dependabot / dependabot/dependabot-core
Support for Docker multi-stage builds
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 155
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Docker has a feature called [multi-stage builds](https://docs.docker.com/build/building/multi-stage/) where Docker images can be split up and referenced later by name.
Dependabot currently supports updates to images using the FROM directive, but naming the images may cause the update to not work properly.
Another related issue is that Dependabot does not currently update images that have [two FROM directives](https://github.com/dependabot/dependabot-core/issues/6700) in a Dockerfile, which is common with multi-stage builds, as are the [COPY](https://github.com/dependabot/dependabot-core/issues/5103) and [ARG](https://github.com/dependabot/dependabot-core/issues/2057) directives
We should confirm what level of support we have for Docker images.
Contributor guide
Research direction
Start with Dockerfile handling for the FROM, COPY, and ARG directives, and compare current behavior with Docker's multi-stage build documentation. Review the related issues 6700, 5103, and 2057. Done means establishing the current level of image-update support and covering named stages and multiple FROM directives with appropriate tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, dockerfile
- Domain
- devops
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100