jfrog / jfrog/jfrog-cli-security
jf docker scan fails with "is not a docker command" when --min-severity flag is used without a value
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
The jf docker scan command fails with the misleading error message docker: 'dsl.exampl.com:5002/app:1.18.4' is not a docker command when the --min-severity flag is provided but no value is specified. This behavior prevents the user from receiving an immediate, clear error about the missing value for the flag. Instead, it seems to cause the command to be incorrectly parsed and passed to the underlying Docker client. Discovered in a CI/CD pipeline where the MIN_SEVERITY variable was not set.
This bug makes debugging difficult when running in a pipeline as the error message points to the wrong root cause.
Current behavior
jf docker scan dsl.example.com:5002/app:1.18.4 --min-severity docker: 'dsl.example.com:5002/app:1.18.4' is not a docker command. See 'docker --help' exit status 1
Reproduction steps
jf docker scan dsl.example.com:5002/app:1.18.4 --min-severity docker: 'dsl.example.com:5002/app:1.18.4' is not a docker command. See 'docker --help' exit status 1
Expected behavior
Error: the --min-severity flag requires a value
JFrog CLI version
2.78.2
Operating system type and version
Linux, MacOs
JFrog Artifactory version
No response
JFrog Xray version
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the jf docker scan entry point and reproduce the command with --min-severity but no value using the example image reference. Trace how the flag and image argument are parsed, then verify that the command reports that --min-severity requires a value instead of forwarding the image to Docker.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100