feat: add examples for dockerfile and kubernetes checks

checks/docker/add_instead_of_copy.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/add_instead_of_copy.yaml
 package builtin.dockerfile.DS005
 
 import data.lib.docker

checks/docker/add_instead_of_copy.yaml

@@ -0,0 +1,12 @@
+dockerfile:
+  good:
+    - |-
+      FROM alpine:3.13
+      USER mike
+      ADD "/target/resources.tar.gz" "resources"
+  bad:
+    - |-
+      FROM alpine:3.13
+      USER mike
+      ADD "/target/resources.tar.gz" "resources.jar"
+      ADD "/target/app.jar" "app.jar"

checks/docker/apt_get_missing_yes_flag_to_avoid_manual_input.rego

@@ -16,6 +16,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/apt_get_missing_yes_flag_to_avoid_manual_input.yaml
 package builtin.dockerfile.DS021
 
 import data.lib.docker

checks/docker/apt_get_missing_yes_flag_to_avoid_manual_input.yaml

@@ -0,0 +1,11 @@
+dockerfile:
+  good:
+    - |-
+      FROM node:12
+      USER mike
+      RUN apt-get -fmy install apt-utils && apt-get clean
+  bad:
+    - |-
+      FROM node:12
+      USER mike
+      RUN apt-get install apt-utils && apt-get clean

checks/docker/copy_from_references_current_from_alias.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/copy_from_references_current_from_alias.yaml
 package builtin.dockerfile.DS006
 
 import data.lib.docker

checks/docker/copy_from_references_current_from_alias.yaml

@@ -0,0 +1,17 @@
+dockerfile:
+  good:
+    - |-
+      FROM golang:1.7.3 as dep
+      COPY  /binary /
+
+      FROM alpine:3.13
+      USER mike
+      ENTRYPOINT [ "/opt/app/run.sh --port 8080" ]
+  bad:
+    - |-
+      FROM golang:1.7.3 as dep
+      COPY --from=dep /binary /
+
+      FROM alpine:3.13
+      USER mike
+      ENTRYPOINT [ "/opt/app/run.sh --port 8080" ]

checks/docker/copy_with_more_than_two_arguments_not_ending_with_slash.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/copy_with_more_than_two_arguments_not_ending_with_slash.yaml
 package builtin.dockerfile.DS011
 
 import data.lib.docker

checks/docker/copy_with_more_than_two_arguments_not_ending_with_slash.yaml

@@ -0,0 +1,11 @@
+dockerfile:
+  good:
+    - |-
+      FROM alpine:3.13
+      USER mike
+      COPY ["package.json", "yarn.lock", "myapp/"]
+  bad:
+    - |-
+      FROM alpine:3.13
+      USER mike
+      COPY ["package.json", "yarn.lock", "myapp"]

checks/docker/latest_tag.rego

@@ -13,6 +13,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/latest_tag.yaml
 package builtin.dockerfile.DS001
 
 import data.lib.docker

checks/docker/latest_tag.yaml

@@ -0,0 +1,11 @@
+dockerfile:
+  good:
+    - |-
+      FROM debian:9
+      RUN apt-get update && apt-get -y install vim && apt-get clean
+      USER foo
+  bad:
+    - |-
+      FROM debian:latest
+      RUN apt-get update && apt-get -y install vim && apt-get clean
+      USER foo

checks/docker/maintainer_is_deprecated.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/maintainer_is_deprecated.yaml
 package builtin.dockerfile.DS022
 
 import data.lib.docker

checks/docker/maintainer_is_deprecated.yaml

@@ -0,0 +1,10 @@
+dockerfile:
+  good:
+    - |-
+      FROM busybox:1.33.1
+      USER mike
+  bad:
+    - |-
+      FROM busybox:1.33.1
+      USER mike
+      MAINTAINER Lukas Martinelli <[email protected]>

checks/docker/missing_dnf_clean_all.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/missing_dnf_clean_all.yaml
 package builtin.dockerfile.DS019
 
 import data.lib.docker

checks/docker/missing_dnf_clean_all.yaml

@@ -0,0 +1,13 @@
+dockerfile:
+  good:
+    - |-
+      FROM fedora:27
+      USER mike
+      RUN set -uex &&     dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo &&     sed -i 's/\\$releasever/26/g' /etc/yum.repos.d/docker-ce.repo &&     dnf install -vy docker-ce &&     dnf clean all
+      HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1
+  bad:
+    - |-
+      FROM fedora:27
+      USER mike
+      RUN set -uex &&     dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo &&     sed -i 's/\\$releasever/26/g' /etc/yum.repos.d/docker-ce.repo &&     dnf install -vy docker-ce
+      HEALTHCHECK CMD curl --fail http://localhost:3000 || exit 1

checks/docker/missing_zypper_clean.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/missing_zypper_clean.yaml
 package builtin.dockerfile.DS020
 
 import data.lib.docker

checks/docker/missing_zypper_clean.yaml

@@ -0,0 +1,15 @@
+dockerfile:
+  good:
+    - |-
+      FROM alpine:3.5
+      RUN zypper install bash && zypper clean
+      RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
+      USER mike
+      CMD python /usr/src/app/app.py
+  bad:
+    - |-
+      FROM alpine:3.5
+      RUN zypper install bash
+      RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
+      USER mike
+      CMD python /usr/src/app/app.py

checks/docker/multiple_cmd_instructions_listed.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/multiple_cmd_instructions_listed.yaml
 package builtin.dockerfile.DS016
 
 import data.lib.docker

checks/docker/multiple_cmd_instructions_listed.yaml

@@ -0,0 +1,16 @@
+dockerfile:
+  good:
+    - |-
+      FROM golang:1.7.3
+      USER mike
+      CMD ./apps
+      FROM alpine:3.13
+      CMD ./app
+  bad:
+    - |-
+      FROM golang:1.7.3
+      USER mike
+      CMD ./app
+      CMD ./apps
+      FROM alpine:3.13
+      CMD ./app

checks/docker/multiple_entrypoint_instructions_listed.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/multiple_entrypoint_instructions_listed.yaml
 package builtin.dockerfile.DS007
 
 import data.lib.docker

checks/docker/multiple_entrypoint_instructions_listed.yaml

@@ -0,0 +1,19 @@
+dockerfile:
+  good:
+    - |-
+      FROM golang:1.7.3 as dep
+      COPY /binary /
+
+      FROM alpine:3.13
+      USER mike
+      ENTRYPOINT [ "/opt/app/run.sh --port 8080" ]
+  bad:
+    - |-
+      FROM golang:1.7.3 as dep
+      COPY dep /binary /
+      ENTRYPOINT [ "/opt/app/run.sh --port 8080" ]
+      ENTRYPOINT [ "/opt/app/run.sh --port 8080" ]
+
+      FROM alpine:3.13
+      USER mike
+      ENTRYPOINT [ "/opt/app/run.sh --port 8080" ]

checks/docker/multiple_healthcheck_instructions.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/multiple_healthcheck_instructions.yaml
 package builtin.dockerfile.DS023
 
 import data.lib.docker

checks/docker/multiple_healthcheck_instructions.yaml

@@ -0,0 +1,20 @@
+dockerfile:
+  good:
+    - |-
+      FROM busybox:1.33.1
+      HEALTHCHECK CMD /bin/healthcheck
+
+      FROM alpine:3.13
+      HEALTHCHECK CMD /bin/healthcheck
+      USER mike
+      CMD ./app
+  bad:
+    - |-
+      FROM busybox:1.33.1
+      HEALTHCHECK CMD curl http://localhost:8080
+      HEALTHCHECK CMD /bin/healthcheck
+
+      FROM alpine:3.13
+      HEALTHCHECK CMD /bin/healthcheck
+      USER mike
+      CMD ./app

checks/docker/port22.rego

@@ -13,6 +13,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/port22.yaml
 package builtin.dockerfile.DS004
 
 import data.lib.docker

checks/docker/port22.yaml

@@ -0,0 +1,11 @@
+dockerfile:
+  good:
+    - |-
+      FROM alpine:3.13
+      USER mike
+      EXPOSE 8080
+  bad:
+    - |-
+      FROM alpine:3.13
+      USER mike
+      EXPOSE 22

checks/docker/root_user.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/root_user.yaml
 package builtin.dockerfile.DS002
 
 import data.lib.docker

checks/docker/root_user.yaml

@@ -0,0 +1,10 @@
+dockerfile:
+  good:
+    - |-
+      FROM debian:9
+      RUN apt-get update && apt-get -y install vim && apt-get clean
+      USER foo
+  bad:
+    - |-
+      FROM debian:9
+      RUN apt-get update && apt-get -y install vim && apt-get clean

checks/docker/run_apt_get_dist_upgrade.rego

@@ -13,6 +13,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/run_apt_get_dist_upgrade.yaml
 package builtin.dockerfile.DS024
 
 import data.lib.docker

checks/docker/run_apt_get_dist_upgrade.yaml

@@ -0,0 +1,13 @@
+dockerfile:
+  good:
+    - |-
+      FROM debian:9.13
+      RUN apt-get update && apt-get install -y curl && apt-get clean
+      USER mike
+      CMD python /usr/src/app/app.py
+  bad:
+    - |-
+      FROM debian:9.13
+      RUN apt-get update && apt-get dist-upgrade && apt-get -y install curl && apt-get clean
+      USER mike
+      CMD python /usr/src/app/app.py

checks/docker/run_command_cd_instead_of_workdir.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/run_command_cd_instead_of_workdir.yaml
 package builtin.dockerfile.DS013
 
 import data.lib.docker

checks/docker/run_command_cd_instead_of_workdir.yaml

@@ -0,0 +1,13 @@
+dockerfile:
+  good:
+    - |-
+      FROM nginx:2.2
+      WORKDIR /usr/share/nginx/html
+      USER mike
+      CMD cd /usr/share/nginx/html && sed -e s/Docker/\"$AUTHOR\"/ Hello_docker.html > index.html ; nginx -g 'daemon off;'
+  bad:
+    - |-
+      FROM nginx:2.2
+      RUN cd /usr/share/nginx/html
+      USER mike
+      CMD cd /usr/share/nginx/html && sed -e s/Docker/\"$AUTHOR\"/ Hello_docker.html > index.html ; nginx -g 'daemon off;'

checks/docker/run_using_sudo.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/run_using_sudo.yaml
 package builtin.dockerfile.DS010
 
 import data.lib.docker

checks/docker/run_using_sudo.yaml

@@ -0,0 +1,11 @@
+dockerfile:
+  good:
+    - |-
+      FROM alpine:3.13
+      RUN  pip install --upgrade pip
+      USER mike
+  bad:
+    - |-
+      FROM alpine:3.13
+      RUN  sudo pip install --upgrade pip
+      USER mike

checks/docker/run_using_wget_and_curl.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/run_using_wget_and_curl.yaml
 package builtin.dockerfile.DS014
 
 import data.lib.docker

checks/docker/run_using_wget_and_curl.yaml

@@ -0,0 +1,19 @@
+dockerfile:
+  good:
+    - |-
+      FROM debian:stable-20210621
+      RUN curl http://bing.com
+      RUN curl http://google.com
+
+      FROM baseimage:1.0
+      USER mike
+      RUN curl http://bing.com
+  bad:
+    - |-
+      FROM debian:stable-20210621
+      RUN wget http://bing.com
+      RUN curl http://google.com
+
+      FROM baseimage:1.0
+      USER mike
+      RUN curl http://bing.com

checks/docker/same_alias_in_different_froms.rego

@@ -15,6 +15,7 @@
 #   input:
 #     selector:
 #     - type: dockerfile
+#   examples: checks/docker/same_alias_in_different_froms.yaml
 package builtin.dockerfile.DS012
 
 import data.lib.docker