Trivy fails to scan Dockerfiles that contain the new COPY --parents syntax

[peetw]

Description

Trivy fails to scan Dockerfiles that contain the new COPY --parents syntax

Desired Behavior

Dockerfile is scanned by Trivy

Actual Behavior

Trivy fails to scan the Dockerfile with the following error:

ERROR   [dockerfile scanner] Failed to parse file       file_path="Dockerfile" err="parse dockerfile instruction: unknown flag: --parents"

Reproduction Steps

cat > Dockerfile <<EOF
# syntax=docker.io/docker/dockerfile:1.7-labs
FROM alpine:latest
COPY --parents . .
EOF

trivy filesystem --scanners misconfig Dockerfile

Target

Filesystem

Scanner

Misconfiguration

Output Format

None

Mode

Standalone

Debug Output

2025-11-06T12:25:57Z    DEBUG   No plugins loaded
2025-11-06T12:25:57Z    DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2025-11-06T12:25:57Z    DEBUG   Cache dir       dir="/home/xxxx/.cache/trivy"
2025-11-06T12:25:57Z    DEBUG   Cache dir       dir="/home/xxxx/.cache/trivy"
2025-11-06T12:25:57Z    DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2025-11-06T12:25:57Z    DEBUG   Ignore statuses statuses=[]
2025-11-06T12:25:57Z    DEBUG   [pkg] Package types     types=[os library]
2025-11-06T12:25:57Z    DEBUG   [pkg] Package relationships     relationships=[unknown root workspace direct indirect]
2025-11-06T12:25:57Z    INFO    [misconfig] Misconfiguration scanning is enabled
2025-11-06T12:25:57Z    DEBUG   [misconfig] Checks successfully loaded from disk
2025-11-06T12:25:57Z    DEBUG   [notification] Running version check
2025-11-06T12:25:57Z    DEBUG   [notification] Version check completed  latest_version="0.67.2"
2025-11-06T12:25:57Z    DEBUG   [rego] Overriding filesystem for checks
2025-11-06T12:25:57Z    DEBUG   [rego] Embedded libraries are loaded    count=17
2025-11-06T12:25:57Z    DEBUG   [rego] Embedded checks are loaded       count=519
2025-11-06T12:25:58Z    DEBUG   [rego] Checks from disk are loaded      count=536
2025-11-06T12:25:58Z    DEBUG   [rego] Overriding filesystem for data
2025-11-06T12:25:58Z    DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot]
2025-11-06T12:25:58Z    DEBUG   Initializing scan cache...      type="memory"
2025-11-06T12:25:58Z    DEBUG   [fs] Analyzing...       root="Dockerfile"
2025-11-06T12:25:58Z    DEBUG   [fs] Random cache key will be used      err="failed to open git repository: stat /xxxx/.git: not a directory"
2025-11-06T12:25:58Z    DEBUG   Created process-specific temp directory path="/tmp/trivy-3628"
2025-11-06T12:25:58Z    DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Dockerfile"
2025-11-06T12:25:58Z    ERROR   [dockerfile scanner] Failed to parse file       file_path="Dockerfile" err="parse dockerfile instruction: unknown flag: --parents"
2025-11-06T12:25:58Z    DEBUG   OS is not detected.
2025-11-06T12:25:58Z    DEBUG   Detected OS: unknown
2025-11-06T12:25:58Z    INFO    Number of language-specific files       num=0
2025-11-06T12:25:58Z    INFO    Detected config files   num=0
2025-11-06T12:25:58Z    DEBUG   Found an ignore file    file_path=".trivyignore"
2025-11-06T12:25:58Z    DEBUG   [vex] VEX filtering is disabled
2025-11-06T12:25:58Z    WARN    [report] Supported files for scanner(s) not found.      scanners=[misconfig]

Report Summary

┌────────┬──────┬───────────────────┐
│ Target │ Type │ Misconfigurations │
├────────┼──────┼───────────────────┤
│   -    │  -   │         -         │
└────────┴──────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)

2025-11-06T12:25:58Z    DEBUG   Cleaning up temp directory      path="/tmp/trivy-3628"

Operating System

Ubuntu 24.04

Version

Version: 0.67.2
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-11-06 06:28:27.475900541 +0000 UTC
  NextUpdate: 2025-11-07 06:28:27.47590024 +0000 UTC
  DownloadedAt: 2025-11-06 11:30:59.787142061 +0000 UTC
Check Bundle:
  Digest: sha256:0491169789b867ae5a7353381220c1d4d97b3a0d6d9dfd84a25d06f0ba68aa93
  DownloadedAt: 2025-11-06 11:31:00.160263498 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[nikpivkin]

Hi @peetw !

Thanks for the report! We already have an open discussion about the Labs syntax here: #8829