chore: Testing DataDog Dockerfile misconfiguration checks (off-ticket)

[dragos441]

Sloppy Dockerfile full of bad practices (root user, hardcoded password, 777 permissions, etc) that should trigger DataDog code quality checks.

---

Checklist:

Title:

• Conforms to our pull request title guidance. E.g. feat: Add new feature (DBTP-1234) or chore: Correct typo (off-ticket)

Description:

• Link to ticket included (unless it's a quick out of ticket thing)
• Includes tests (or an explanation for why it doesn't)
• If the work includes user interface changes, before and after screenshots included in description
• Includes any applicable changes to the documentation in this code base
• Includes link(s) to any applicable changes to the documentation in the DBT Platform Documentation (can be to a pull request)

Tasks:

• Run the end to end tests for this branch and confirm that they are passing

Reviewer Checklist

• I have reviewed the PR and ensured no secret values are present

[github-actions]

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage

[github-actions]

Dependency Review

✅ No vulnerabilities or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Your PR has commits that are missing the Signed-off-by trailer. This is likely due to the pre-commit hook not being configured on your local machine. The usual fix for this issue is to run pre-commit install --install-hooks --overwrite -t commit-msg -t pre-commit, however for more detailed help in setting up the pre-commit hooks, follow the instructions at https://github.com/uktrade/github-standards/blob/main/README.md#usage

[datadog-uktrade]

       

🛑 Gate Violations

🧱 1 Infrastructure as Code (IaC) issue detected

An IaC violations gate may be blocking this PR.

High: Last user is root

Last user is root View rule
bad-dockerfile/Dockerfile:5

ℹ️ Info

No other issues found (see more)

🛠️ No new code quality issues
🛡️ No new code vulnerabilities
📚 No new vulnerable libraries detected
🔑 No new secrets detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 3da8dcf | Docs | Datadog PR Page | Give us feedback!}

[datadog-uktrade]

🔴 High: Last user is root

Containers must not run their final process as root because running as root increases the impact of a compromise and can enable privilege escalation or container-to-host attacks.

This rule checks the Dockerfile USER i... (...read more)

Containers must not run their final process as root because running as root increases the impact of a compromise and can enable privilege escalation or container-to-host attacks.

This rule checks the Dockerfile USER instruction and flags Dockerfiles whose last USER is set to root. The final USER must be a non-root username or UID.

If root is required for build-time actions, perform those steps earlier (for example, in a build stage), then create a non-root user and set USER to that account before the final CMD/ENTRYPOINT.

Secure example that switches to a non-root user before runtime:

FROM node:18 AS build
RUN npm ci && npm run build

FROM node:18-slim
WORKDIR /app
COPY --from=build /app/dist .
RUN addgroup --system app && adduser --system --ingroup app app
USER app
CMD ["node", "server.js"]

_{Helpful? 👍/👎     
🚩 Report as false positive. Flags the rule for review to improve detection accuracy.}