Inline comment ignore for Dockerfile misconfig checks

[tstraley]

Description

According to the docs, trivy misconfig scans support filtering via inline comments - but this appears to only work for terraform files https://aquasecurity.github.io/trivy/test/docs/configuration/filtering/#by-inline-comments

Would like to have a similar capability for Dockerfile scanning, so that we can more accurately accept / ignore specific lines in our Dockerfile while not excluding the specific check entirely.

Target

Filesystem

Scanner

Misconfiguration

[simar7]

You can write a custom rego check to accomplish this easily

package trivy

default ignore = false

ignore {
    rule = [
        {"id": "AVD-DS-0002", "start": 1, "end": 3},
        {"id": "AVD-DS-0026", "start": 1, "end": 6},
    ][_]
    input.ID == rule.id
    input.CauseMetadata.StartLine == rule.start
    input.CauseMetadata.EndLine == rule.end
}

[tstraley]

Thanks - I disagree about this being easy to accomplish. This also means that anytime we change the Dockerfile, we'd need to update the StartLine / EndLine to ensure we are just matching the specific case we want to ignore.

I'd think adding the ability to using #trivy:ignore: comments like supported in .tf files would be a huge improvement and useful feature addition for simplifying management of accepted misconfig checks.

[alexanderbazhenoff]

I'd think adding the ability to using #trivy:ignore: comments like supported in .tf files would be a huge improvement and useful feature addition for simplifying management of accepted misconfig checks.

Agree.

[nikpivkin]

@simar7 @itaysk We recently added support for inline ignore rules for CloudFormation. Is there any reason why we can't do this for Dockerfile? We have common ignore logic regardless of configuration type.

[itaysk]

if it's straightforward implementation (as you say common ignore logic), then I don't see a reason not to do this.

[nikpivkin]

Track #8113