[shinsenter]

Goal

Docker Scout reports CVE-2026-4738 (alpine/zlib 1.3.2-r1) on shinsenter/s6-overlay:dev-v3.2.3.2. The image is built FROM scratch and contains only /s6, so the finding is a false positive.

Cause

• ARG BUILDKIT_SBOM_SCAN_STAGE=true makes BuildKit attach the SBOM of every intermediate stage (AdditionalSPDXs).
• For s6-overlay that adds the base-os stage, which lists zlib 1.3.2-r1 from the alpine:latest layer. The package is not in the final image, and base-os already upgrades it to 1.4-r0.

Scope

• Remove ARG BUILDKIT_SBOM_SCAN_STAGE=true from the 31 dockerfiles in src/php and src/webapps.
• Keep BUILDKIT_SBOM_SCAN_CONTEXT and sbom: true in the workflow, so the SBOM of the final image stays.

Risks

• The buildfile hash of most images changes, so the next run rebuilds nearly all images once.
• If dockerfile-x handles ARG differently from what I expect, AdditionalSPDXs may remain. Check the SBOM of s6-overlay after the next build.

Tests

• tests/run.sh passes (lint 101, versions 86, backports 66, config 6, scaling 63, ssh 6, defaults 6).
• No image was built locally. The effect on the SBOM and on Docker Scout is not verified yet.