bug(query): false positive from dockerfile/apt_get_install_lists_were_not_deleted

[rossi-fi]

It's common to use DEBIAN_FRONTEND=noninteractive apt-get install package. However the variable causes a false positive even though the install command is followed by cleanup.

Expected Behavior

No vulnerabilities reported

Actual Behavior

Apt Get Install Lists Were Not Deleted

Workaround

Remove variable from apt-get install and precede it with dpkg-reconfigure debconf --frontend=noninteractive

[EduardoSemanas]

Hi @rossi-fi! I created the following code sample for this issue, which doesn't reproduce the false positive:

FROM busyboxneg6 ARG DEBIAN_FRONTEND=noninteractive RUN apt-get update;
apt-get install --no-install-recommends -y python;
apt-get clean

Do you think it covers it?

[rossi-fi]

Hi @EduardoSemanas

Using ARG to declare the variable is a valid workaround to avoid the false positive. Ideally the rules could be modified so one doesn't need to code around tool behaviour.