fix(misconf): get user from Config.User (#6070)

pkg/fanal/analyzer/imgconf/dockerfile/dockerfile.go

@@ -41,6 +41,7 @@ func (a *historyAnalyzer) Analyze(ctx context.Context, input analyzer.ConfigAnal
 		return nil, nil
 	}
 	dockerfile := new(bytes.Buffer)
+	var userFound bool
 	baseLayerIndex := image.GuessBaseImageIndex(input.Config.History)
 	for i := baseLayerIndex + 1; i < len(input.Config.History); i++ {
 		h := input.Config.History[i]
@@ -64,6 +65,7 @@ func (a *historyAnalyzer) Analyze(ctx context.Context, input analyzer.ConfigAnal
 		case strings.HasPrefix(h.CreatedBy, "USER"):
 			// USER instruction
 			createdBy = h.CreatedBy
+			userFound = true
 		case strings.HasPrefix(h.CreatedBy, "HEALTHCHECK"):
 			// HEALTHCHECK instruction
 			var interval, timeout, startPeriod, retries, command string
@@ -86,6 +88,11 @@ func (a *historyAnalyzer) Analyze(ctx context.Context, input analyzer.ConfigAnal
 		dockerfile.WriteString(strings.TrimSpace(createdBy) + "\n")
 	}
 
+	if !userFound && input.Config.Config.User != "" {
+		user := fmt.Sprintf("USER %s", input.Config.Config.User)
+		dockerfile.WriteString(user)
+	}
+
 	fsys := mapfs.New()
 	if err := fsys.WriteVirtualFile("Dockerfile", dockerfile.Bytes(), 0600); err != nil {
 		return nil, xerrors.Errorf("mapfs write error: %w", err)

pkg/fanal/analyzer/imgconf/dockerfile/dockerfile_test.go

@@ -104,6 +104,7 @@ func Test_historyAnalyzer_Analyze(t *testing.T) {
 							Interval: time.Second * 10,
 							Timeout:  time.Second * 3,
 						},
+						User: "1002",
 					},
 					History: []v1.History{
 						{
@@ -126,10 +127,6 @@ func Test_historyAnalyzer_Analyze(t *testing.T) {
 							CreatedBy:  "RUN /bin/sh -c ls -hl /foo # buildkit",
 							EmptyLayer: false,
 						},
-						{
-							CreatedBy:  "USER foo",
-							EmptyLayer: true,
-						},
 						{
 							CreatedBy:  `HEALTHCHECK &{["CMD-SHELL" "curl -sS 127.0.0.1 || exit 1"] "10s" "3s" "0s" '\x00'}`,
 							EmptyLayer: true,