DL3002 : Last USER should not be root

Description

The final USER instruction in each stage should not specify a root user (root or 0).

Goals

• Encourage running containers as non-root to improve security.
• Prevent accidental privilege escalation in image builds.

Specification

1. For each build stage, identify the last USER instruction before the next FROM or end of file.
2. If that instruction sets the user to root, 0, or begins with root: or 0:, emit DL3002 for the line containing the instruction.

(c) 2025 Asymmetric Effort, LLC. scaldwell@asymmetric-effort.com