diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerUtils.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerUtils.java
index debf8dddd..45d42f1ce 100644
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerUtils.java
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/DockerUtils.java
@@ -1,7 +1,11 @@
 package org.graalvm.internal.tck;
 
+import java.io.BufferedReader;
 import java.io.File;
+import java.io.FileReader;
 import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
@@ -12,7 +16,7 @@
 
 public class DockerUtils {
 
-    public static Set<String> getAllowedImages() throws IOException {
+    public static Set<String> getAllowedImages() throws IOException, URISyntaxException {
         String dockerfileDirectory = Paths.get("./tests/tck-build-logic/src/main/resources/allowed-docker-images").toString();
         File[] dockerFiles = new File(dockerfileDirectory).listFiles();
         if (dockerFiles == null) {
@@ -22,13 +26,15 @@ public static Set<String> getAllowedImages() throws IOException {
         final String FROM = "FROM";
         Set<String> allowedImages = new HashSet<>();
         for (File dockerFile : dockerFiles) {
-            List<String> images = Files.readAllLines(dockerFile.toPath())
-                    .stream()
-                    .filter(line -> line.startsWith(FROM))
-                    .map(line -> line.substring(FROM.length()).trim())
-                    .toList();
+            BufferedReader file = new BufferedReader(new FileReader(dockerFile));
+            String image = file.readLine().substring(FROM.length()).trim();
 
-            allowedImages.addAll(images);
+            if (file.readLine() != null) {
+                throw new RuntimeException("Dockerfile: " + dockerFile.getName() + " must contain only one line. Please read our documentation: " +
+                        new URI("https://github.com/oracle/graalvm-reachability-metadata/blob/master/CONTRIBUTING.md#providing-the-tests-that-use-docker"));
+            }
+
+            allowedImages.add(image);
         }
 
         return allowedImages;
diff --git a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java
index 9bb6def78..a284bca5f 100644
--- a/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java
+++ b/tests/tck-build-logic/src/main/java/org/graalvm/internal/tck/GrypeTask.java
@@ -8,6 +8,7 @@
 
 import javax.inject.Inject;
 import java.io.*;
+import java.net.URISyntaxException;
 import java.util.*;
 import java.util.function.Predicate;
 
@@ -21,7 +22,7 @@ public abstract class GrypeTask extends DefaultTask {
     private final String jqMatcher = " | jq -c '.matches | .[] | .vulnerability | select(.severity | (contains(\"High\") or contains(\"Critical\")))'";
 
     @TaskAction
-    void run() throws IllegalStateException, IOException {
+    void run() throws IllegalStateException, IOException, URISyntaxException {
         List<String> vulnerableImages = new ArrayList<>();
         Set<String> allowedImages = getAllowedImages();
         boolean shouldFail = false;