Hello!
Writing here after googling arround with the following issue:
I have the following docker file (I will simplify it a bit):
# syntax=docker/dockerfile:1
FROM ubuntu:20.04
RUN adduser --disabled-password --gecos "" nonrootuser && \
usermod -u 1000 nonrootuser && \
groupmod -g 1000 nonrootuser
RUN --mount=type=cache,target=/var/cache/apt \
--mount=type=cache,target=/var/lib/apt \
apt-get update && apt-get install -y --no-install-recommends \
ca-certificates \
ninja-build \
...
WORKDIR /tmp
RUN git clone --recurse-submodules --depth 1 --shallow-submodules https://github.com/mycompany/myproject.git .
WORKDIR /tmp/myproject
RUN cmake -S . -B build \
cmake --build build --config Release && \
cmake --build build --target install
USER nonrootuser
WORKDIR /home/nonrootuser
Which after pushing to dockerhub and scanning it with DockerScout results in 6/7 compliant policies, being the “Default non-root user” policy not compliant. First, I don’t understand why this is possible, given that I set the non root user as last.
Second, I have this other dockerfile:
# syntax=docker/dockerfile:1
FROM ubuntu:20.04 AS ubuntu-arm64
ENV SYSTEM_LIBS_PATH=/usr/lib/aarch64-linux-gnu
FROM ubuntu:20.04 AS ubuntu-x86_64
ENV SYSTEM_LIBS_PATH=/usr/lib/x86_64-linux-gnu
FROM ubuntu:20.04 AS ubuntu-amd64
ENV SYSTEM_LIBS_PATH=/usr/lib/x86_64-linux-gnu
ARG TARGETARCH
FROM ubuntu-${TARGETARCH}
USER root
RUN adduser --disabled-password --gecos "" nonrootuser && usermod -u 1000 nonrootuser && groupmod -g 1000 nonrootuser
RUN apt-get update && apt-get upgrade -y && apt-get install -yqq --fix-missing --no-install-recommends \
python3 \
....
RUN ldconfig
USER nonrootuser
WORKDIR /home/nonrootuser
This image, however, does complain with all the 7 policies… What I am missing? Is there a bug or something on docker scout?
Hope someone can shed some light on this issue 
Thanks in advance!