Dockerfile: Use Absolute Paths for WORKDIR

Relative WORKDIR values can produce ambiguous paths across layers. Use absolute WORKDIR paths for clear and repeatable Docker builds.

Problem

Relative WORKDIR values depend on prior directory state and can change unexpectedly across stages or base-image updates. Action: declare WORKDIR with absolute paths in every stage.

Description

Absolute paths keep intent explicit and behavior deterministic. Relative paths can concatenate with inherited work directories and silently move files into unexpected locations. Action: audit Dockerfiles for non-absolute WORKDIR usage and fix each occurrence.

Path drift affects more than one line. It breaks COPY destinations, RUN commands, and startup scripts in ways that are expensive to diagnose later. Action: review WORKDIR, COPY, and entrypoint paths together in the same pull request.

Tooling and policy engines reason more reliably about absolute paths, which improves automated verification and reduces reviewer ambiguity. Action: enforce an absolute-WORKDIR lint rule and block merges on violations.

Use this rollout checklist to stabilize directory behavior:

  • Require WORKDIR paths to start with / in every stage.
  • Align COPY destinations with declared stage directories.
  • Keep entrypoint and script paths consistent with WORKDIR.
  • Document stage directory conventions in service templates.

Treat verification as part of the rule, not optional cleanup. Action: automate a static check, a build check, and a runtime smoke check in the default CI pipeline so regressions are caught before review.

  • Static check: fail when the disallowed pattern appears in Dockerfile or manifest.
  • Build check: run a minimal image build to confirm the secure pattern is valid.
  • Runtime check: start the workload and assert expected behavior with one deterministic probe.

Examples of code

Problematic code

FROM ubuntu:24.04
WORKDIR app
COPY . .

Verified code

FROM ubuntu:24.04
WORKDIR /app
COPY . .

Related rules