Problem
Relative WORKDIR values depend on prior directory state and can change unexpectedly across stages or base-image updates. Action: declare WORKDIR with absolute paths in every stage.
Description
Absolute paths keep intent explicit and behavior deterministic. Relative paths can concatenate with inherited work directories and silently move files into unexpected locations. Action: audit Dockerfiles for non-absolute WORKDIR usage and fix each occurrence.
Path drift affects more than one line. It breaks COPY destinations, RUN commands, and startup scripts in ways that are expensive to diagnose later. Action: review WORKDIR, COPY, and entrypoint paths together in the same pull request.
Tooling and policy engines reason more reliably about absolute paths, which improves automated verification and reduces reviewer ambiguity. Action: enforce an absolute-WORKDIR lint rule and block merges on violations.
Use this rollout checklist to stabilize directory behavior:
- Require
WORKDIRpaths to start with/in every stage. - Align
COPYdestinations with declared stage directories. - Keep entrypoint and script paths consistent with
WORKDIR. - Document stage directory conventions in service templates.
Treat verification as part of the rule, not optional cleanup. Action: automate a static check, a build check, and a runtime smoke check in the default CI pipeline so regressions are caught before review.
- Static check: fail when the disallowed pattern appears in Dockerfile or manifest.
- Build check: run a minimal image build to confirm the secure pattern is valid.
- Runtime check: start the workload and assert expected behavior with one deterministic probe.
Examples of code
Problematic code
FROM ubuntu:24.04
WORKDIR app
COPY . .Verified code
FROM ubuntu:24.04
WORKDIR /app
COPY . .