dependabot / dependabot/dependabot-core

Support for Docker multi-stage builds

Open
#7,640 4 comments 23 reactions 0 assignees View on GitHub
L: docker T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
155

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

Docker has a feature called [multi-stage builds](https://docs.docker.com/build/building/multi-stage/) where Docker images can be split up and referenced later by name.

Dependabot currently supports updates to images using the FROM directive, but naming the images may cause the update to not work properly.

Another related issue is that Dependabot does not currently update images that have [two FROM directives](https://github.com/dependabot/dependabot-core/issues/6700) in a Dockerfile, which is common with multi-stage builds, as are the [COPY](https://github.com/dependabot/dependabot-core/issues/5103) and [ARG](https://github.com/dependabot/dependabot-core/issues/2057) directives

We should confirm what level of support we have for Docker images.

Contributor guide

Open the contributing guide

Research direction

Start with Dockerfile handling for the FROM, COPY, and ARG directives, and compare current behavior with Docker's multi-stage build documentation. Review the related issues 6700, 5103, and 2057. Done means establishing the current level of image-update support and covering named stages and multiple FROM directives with appropriate tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, dockerfile
Domain
devops
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.