Docker
TMA-DOCKER-4.6
Ensure update instructions are not used alone in Dockerfiles
Descripción
You should not use OS package manager update instructions such as apt-get update or dnf update either alone or in a single line in any Dockerfiles used to generate images under review. Adding update instructions in a single line on the Dockerfile will cause the update layer to be cached. When you then build any image later using the same instruction, this will cause the previously cached update layer ... Reported as a manual review item: the audit needs a site-specific judgement.
Cómo se verifica
Método de auditoría: Revisión manual
Step 1: Run the command below to get the list of images: docker images Step 2: Run the command below against each image in the list above, looking for any update instructions which are incorporated in a single line: docker history <Image_ID> Alternatively, if you have access to the Dockerfile for the image, you should verify that there are no update instructions configured as described above.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
You should use update instructions together with install instructions and version pinning for packages while installing them. This will prevent caching and force the extraction of the required versions. Alternatively, you could use the --no-cache flag during the docker build process to avoid using cached layers.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- dockermanual
- Referencia
- CIS Docker Benchmark v1.9.0 - 4.6 Ensure update instructions are not used alone in Dockerfiles