Dockerfile provider fails on standard multi-stage FROM ... AS ... syntax

[itsec38]

Support guidelines

• I've read the support guidelines

I've found a bug and checked that ...

• ... the documentation does not mention anything about my problem
• ... there are no open or closed issues that are related to my problem

Description

Hello,

I believe I may have found an issue with the Dockerfile provider in DIUN v4.33.0.

Environment

• DIUN v4.33.0
• Dockerfile provider

Problem

A Dockerfile containing a multi-stage build fails to be processed correctly.

Example:

FROM nginx:latest AS final
COPY ./config /etc/nginx

DIUN reports errors and fails to detect the image correctly.

Workaround

When the stage alias is removed:

FROM nginx:latest
COPY ./config /etc/nginx

the Dockerfile is processed correctly and image detection works as expected.

Investigation

To isolate the issue, I generated a DIUN-specific version of the Dockerfile where the only modification was removing the AS portion from FROM instructions.

No other instructions were modified (COPY, RUN, etc.).

After removing the stage aliases, DIUN started working correctly.

Expected Behavior

Multi-stage Dockerfiles using standard Docker syntax such as:

FROM image:tag AS stage-name

should be parsed correctly, as this is a common and officially supported Docker feature.

Could you please confirm whether this is a bug or an intentional limitation of the Dockerfile provider?

Thank you for your work on DIUN.

Best regards

Expected behaviour

Hello,

I believe I may have found an issue with the Dockerfile provider in DIUN v4.33.0.

Environment

• DIUN v4.33.0
• Dockerfile provider

Problem

A Dockerfile containing a multi-stage build fails to be processed correctly.

Example:

FROM nginx:latest AS final
COPY ./config /etc/nginx

DIUN reports errors and fails to detect the image correctly.

Workaround

When the stage alias is removed:

FROM nginx:latest
COPY ./config /etc/nginx

the Dockerfile is processed correctly and image detection works as expected.

Investigation

To isolate the issue, I generated a DIUN-specific version of the Dockerfile where the only modification was removing the AS portion from FROM instructions.

No other instructions were modified (COPY, RUN, etc.).

After removing the stage aliases, DIUN started working correctly.

Expected Behavior

Multi-stage Dockerfiles using standard Docker syntax such as:

FROM image:tag AS stage-name

should be parsed correctly, as this is a common and officially supported Docker feature.

Could you please confirm whether this is a bug or an intentional limitation of the Dockerfile provider?

Thank you for your work on DIUN.

Best regards

Actual behaviour

The Dockerfile provider fails to process a standard multi-stage Dockerfile using the official Docker syntax:

FROM image:tag AS stage-name

The image is not detected correctly and DIUN reports parsing errors.

When the stage alias is removed and the Dockerfile is changed to:

FROM image:tag

the same Dockerfile is processed successfully.

No other instructions were modified.

Steps to reproduce

1. Create a Dockerfile:

FROM nginx:latest AS final

COPY ./config /etc/nginx

2. Configure DIUN Dockerfile provider to monitor this Dockerfile.

3. Run DIUN.

4. Observe that the Dockerfile is not processed correctly and image detection fails.

5. Remove only the "AS final" part:

FROM nginx:latest

6. Run DIUN again.

7. Observe that image detection works correctly.

Diun version

DIUN: v4.33.0 Provider: Dockerfile

Docker info

Client: Docker Engine - Community
 Version:    29.5.1
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.34.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v5.1.3
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

Server:
 Containers: 10
  Running: 10
  Paused: 0
  Stopped: 0
 Images: 14
 Server Version: 29.5.1
 Storage Driver: overlayfs
  driver-type: io.containerd.snapshotter.v1
 Logging Driver: json-file
 Cgroup Driver: systemd
 Cgroup Version: 2
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local splunk syslog
 CDI spec directories:
  /etc/cdi
  /var/run/cdi
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 77c84241c7cbdd9b4eca2591793e3d4f4317c590
 runc version: v1.3.5-0-g488fc13e
 init version: de40ad0
 Security Options:
  apparmor
  seccomp
   Profile: builtin
  cgroupns
 Kernel Version: 6.12.88+deb13-amd64
 Operating System: Debian GNU/Linux 13 (trixie)
 OSType: linux
 Architecture: x86_64
 CPUs: 4
 Total Memory: 5.714GiB
 Name: hvg-doc001
 ID: c56ade0e-3f6a-4e6b-b317-055a89fa5f41
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Experimental: false
 Insecure Registries:
  ::1/128
  127.0.0.0/8
 Live Restore Enabled: false
 Firewall Backend: iptables
  EnableUserlandProxy: true
  UserlandProxyPath: /usr/bin/docker-proxy

Docker Compose config

services:
  app:
    command:
      - serve
    container_name: diun8prd_app
    environment:
      DIUN_DB_PATH: /data/diun.db
      DIUN_DEFAULTS_NOTIFYON: new,update
      DIUN_DEFAULTS_SORTTAGS: reverse
      DIUN_DEFAULTS_WATCHREPO: "false"
      DIUN_NOTIF_MAIL_FROM: doo@example.com
      DIUN_NOTIF_MAIL_HOST: docker.localhost
      DIUN_NOTIF_MAIL_INSECURESKIPVERIFY: "true"
      DIUN_NOTIF_MAIL_PORT: "25"
      DIUN_NOTIF_MAIL_SSL: "false"
      DIUN_NOTIF_MAIL_TEMPLATEBODY: <p><b>Host:</b> {{ .Meta.Hostname }}</p><p><b>Image:</b> {{ .Entry.Image }}</p><p><b>Provider:</b> {{ .Entry.Provider }}</p><p>An update is available.</p>
      DIUN_NOTIF_MAIL_TEMPLATETITLE: '[DIUN] Update {{ .Entry.Image }} available'
      DIUN_NOTIF_MAIL_TO: too@example.com
      DIUN_PROVIDERS_DOCKER: "true"
      DIUN_PROVIDERS_DOCKER_ENDPOINT: unix:///var/run/docker.sock
      DIUN_PROVIDERS_DOCKER_WATCHBYDEFAULT: "true"
      DIUN_PROVIDERS_DOCKER_WATCHSTOPPED: "false"
      DIUN_PROVIDERS_DOCKERFILE: "true"
      DIUN_PROVIDERS_DOCKERFILE_PATTERNS: /workspace/*/*/Dockerfile.diun
      DIUN_WATCH_FIRSTCHECKNOTIF: "false"
      DIUN_WATCH_JITTER: 30s
      DIUN_WATCH_RUNONSTARTUP: "true"
      DIUN_WATCH_SCHEDULE: 0 */6 * * *
      DIUN_WATCH_WORKERS: "20"
      LOG_JSON: "false"
      LOG_LEVEL: info
      TZ: Europe/Berlin
    extra_hosts:
      - docker.localhost=172.18.0.1
    hostname: diun8prd9app
    healthcheck:
      test:
        - CMD
        - diun
        - healthcheck
      timeout: 5s
      interval: 30s
      retries: 3
      start_period: 1m0s
    image: crazymax/diun:4
    labels:
      diun.enable: "true"
      traefik.enable: "false"
    networks:
      locnet: null
      webnet: null
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        read_only: true
        bind: {}
      - type: volume
        source: app
        target: /data
        volume: {}
      - type: bind
        source: /home/github-runner/actions/runner/_work
        target: /workspace
        read_only: true
        bind: {}
networks:
  locnet:
    name: locnet
    external: true
  webnet:
    name: webnet
    external: true
volumes:
  app:
    name: diun8prd_app

Logs

Mon, 08 Jun 2026 17:18:51 CEST ERR Cannot parse image error="parsing image  failed: invalid reference format" image= provider=dockerfile

Additional info

No response