feat(rule): add security rules for dangerous capabilities and host namespaces

.github/workflows/ci.yml

@@ -52,6 +52,23 @@ jobs:
       - run: make docs-content
       - run: git diff --exit-code README.md
 
+  dockerflags:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
+        with:
+          go-version-file: go.mod
+      # The flag table is generated from the docker/cli pinned in cmd/dockerflagsgen/go.mod, so a
+      # diff here means Docker changed the flags decolint reads "runArgs" with — which is what a
+      # renovate bump of that module is meant to surface.
+      - run: make dockerflags
+      - run: git diff --exit-code dockerargs/runflags_gen.go
+
   dogfooding:
     runs-on: ubuntu-latest
     permissions:

CONTRIBUTING.md

@@ -154,6 +154,25 @@ The layout of everything the generator writes lives in
 [`cmd/docgen/templates/`](cmd/docgen/templates/), so changing how a
 page looks is an edit to a template rather than to Go code.
 
+## The "docker run" flag table
+
+The devcontainer tooling passes `runArgs` to `docker run` unchanged, so
+reading it means knowing which flags take a value: `["--label",
+"--cap-drop=ALL"]` drops no capability, because Docker takes the second
+entry as the label's value. [`dockerargs/runflags_gen.go`](dockerargs/runflags_gen.go)
+is that table, generated by [`cmd/dockerflagsgen`](cmd/dockerflagsgen/)
+from the flags docker/cli registers, so it can disagree with Docker only
+by being older. Regenerate it with `make dockerflags`.
+
+The generator is a module of its own, because it imports docker/cli,
+which decolint neither imports nor ships. That also puts it outside
+`./...`, so `go build`, `go test` and `make lint` at the repository root
+leave it alone. Renovate updates that module like any other dependency,
+and CI's `dockerflags` job regenerates the table and fails on a diff —
+so a Docker release that changes one of these flags arrives as a
+reviewable change to this file rather than as a finding that is quietly
+wrong.
+
 When implementing or reviewing rules, consult the Dev Container
 specification at [containers.dev](https://containers.dev/) to confirm
 the behavior matches the spec:

Makefile

@@ -54,6 +54,10 @@ docs-serve: docs-content docs-syntax ## Serve the documentation site with live r
 	# /decolint/ and leave http://localhost:$(DOCS_PORT)/ a 404. Override it for local preview.
 	$(HUGO) server --source docs --port $(DOCS_PORT) --baseURL http://localhost:$(DOCS_PORT)/
 
+.PHONY: dockerflags
+dockerflags: ## Regenerate the "docker run" flag table the runArgs rules read
+	go generate ./dockerargs
+
 .PHONY: docs-content
 docs-content: ## Regenerate the rule pages, README-derived pages, and README rules table
 	go run ./cmd/docgen

README.md

@@ -154,7 +154,7 @@ runs without configuration; the rest are `off` until you enable them:
 | Category | Default | Rules |
 | --- | --- | --- |
 | [`correctness`](https://bare-devcontainer.github.io/decolint/rules/#correctness) | `error` | 13 |
-| [`security`](https://bare-devcontainer.github.io/decolint/rules/#security) | `off` | 8 |
+| [`security`](https://bare-devcontainer.github.io/decolint/rules/#security) | `off` | 11 |
 | [`reproducibility`](https://bare-devcontainer.github.io/decolint/rules/#reproducibility) | `off` | 4 |
 | [`style`](https://bare-devcontainer.github.io/decolint/rules/#style) | `off` | 2 |
 <!-- /decolint:categories -->

cmd/dockerflagsgen/go.mod

@@ -0,0 +1,99 @@
+module github.com/bare-devcontainer/decolint/cmd/dockerflagsgen
+
+go 1.26.5
+
+require (
+	github.com/docker/cli v29.6.2+incompatible
+	github.com/spf13/cobra v1.10.2
+	github.com/spf13/pflag v1.0.10
+)
+
+require (
+	dario.cat/mergo v1.0.2 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/clipperhouse/uax29/v2 v2.2.0 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/containerd/log v0.1.0 // indirect
+	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/cli-docs-tool v0.11.0 // indirect
+	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.9.8 // indirect
+	github.com/docker/go-connections v0.8.1 // indirect
+	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
+	github.com/docker/go-metrics v0.0.1 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fvbommel/sortorder v1.1.0 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
+	github.com/mattn/go-runewidth v0.0.27 // indirect
+	github.com/moby/docker-image-spec v1.3.1 // indirect
+	github.com/moby/go-archive v0.2.1 // indirect
+	github.com/moby/moby/api v1.55.0 // indirect
+	github.com/moby/moby/client v0.5.1 // indirect
+	github.com/moby/patternmatcher v0.6.1 // indirect
+	github.com/moby/swarmkit/v2 v2.1.2 // indirect
+	github.com/moby/sys/atomicwriter v0.1.0 // indirect
+	github.com/moby/sys/capability v0.4.0 // indirect
+	github.com/moby/sys/sequential v0.7.0 // indirect
+	github.com/moby/sys/signal v0.7.1 // indirect
+	github.com/moby/sys/symlink v0.3.0 // indirect
+	github.com/moby/sys/user v0.4.1 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/term v0.5.2 // indirect
+	github.com/morikuni/aec v1.1.0 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
+	github.com/prometheus/client_golang v1.20.5 // indirect
+	github.com/prometheus/client_model v0.6.1 // indirect
+	github.com/prometheus/common v0.62.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/sirupsen/logrus v1.9.4 // indirect
+	github.com/tonistiigi/go-rosetta v0.0.0-20220804170347-3f4430f2d346 // indirect
+	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
+	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
+	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
+	go.etcd.io/raft/v3 v3.6.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.69.0 // indirect
+	go.opentelemetry.io/otel v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.44.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.44.0 // indirect
+	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/trace v1.44.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.10.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sync v0.22.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
+	golang.org/x/text v0.40.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260630182238-925bb5da69e7 // indirect
+	google.golang.org/grpc v1.82.0 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+	tags.cncf.io/container-device-interface v1.1.0 // indirect
+)