Add check for missing pipefail in Dockerfile

[rittneje]

Description

See https://docs.docker.com/build/building/best-practices/#using-pipes.

Please add a check for RUN steps that use | without -o pipefail set.

Target

Filesystem

Scanner

Misconfiguration

[simar7]

thanks for the idea!

[nikpivkin]

@simar7
From the documentation:

Not all shells support the -o pipefail option.

In cases such as the dash shell on Debian-based images, consider using the exec form of RUN to explicitly choose a shell that does > support the pipefail option

Since we will not be able to identify the base image, this will lead to false positives.

[rittneje]

Regardless of what the shell supports, the default behavior of the pipe operator is error-prone, and ought to be flagged. (That is, what you are describing is not a false positive.)

[nikpivkin]

Yeah, I missed that.

[nikpivkin]

Track #10401