mcp-server-semgrep/semgrep-rules/dockerfile/best-practice/use-workdir.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: use-workdir
    options:
      implicit_deep_exprstmt: false
    patterns:
      - pattern-either:
        - pattern-inside: |
            RUN $ CMD ...
        - pattern-inside: |
            RUN $CMD ... && ...
      - metavariable-pattern:
          metavariable: $CMD
          pattern: cd
      - focus-metavariable: $CMD
    message: >-
      As recommended by Docker's documentation, it is best to use 'WORKDIR'
      instead of 'RUN cd ...' for improved clarity and reliability. Also, 'RUN cd
      ...' may not work as expected in a container.
    severity: WARNING
    languages: [dockerfile]
    metadata:
      source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3003
      references:
        - https://github.com/hadolint/hadolint/wiki/DL3003
      category: best-practice
      technology:
        - dockerfile