Remote ADD without a check (ARCH10004)

Key config.docker.remote-add · Severity warning · Category security · CWE CWE-494

ADD <url> puts whatever the server returns that day into the image. A moved file, a hijacked domain or a man in the middle changes the image without a line of the Dockerfile changing.

Incorrect

FROM alpine:3.20
ADD https://downloads.example.com/cli/cli-2.4.1.tar.gz /tmp/cli.tar.gz
RUN tar -xzf /tmp/cli.tar.gz -C /usr/local/bin
USER 65534

Correct

FROM alpine:3.20
ADD --checksum=sha256:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08 \
    https://downloads.example.com/cli/cli-2.4.1.tar.gz /tmp/cli.tar.gz
RUN tar -xzf /tmp/cli.tar.gz -C /usr/local/bin
USER 65534

Fix

Pin the content: ADD --checksum=sha256:..., or download with curl and check it with sha256sum -c before use. A vetted file in the repository can be COPYed instead.

Not flagged

• ADD --checksum=....
• A remote ADD whose file a later RUN of the same stage verifies by name (sha256sum -c, gpg --verify, cosign verify, minisign -V).