p/docker-compose does not detect service explicitly configured with user: root

[webpwnized]

Describe the bug

The Semgrep Community p/docker-compose ruleset does not report a finding when a Docker Compose service is explicitly configured to run as root using:

user: root

Semgrep successfully parses and scans the Docker Compose file, but none of the six rules currently loaded by p/docker-compose detect the root runtime user.

This appears to be a false negative or coverage gap in the Docker Compose Community ruleset.

A related condition in a Dockerfile is detected by the Docker ruleset using:

dockerfile.security.last-user-is-root.last-user-is-root

However, there does not appear to be equivalent coverage for a Docker Compose service explicitly configured with user: root.

To Reproduce

Create a Docker Compose file containing a service explicitly configured to run as root:

services:
  www:
    container_name: www
    image: docker.io/webpwnized/dragonfly:www

    user: root

    security_opt:
      - no-new-privileges:true

    ports:
      - 127.0.0.1:80:80
      - 127.0.0.1:8888:80

    networks:
      - httpnet

networks:
  httpnet:

Run Semgrep Community Edition using the p/docker-compose ruleset:

docker run --rm \
  -v "$(pwd)/.build:/mnt/src:ro" \
  docker.io/semgrep/semgrep:latest \
  semgrep scan \
    --config p/docker-compose \
    /mnt/src \
    --error

Semgrep reports:

Scanning 1 file tracked by git with 6 Code rules:
Scanning 1 file with 6 yaml rules.

Scan Summary

Scan completed successfully.
Findings: 0 (0 blocking)
Rules run: 6
Targets scanned: 1
Parsed lines: ~100.0%

Ran 6 rules on 1 file: 0 findings.

The Docker Compose file is therefore discovered and parsed successfully, but the explicit root user configuration is not detected.

Expected behavior

I would expect the Docker Compose security ruleset to report a finding when a service explicitly overrides the container image user with:

user: root

This configuration causes the service to run as root, including when the underlying container image specifies a non-root user.

Ideally, p/docker-compose would provide coverage equivalent in intent to the existing Dockerfile rule:

dockerfile.security.last-user-is-root.last-user-is-root

for the Docker Compose service-level user configuration.

Screenshots

I can provide screenshots of the Docker Compose configuration and Semgrep CLI output if needed.

What is the priority of the bug to you?

• P0: blocking your adoption of Semgrep or workflow
• P1: important to fix or quite annoying
• P2: regular bug that should get fixed

Environment

Semgrep is being run using the official Docker image:

docker.io/semgrep/semgrep:latest

The scan uses Semgrep Community Edition and the public Registry ruleset:

p/docker-compose

The source directory is mounted read-only into the scanner container:

-v "$(pwd)/.build:/mnt/src:ro"

Semgrep version can be obtained with:

docker run --rm docker.io/semgrep/semgrep:latest semgrep --version

Use case

I am building a GitOps-based SAST reference architecture where Semgrep Community Edition runs as an ephemeral scanner in CI/CD pipelines.

Broad Community rulesets are used for audit coverage, while selected high-confidence rules can be promoted to blocking CI/CD controls.

Detecting Docker Compose services explicitly configured to run as root would allow this common container security condition to be identified through the Community ruleset and, where appropriate, promoted to a blocking control without requiring organizations to maintain a custom Semgrep rule.