prompt: We are currently solving the following issue within our repository. Here is the issue text:
  --- BEGIN ISSUE ---
  Error while checking Dockerfile USER set with env variable
  **Describe the bug**
  The **checkov** CLI return an error when analyzing a Dockerfile with USER set according to an ENV variable. 
  
  **To Reproduce**
  Steps to reproduce the behavior:
  1. Get this snippet :
  ```Dockerfile
  FROM python:alpine
  
  WORKDIR /app
  COPY requirements.txt .
  RUN pip install -r requirements.txt
  
  ENV USERNAME=app
  RUN addgroup -S ${USERNAME} && adduser -s /sbin/nologin -S ${USERNAME} -G ${USERNAME} && chown -R ${USERNAME} /app
  USER ${USERNAME}
  
  COPY --chown=${USERNAME} script.py .
  
  CMD python3 script.py
  ```
  2. Run cli command  'checkov -f Dockerfile'
  3. See error
  
  **Expected behavior**
  No error.
  
  **Screenshots**
  <img width="750" alt="" src="https://user-images.githubusercontent.com/44492274/115271564-c380b080-a13d-11eb-9c4d-cb086e3bd9fd.png">
  
  **Desktop (please complete the following information):**
   - OS: macOS Big Sur 11.2.3
   - Checkov Version 2.0.55
  
  --- END ISSUE ---
  
  Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
  --- BEGIN FILES ---
  Path: `checkov/dockerfile/checks/RootUser.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckCategories, CheckResult
  2 from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck
  3 
  4 
  5 class RootUser(BaseDockerfileCheck):
  6     def __init__(self):
  7         name = "Ensure the last USER is not root"
  8         id = "CKV_DOCKER_8"
  9         supported_instructions = ["USER"]
  10         categories = [CheckCategories.APPLICATION_SECURITY]
  11         super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)
  12 
  13     def scan_entity_conf(self, conf):
  14         contents = conf.get("USER")
  15 
  16         if contents:
  17             last_user = contents[-1]
  18             if last_user["value"] == "root":
  19                 return CheckResult.FAILED, last_user
  20 
  21             return CheckResult.PASSED, last_user
  22 
  23         return CheckResult.UNKNOWN, None
  24 
  25 
  26 check = RootUser()
  27
  ```
  
  Path: `checkov/dockerfile/checks/MaintainerExists.py`
  Content:
  ```
  1 from checkov.common.models.enums import CheckCategories, CheckResult
  2 from checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck
  3 
  4 
  5 class MaintainerExists(BaseDockerfileCheck):
  6     def __init__(self):
  7         name = "Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated)"
  8         id = "CKV_DOCKER_6"
  9         supported_instructions = ["MAINTAINER"]
  10         categories = [CheckCategories.CONVENTION]
  11         super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)
  12 
  13     def scan_entity_conf(self, conf):
  14         for instruction, content in conf.items():
  15             if instruction == "MAINTAINER":
  16                 return CheckResult.FAILED, content[0]
  17         return CheckResult.PASSED, None
  18 
  19 
  20 check = MaintainerExists()
  21
  ```
  --- END FILES ---
  
  Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.
  
  Here is an example:
  
  ```diff
  diff --git a/examples/server_async.py b/examples/server_async.py
  --- a/examples/server_async.py
  +++ b/examples/server_async.py
  @@ -313,4 +313,4 @@
   
   
   if __name__ == "__main__":
  -    asyncio.run(run_async_server("."), debug=True)
  +    asyncio.run(run_async_server(), debug=True)
  diff --git a/examples/server_sync.py b/examples/server_sync.py
  --- a/examples/server_sync.py
  +++ b/examples/server_sync.py
  @@ -313,5 +313,5 @@
   
   
   if __name__ == "__main__":
  -    server = run_sync_server(".")
  +    server = run_sync_server()
       server.shutdown()
  
  ```
  
golden_diff: diff --git a/checkov/dockerfile/checks/MaintainerExists.py b/checkov/dockerfile/checks/MaintainerExists.py
  --- a/checkov/dockerfile/checks/MaintainerExists.py
  +++ b/checkov/dockerfile/checks/MaintainerExists.py
  @@ -11,10 +11,7 @@
           super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)
   
       def scan_entity_conf(self, conf):
  -        for instruction, content in conf.items():
  -            if instruction == "MAINTAINER":
  -                return CheckResult.FAILED, content[0]
  -        return CheckResult.PASSED, None
  +        return CheckResult.FAILED, conf[0]
   
   
   check = MaintainerExists()
  diff --git a/checkov/dockerfile/checks/RootUser.py b/checkov/dockerfile/checks/RootUser.py
  --- a/checkov/dockerfile/checks/RootUser.py
  +++ b/checkov/dockerfile/checks/RootUser.py
  @@ -11,16 +11,11 @@
           super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)
   
       def scan_entity_conf(self, conf):
  -        contents = conf.get("USER")
  +        last_user = conf[-1]
  +        if last_user["value"] == "root":
  +            return CheckResult.FAILED, last_user
   
  -        if contents:
  -            last_user = contents[-1]
  -            if last_user["value"] == "root":
  -                return CheckResult.FAILED, last_user
  -
  -            return CheckResult.PASSED, last_user
  -
  -        return CheckResult.UNKNOWN, None
  +        return CheckResult.PASSED, last_user
   
   
   check = RootUser()
  
verification_info: {"golden_diff": "diff --git a/checkov/dockerfile/checks/MaintainerExists.py b/checkov/dockerfile/checks/MaintainerExists.py\n--- a/checkov/dockerfile/checks/MaintainerExists.py\n+++ b/checkov/dockerfile/checks/MaintainerExists.py\n@@ -11,10 +11,7 @@\n         super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)\n \n     def scan_entity_conf(self, conf):\n-        for instruction, content in conf.items():\n-            if instruction == \"MAINTAINER\":\n-                return CheckResult.FAILED, content[0]\n-        return CheckResult.PASSED, None\n+        return CheckResult.FAILED, conf[0]\n \n \n check = MaintainerExists()\ndiff --git a/checkov/dockerfile/checks/RootUser.py b/checkov/dockerfile/checks/RootUser.py\n--- a/checkov/dockerfile/checks/RootUser.py\n+++ b/checkov/dockerfile/checks/RootUser.py\n@@ -11,16 +11,11 @@\n         super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)\n \n     def scan_entity_conf(self, conf):\n-        contents = conf.get(\"USER\")\n+        last_user = conf[-1]\n+        if last_user[\"value\"] == \"root\":\n+            return CheckResult.FAILED, last_user\n \n-        if contents:\n-            last_user = contents[-1]\n-            if last_user[\"value\"] == \"root\":\n-                return CheckResult.FAILED, last_user\n-\n-            return CheckResult.PASSED, last_user\n-\n-        return CheckResult.UNKNOWN, None\n+        return CheckResult.PASSED, last_user\n \n \n check = RootUser()\n", "issue": "Error while checking Dockerfile USER set with env variable\n**Describe the bug**\r\nThe **checkov** CLI return an error when analyzing a Dockerfile with USER set according to an ENV variable. \r\n\r\n**To Reproduce**\r\nSteps to reproduce the behavior:\r\n1. Get this snippet :\r\n```Dockerfile\r\nFROM python:alpine\r\n\r\nWORKDIR /app\r\nCOPY requirements.txt .\r\nRUN pip install -r requirements.txt\r\n\r\nENV USERNAME=app\r\nRUN addgroup -S ${USERNAME} && adduser -s /sbin/nologin -S ${USERNAME} -G ${USERNAME} && chown -R ${USERNAME} /app\r\nUSER ${USERNAME}\r\n\r\nCOPY --chown=${USERNAME} script.py .\r\n\r\nCMD python3 script.py\r\n```\r\n2. Run cli command  'checkov -f Dockerfile'\r\n3. See error\r\n\r\n**Expected behavior**\r\nNo error.\r\n\r\n**Screenshots**\r\n<img width=\"750\" alt=\"\" src=\"https://user-images.githubusercontent.com/44492274/115271564-c380b080-a13d-11eb-9c4d-cb086e3bd9fd.png\">\r\n\r\n**Desktop (please complete the following information):**\r\n - OS: macOS Big Sur 11.2.3\r\n - Checkov Version 2.0.55\n", "before_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck\n\n\nclass RootUser(BaseDockerfileCheck):\n    def __init__(self):\n        name = \"Ensure the last USER is not root\"\n        id = \"CKV_DOCKER_8\"\n        supported_instructions = [\"USER\"]\n        categories = [CheckCategories.APPLICATION_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)\n\n    def scan_entity_conf(self, conf):\n        contents = conf.get(\"USER\")\n\n        if contents:\n            last_user = contents[-1]\n            if last_user[\"value\"] == \"root\":\n                return CheckResult.FAILED, last_user\n\n            return CheckResult.PASSED, last_user\n\n        return CheckResult.UNKNOWN, None\n\n\ncheck = RootUser()\n", "path": "checkov/dockerfile/checks/RootUser.py"}, {"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck\n\n\nclass MaintainerExists(BaseDockerfileCheck):\n    def __init__(self):\n        name = \"Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated)\"\n        id = \"CKV_DOCKER_6\"\n        supported_instructions = [\"MAINTAINER\"]\n        categories = [CheckCategories.CONVENTION]\n        super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)\n\n    def scan_entity_conf(self, conf):\n        for instruction, content in conf.items():\n            if instruction == \"MAINTAINER\":\n                return CheckResult.FAILED, content[0]\n        return CheckResult.PASSED, None\n\n\ncheck = MaintainerExists()\n", "path": "checkov/dockerfile/checks/MaintainerExists.py"}], "after_files": [{"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck\n\n\nclass RootUser(BaseDockerfileCheck):\n    def __init__(self):\n        name = \"Ensure the last USER is not root\"\n        id = \"CKV_DOCKER_8\"\n        supported_instructions = [\"USER\"]\n        categories = [CheckCategories.APPLICATION_SECURITY]\n        super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)\n\n    def scan_entity_conf(self, conf):\n        last_user = conf[-1]\n        if last_user[\"value\"] == \"root\":\n            return CheckResult.FAILED, last_user\n\n        return CheckResult.PASSED, last_user\n\n\ncheck = RootUser()\n", "path": "checkov/dockerfile/checks/RootUser.py"}, {"content": "from checkov.common.models.enums import CheckCategories, CheckResult\nfrom checkov.dockerfile.base_dockerfile_check import BaseDockerfileCheck\n\n\nclass MaintainerExists(BaseDockerfileCheck):\n    def __init__(self):\n        name = \"Ensure that LABEL maintainer is used instead of MAINTAINER (deprecated)\"\n        id = \"CKV_DOCKER_6\"\n        supported_instructions = [\"MAINTAINER\"]\n        categories = [CheckCategories.CONVENTION]\n        super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)\n\n    def scan_entity_conf(self, conf):\n        return CheckResult.FAILED, conf[0]\n\n\ncheck = MaintainerExists()\n", "path": "checkov/dockerfile/checks/MaintainerExists.py"}]}