rules:
- id: last-user-is-root
  patterns:
    - pattern: USER root
    - pattern-not-inside:
        patterns:
          - pattern: |
              USER root
              ...
              USER $X
          - metavariable-pattern:
              metavariable: $X
              patterns:
                - pattern-not: root
  message: >-
    The last user in the container is 'root'. This is a security
    hazard because if an attacker gains control of the container
    they will have root access. Switch back to another user after
    running commands as 'root'.
  severity: ERROR
  languages: 
    - dockerfile 
  metadata:
    cwe:
    - 'CWE-269: Improper Privilege Management'
    source-rule-url: https://github.com/hadolint/hadolint/wiki/DL3002
    references:
    - https://github.com/hadolint/hadolint/wiki/DL3002
    category: security
    technology:
    - dockerfile
    confidence: MEDIUM
    owasp:
    - A04:2021 - Insecure Design
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: MEDIUM