From 23a4e6267688c948ef0217d8d3a808487f4137f9 Mon Sep 17 00:00:00 2001 From: Jasdeep Singh Bhalla Date: Wed, 1 Jul 2026 01:42:54 -0700 Subject: [PATCH] Add Dockerfile.rego to validate image builds (#8744) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit OPA's Docker images are built with `docker buildx`, which supports Rego-based build policies via `Dockerfile.rego`. Adding this file lets OPA validate its own image builds using OPA — enforcing that base images come only from the approved chainguard namespace. Adds `Dockerfile.rego` with a single deny rule: base images must come from `docker.io/chainguard/`. This covers all four variants built in the Makefile (`glibc-dynamic`, `glibc-dynamic:latest-dev`, `static`, `busybox`). Local build context access (used by `COPY`) is allowed implicitly when no deny rule fires. The policy follows the same `decision` shape used by buildx's own `policy/default.rego`. No changes to other files are needed — buildx automatically evaluates `Dockerfile.rego` when present. Closes #8401. Signed-off-by: jasdeepbhalla --- Dockerfile.rego | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 Dockerfile.rego diff --git a/Dockerfile.rego b/Dockerfile.rego new file mode 100644 index 0000000000..04eef065c0 --- /dev/null +++ b/Dockerfile.rego @@ -0,0 +1,16 @@ +# regal ignore:directory-package-mismatch +package docker + +import rego.v1 + +# Deny base images that are not from the approved chainguard namespace. +deny_msgs contains msg if { + input.image + not startswith(input.image.fullRepo, "docker.io/chainguard/") + msg := sprintf("base image %q is not allowed; only docker.io/chainguard images are permitted", [input.image.ref]) +} + +decision := { + "allow": count(deny_msgs) == 0, + "deny_msg": [msg | some msg in deny_msgs], +}