Security / Public reference

Remote script piped to a shell

A Dockerfile RUN instruction that downloads a script with curl or wget and pipes it to sh or bash.

What you need to supply

The Dockerfile text. The check does not fetch the remote script.

If it reports a finding

High severity. The suggested next step is to download the script, review it, and pin a checksum before running it.

What this does not prove

A download that is saved to a file and not piped to a shell is not this finding.

Instruction that this check is written to notice

RUN curl -fsSL https://example.com/install.sh | bash

All review checks. Reading this page does not submit your infrastructure.