Ensure build workers are automatically scanned for vulnerabilities

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

If you are using a static host for a runner, whether bare-metal or virtual machine, you should implement security best practices for the host operating system. Malicious code executed in the context of a CI job could compromise the host, so security protocols can help mitigate the impact. Other points to keep in mind include securing or removing files such as SSH keys from the host system that may enable an attacker to access other endpoints in the environment.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

For each build worker, automatically scan its environmental sources, such as docker image, for vulnerabilities. - Create a new project. - Add a Dockerfile file to the project. This Dockerfile contains minimal configuration required to create a Docker image. - Create pipeline configuration for the new project to create a Docker image from the Dockerfile, build and push a Docker image to the container registry, and then scan the Docker image for vulnerabilities. - Check for reported vulnerabilities. - Update the Docker image and scan the updated image.