mcp-server-semgrep/semgrep-rules/dockerfile/correctness/multiple-entrypoint-instructions.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: multiple-entrypoint-instructions
    severity: ERROR
    languages: [dockerfile]
    patterns:
      - pattern: |
          ENTRYPOINT ...
          ...
          $ENTRYPOINT_INSTR
      # Restrict the match to just the second ENTRYPOINT instruction.
      # This avoids producing unstable findings due to capturing
      # many lines of irrelevant code with the ellipsis.
      - metavariable-pattern:
          metavariable: $ENTRYPOINT_INSTR
          pattern: |
            ENTRYPOINT ...
      - focus-metavariable: $ENTRYPOINT_INSTR
    message: >-
      Multiple ENTRYPOINT instructions were found. Only the last one
      will take effect.
    metadata:
      source-rule-url: https://github.com/hadolint/hadolint/wiki/DL4004
      references:
        - https://github.com/hadolint/hadolint/wiki/DL4004
        - https://kapeli.com/cheat_sheets/Dockerfile.docset/Contents/Resources/Documents/index#//dash_ref_Instructions/Entry/ENTRYPOINT/0
      category: correctness
      technology:
        - dockerfile