mcp-server-semgrep/semgrep-rules/dockerfile/best-practice/missing-apk-no-cache.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: missing-apk-no-cache
    patterns:
      - pattern: |
          RUN apk $COMMAND ...
      - pattern-not-inside: |
          RUN apk ... --no-cache ...
    languages:
      - dockerfile
    message: >-
      This apk command is missing '--no-cache'. This forces apk to use a package
      index instead of a local package cache, removing the need for '--update'
      and the deletion of '/var/cache/apk/*'. Add '--no-cache' to your apk command.
    severity: INFO
    metadata:
      source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3019
      references:
        - https://github.com/hadolint/hadolint/wiki/DL3019
      category: best-practice
      technology:
        - dockerfile
#   fix: RUN apk $COMMAND --no-cache $SOMETHING