Skip to content

Instantly share code, notes, and snippets.

@deanwilson

deanwilson/gds-way-docker.rego

Created July 7, 2020 18:09
Show Gist options
  • Save deanwilson/00a2e4db4ece7b6ee3d05f3bd9dda1fe to your computer and use it in GitHub Desktop.
Save deanwilson/00a2e4db4ece7b6ee3d05f3bd9dda1fe to your computer and use it in GitHub Desktop.
Download ZIP
Raw
gds-way-docker.rego
package main
deny[msg] {
input[i].Cmd == "from"
val := input[i].Value
image := val[0]
trace(image)
not re_match(".+@sha256:.{64}$", image)
msg = sprintf("FROM commands should use a sha256 hash, not a label %s", [image])
}
## Matches the label rules in https://gds-way.cloudapps.digital/manuals/programming-languages/docker.html#using-tags-and-digests-in-from-instructions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment