Skip to main content
COPY to a relative destination without WORKDIR set.
PropertyValue
SeverityWarning
CategoryBest Practice
DefaultEnabled
Auto-fixYes (suggestion --fix-unsafe; safe with --slow-checks)

​
Description

While copying to a relative path is not problematic per se, errors happen when changes are introduced to the WORKDIR without updating the destination of the COPY command. It is assumed that when a WORKDIR is set, the programmer will make sure it works well together with the COPY destinations.

​
Examples

​
Problematic code

FROM scratch
COPY foo bar

​
Correct code

FROM scratch
COPY foo /bar
or: 
FROM scratch
WORKDIR /
COPY foo bar

​
Auto-fix

Inserts an explicit WORKDIR instruction before the first COPY with a relative destination.
  • Fast path (no registry access): suggests WORKDIR /app as a conventional default (FixSuggestion, requires --fix-unsafe).
  • With --slow-checks: resolves the base image’s actual WORKDIR from the registry and uses that value (FixSafe, applied with --fix).
# Before
FROM python:3.12
COPY requirements.txt .

# After (with --fix-unsafe, fast path)
FROM python:3.12
WORKDIR /app
COPY requirements.txt .

# After (with --fix --slow-checks, base image has WORKDIR /usr/src/app)
FROM python:3.12
WORKDIR /usr/src/app
COPY requirements.txt .

​
Reference