False Positive: misconfig DS-0001 triggered on dynamic multi-stage FROM statement using local alias

[jhsesu]

IDs

DS-0001

Description

Target and Misconfiguration ID

DS-0001 (MEDIUM): Specify a tag in the 'FROM' statement for image 'os-'

Description

Trivy flags a DS-0001 misconfiguration rule on a FROM statement that references a local multi-stage build alias dynamically set via an ARG.

However, all upstream base images defined in the previous stages (docker.io/rockylinux/rockylinux:10.2-minimal and docker.io/library/ubuntu:26.04) do explicitly specify precise tags.

Trivy appears to parse os-${OSOUTPUT} as a standalone remote image name missing its tag (interpreting os- as the image name), rather than resolving it as a local reference to the previous multi-stage steps (AS os-rocky10 / AS os-ubuntu2604).

Containerfile / Dockerfile Sample

ARG OSOUTPUT=rocky10

# ------ COMPILATION ------
FROM --platform=\$BUILDPLATFORM docker.io/library/ubuntu:26.04 as cbuild
ARG BUILDPLATFORM
ARG TARGETPLATFORM
ARG CUSTOMCPU
ARG OSOUTPUT
# <More compilation steps...>

# ------ OPERATIONAL ------
FROM --platform=\$TARGETPLATFORM docker.io/rockylinux/rockylinux:10.2-minimal AS os-rocky10
FROM --platform=\$TARGETPLATFORM docker.io/library/ubuntu:26.04 AS os-ubuntu2604

# Trivy triggers DS-0001 on the line below
FROM os-\${OSOUTPUT} AS operational

ARG OSOUTPUT
ARG CUSTOMCPU

Commands Executed

trivy config .
# Or when scanning the specific container file:
trivy config Containerfile

What did you expect to happen?

Trivy should recognize that os-${OSOUTPUT} evaluates to local stage aliases defined in the same file which already contain specific immutable tags, and therefore it shouldn't trigger DS-0001.

Reproduction Steps

$ trivy config .

Target

Container Image

Scanner

Vulnerability

Target OS

Rocky Linux 10

Debug Output

$ trivy config ./Containerfile --debug
2026-11-06T18:33:57-05:00       DEBUG   Default config file "file_path=trivy.yaml" not found, using built in values
2026-11-06T18:33:57-05:00       DEBUG   Cache dir       dir="/home/jhss/.cache/trivy"
2026-11-06T18:33:57-05:00       DEBUG   Cache dir       dir="/home/jhss/.cache/trivy"
2026-11-06T18:33:57-05:00       DEBUG   Parsed severities       severities=[UNKNOWN LOW MEDIUM HIGH CRITICAL]
2026-11-06T18:33:57-05:00       INFO    [misconfig] Misconfiguration scanning is enabled
2026-11-06T18:33:57-05:00       DEBUG   [notification] Running version check and sending anonymous telemetry
2026-11-06T18:33:57-05:00       INFO    [checks-client] Using existing checks from cache        path="/home/jhss/.cache/trivy/policy/content"
2026-11-06T18:33:57-05:00       DEBUG   [misconfig] Checks successfully loaded from disk
2026-11-06T18:33:58-05:00       DEBUG   [rego] Overriding filesystem for checks
2026-11-06T18:33:58-05:00       DEBUG   [rego] Embedded libraries are loaded    count=17
2026-11-06T18:33:58-05:00       DEBUG   [rego] Embedded checks are loaded       count=563
2026-11-06T18:33:58-05:00       DEBUG   [notification] Version check completed  latest_version="0.76.2"
2026-11-06T18:33:59-05:00       DEBUG   [rego] Checks from disk are loaded      count=580
2026-11-06T18:33:59-05:00       DEBUG   [rego] Overriding filesystem for data
2026-11-06T18:33:59-05:00       DEBUG   Enabling misconfiguration scanners      scanners=[azure-arm cloudformation dockerfile helm kubernetes terraform terraformplan-json terraformplan-snapshot ansible]
2026-11-06T18:33:59-05:00       DEBUG   Initializing scan cache...      type="memory"
2026-11-06T18:33:59-05:00       DEBUG   [fs] Analyzing...       root="Containerfile"
2026-11-06T18:33:59-05:00       DEBUG   [fs] Random cache key will be used      err="failed to open git repository: lstat /mnt/e/JosSer/Info/Study/Podman/Containerfile/r10nginx-cross/Containerfile/.git: not a directory"
2026-11-06T18:33:59-05:00       DEBUG   Created process-specific temp directory path="/tmp/trivy-992694914"
2026-11-06T18:33:59-05:00       DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Dockerfile"
2026-11-06T18:33:59-05:00       DEBUG   [dockerfile scanner] Scanning files...  count=1
2026-11-06T18:33:59-05:00       DEBUG   [rego] Scanning inputs  count=1
2026-11-06T18:33:59-05:00       DEBUG   [misconfig] Scanning files for misconfigurations...     scanner="Ansible"
2026-11-06T18:33:59-05:00       DEBUG   OS is not detected.
2026-11-06T18:33:59-05:00       INFO    Detected config files   num=1
2026-11-06T18:33:59-05:00       DEBUG   Scanned config file     file_path="Containerfile"
2026-11-06T18:33:59-05:00       DEBUG   Specified ignore file does not exist    file=".trivyignore"
2026-11-06T18:33:59-05:00       DEBUG   [vex] VEX filtering is disabled

Report Summary

┌───────────────┬────────────┬───────────────────┐
│    Target     │    Type    │ Misconfigurations │
├───────────────┼────────────┼───────────────────┤
│ Containerfile │ dockerfile │         5         │
└───────────────┴────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


Containerfile (dockerfile)

Tests: 28 (SUCCESSES: 23, FAILURES: 5)
Failures: 5 (UNKNOWN: 0, LOW: 1, MEDIUM: 1, HIGH: 3, CRITICAL: 0)

DS-0001 (MEDIUM): Specify a tag in the 'FROM' statement for image 'os-'
══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated.

See https://avd.aquasec.com/misconfig/ds-0001
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Containerfile:48
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  48 [ FROM os-${OSOUTPUT} AS operational
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Version

$ trivy --version
Version: 0.76.2
Check Bundle:
  Digest: sha256:b591e9190cff4aa4e385b1a25bccfd9ecf178d3c77fd194e1410b7ce7e1df058
  DownloadedAt: 2026-11-06 18:40:38.201855619 +0000 UTC

Checklist

• Read the documentation regarding wrong detection
• Ran Trivy with -f json that shows data sources and confirmed that the security advisory in data sources was correct

[nikpivkin]

Hi @jhsesu !

Thanks for the report. Track #11592

[jhsesu]

Hi @nikpivkin,
Thank you for tracking this and for the quick response! I will keep an eye on issue #11592 for updates.
Best regards.