Skip to content

ACR Task dependency scanner fails when --file path contains a space #871

@obriegr0909

Description

@obriegr0909

Describe the bug
The ACR Task dependency scanner fails when the --file (Dockerfile path) contains a space. The scanner appears to split the path on the first space character, treating everything before the space as the full file path. This causes the build to fail at the "Scanning for dependencies" phase before Docker build even starts. It also prevents baseImageDependencies from being populated at task creation time, meaning base image triggers silently don't work.

To Reproduce
Steps to reproduce the behavior:

  1. Have a Git repository containing a Dockerfile at a path with a space, e.g. src/My Projects/App/Dockerfile
  2. Create an ACR Task pointing at that path:
az acr task create \
  --registry myregistry \
  --resource-group myresourcegroup \
  --name test-space-in-path \
  --image "test/space-bug:latest" \
  --context "https://dev.azure.com/myorg/myproject/_git/myrepo" \
  --file "src/My Projects/App/Dockerfile" \
  --git-access-token "$PAT" \
  --base-image-trigger-enabled true \
  --base-image-trigger-type Runtime \
  --commit-trigger-enabled false \
  --pull-request-trigger-enabled false

Note: the task creates successfully but baseImageDependencies is null in the output (the scanner couldn't parse the Dockerfile to find FROM lines).
3. Run the task:

az acr task run --registry myregistry --name test-space-in-path
  1. The run fails during dependency scanning with:
Scanning for dependencies...
error opening dockerfile: src/My, error: open src/My: no such file or directory
failed to run step ID: build: failed to scan dependencies: exit status 1

The scanner truncated src/My Projects/App/Dockerfile to src/My by splitting on the space.

Expected behavior
The dependency scanner should handle file paths containing spaces. The Dockerfile path src/My Projects/App/Dockerfile should be treated as a single path argument. The task should build successfully and baseImageDependencies should be populated so that base image triggers work.

Any relevant environment information

OS: Ubuntu (ACR agent); CLI run from Linux (Ubuntu)
Azure CLI version: 2.75.0
Docker version: N/A (failure occurs before Docker build)
Datetime (UTC): 2026-02-26T20:46:06Z
Registry: Basic SKU, East US
Additional context

This also silently breaks base image triggers. At task creation time, baseImageDependencies returns null because the scanner can't parse the Dockerfile. The task creates without error, but the base image trigger will never fire since no dependencies were detected. There is no warning about this.
Quoting or escaping the path in --file does not help — the split appears to happen inside the ACR agent's dependency scanner, not in shell argument parsing.
Workaround: use --context /dev/null with a multi-step task YAML that clones the repo manually and copies the Dockerfile to a space-free path at runtime. This loses base image trigger functionality entirely.
The affected repository has had this directory structure for years. Renaming is not feasible as it would require changes across the entire codebase.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugFeature bugs that should be fixed.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions