test Dockerfile with conftest

test-dockerfile-with-conftest.sh

#!/usr/bin/env bash
set -e

cat << EOF > Dockerfile
FROM kalilinux/kali-linux-docker:latest

ENTRYPOINT ["echo"]
EOF

cat <<< EOF > test.rego
package main

disallowed_tags := ["latest"]
disallowed_images := ["kalilinux/kali-linux-docker"]

deny[msg] {
        input[i].Cmd == "from"
        val := input[i].Value
        tag := split(val[i], ":")[1]
        contains(tag, disallowed_tags[_])

        msg = sprintf("[%s] tag is not allowed", [tag])
}

deny[msg] {
        input[i].Cmd == "from"
        val := input[i].Value
        image := split(val[i], ":")[0]
        contains(image, disallowed_images[_])

        msg = sprintf("[%s] image is not allowed", [image])
}
EOF

conftest test -p . Dockerfile

Helpful links down below:

• https://dev.to/petermbenjamin/unit-test-your-configuration-files-3mnf
• https://github.com/open-policy-agent/conftest
• https://github.com/open-policy-agent/conftest/tree/master/examples