Docker
TMA-DOCKER-4.6
Ensure update instructions are not used alone in Dockerfiles
Description
You should not use OS package manager update instructions such as apt-get update or dnf update either alone or in a single line in any Dockerfiles used to generate images under review. Adding update instructions in a single line on the Dockerfile will cause the update layer to be cached. When you then build any image later using the same instruction, this will cause the previously cached update layer ... Reported as a manual review item: the audit needs a site-specific judgement.
How it is checked
Audit method: Manual review
Step 1: Run the command below to get the list of images: docker images Step 2: Run the command below against each image in the list above, looking for any update instructions which are incorporated in a single line: docker history <Image_ID> Alternatively, if you have access to the Dockerfile for the image, you should verify that there are no update instructions configured as described above.
How it is fixed
Fix method: Guidance or infrastructure patch
You should use update instructions together with install instructions and version pinning for packages while installing them. This will prevent caching and force the extraction of the required versions. Alternatively, you could use the --no-cache flag during the docker build process to avoid using cached layers.
Properties
- Operating systems
- Any
- Tags
- dockermanual
- Reference
- CIS Docker Benchmark v1.9.0 - 4.6 Ensure update instructions are not used alone in Dockerfiles