mcp-server-semgrep/semgrep-rules/generic/dockerfile/best-practice/use-absolute-workdir.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: use-absolute-workdir
  pattern-either:
  - patterns:
    - pattern: WORKDIR $VALUE
    - metavariable-pattern:
        metavariable: $VALUE
        patterns:
        - pattern-not-regex: (\/.*)
  - patterns:
    - pattern: ENV $VAR=$VALUE ... $CMD ${$VAR}
    - metavariable-pattern:
        metavariable: $VALUE
        patterns:
        - pattern-not-regex: (\/.*)
    - metavariable-pattern:
        metavariable: $CMD
        pattern: WORKDIR
    - focus-metavariable: $CMD
  message: >-
    Detected a relative WORKDIR. Use absolute paths. This prevents
    issues based on assumptions about the WORKDIR of previous containers.
  severity: WARNING
  languages: [generic]
  metadata:
    source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3000
    references:
    - https://github.com/hadolint/hadolint/wiki/DL3000
    category: best-practice
    technology:
    - dockerfile
  paths:
    include:
    - '*dockerfile*'
    - '*Dockerfile*'