang19\". Must be of the form: name=value"
2025-09-18T16:45:49+02:00	DEBUG	[secret] Using streaming scanner	file_path="config.json"
2025-09-18T16:45:49+02:00	DEBUG	[secret] scanStream called	file_path="config.json" buffer_size=65536 overlap_size=4096
2025-09-18T16:45:49+02:00	DEBUG	[secret] scanChunk called	file_path="config.json" content_len=9113 num_rules=87
2025-09-18T16:45:49+02:00	DEBUG	[secret] scanChunk called	file_path="config.json" content_len=4096 num_rules=87
2025-09-18T16:45:49+02:00	DEBUG	No secrets found in container image config
2025-09-18T16:45:49+02:00	INFO	Detected OS	family="alpine" version="3.22.1"
2025-09-18T16:45:49+02:00	INFO	[alpine] Detecting vulnerabilities...	os_version="3.22" repository="3.22" pkg_num=45
2025-09-18T16:45:49+02:00	INFO	Number of language-specific files	num=1
2025-09-18T16:45:49+02:00	INFO	[gobinary] Detecting vulnerabilities...
2025-09-18T16:45:49+02:00	DEBUG	[gobinary] Scanning packages for vulnerabilities	file_path="usr/local/bin/gosu"
2025-09-18T16:45:49+02:00	INFO	Detected config files	num=0
2025-09-18T16:45:49+02:00	WARN	Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/v0.66/docs/scanner/vulnerability#severity-selection for details.
2025-09-18T16:45:49+02:00	DEBUG	Specified ignore file does not exist	file=".trivyignore"
2025-09-18T16:45:49+02:00	DEBUG	[vex] VEX filtering is disabled
2025-09-18T16:45:49+02:00	DEBUG	Cleaning up temp directory	path="/var/folders/xw/gs9kdkdn6jgc28sh6jlv__7r0000gn/T/trivy-19947"

Operating System

macOS Sequoia arm64, linux amd64

Version

$ trivy --version
Version: 0.66.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-09-18 12:34:06.17902776 +0000 UTC
  NextUpdate: 2025-09-19 12:34:06.179027519 +0000 UTC
  DownloadedAt: 2025-09-18 14:39:33.883915 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2025-07-24 00:57:05.696934706 +0000 UTC
  NextUpdate: 2025-07-27 00:57:05.696934456 +0000 UTC
  DownloadedAt: 2025-07-24 16:50:29.199471 +0000 UTC
Check Bundle:
  Digest: sha256:a471e90b7c7335e914ec9075b74cf8f65e4c91e6cecfa7e39c587382808d2684
  DownloadedAt: 2025-09-18 14:39:34.115162 +0000 UTC

Checklist

Run trivy clean --all
Read the troubleshooting

nikpivkin · 2025-09-19T05:31:48Z

nikpivkin
Sep 19, 2025
Maintainer

Hi @byteborg !

Track #9496

1 reply

byteborg Sep 22, 2025
Author

Fixed in #9497

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Dockerfile scan error on Env entries containing tab characters #9494

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment 1 reply

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

Dockerfile scan error on Env entries containing tab characters #9494

Uh oh!

Uh oh!

byteborg Sep 18, 2025

Description

Desired Behavior

Actual Behavior

Reproduction Steps

Target

Scanner

Output Format

Mode

Debug Output

Operating System

Version

Checklist

Replies: 1 comment · 1 reply

Uh oh!

nikpivkin Sep 19, 2025 Maintainer

Uh oh!

byteborg Sep 22, 2025 Author

byteborg
Sep 18, 2025

Replies: 1 comment 1 reply

nikpivkin
Sep 19, 2025
Maintainer

byteborg Sep 22, 2025
Author