False positive "--no-install-recommends" where it is present at the end of the command

[daliborfilus]

Description

────────────────────────────────────────
HIGH: '--no-install-recommends' flag is missed: 'env DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y tzdata postgresql-10 --no-install-recommends && rm -rf /var/lib/apt/lists/*'
════════════════════════════════════════
'apt-get' install should use '--no-install-recommends' to minimize image size.
See https://avd.aquasec.com/misconfig/ds029
────────────────────────────────────────
 Dockerfile:24-26
────────────────────────────────────────
  24 ┌ RUN --mount=type=cache,mode=0755,target=/var/cache/apt,sharing=locked \
  25 │     --mount=type=cache,mode=0755,target=/var/lib/apt,sharing=locked \
  26 └     env DEBIAN_FRONTEND=noninteractive apt-get update && apt-get install -y tzdata postgresql-10 --no-install-recommends && rm -rf /var/lib/apt/lists/*
────────────────────────────────────────

What did you expect to happen?

Nothing.

What happened instead?

Error is thrown.

Output of trivy -v:

Using docker image sha256:ef0fae9e1a4dfc67cee3eb3db365b0ffb3bb8c00acf8eb18f5228e8a50df3adc for docker.io/aquasec/trivy:latest with digest aquasec/trivy@sha256:de367bfafb18b42df66a85ba896378aecf0c9cf227b10488e66a294d109234a6 

❯ docker run --rm -ti aquasec/trivy@sha256:de367bfafb18b42df66a85ba896378aecf0c9cf227b10488e66a294d109234a6 -v
Version: 0.40.0

[daliborfilus]

Btw https://avd.aquasec.com/misconfig/ds029 returns 404.

[simar7]

Btw https://avd.aquasec.com/misconfig/ds029 returns 404.

This should be fixed now. We will look into the false positive issue shortly.

[OldShaterhan]

+1 for changing this behaviour!

[simar7]

Opening an issue here #4462 to track it.