Ensure update instructions are not used alone in Dockerfiles

보통레벨 1수동 검토docker

설명

You should not use OS package manager update instructions such as apt-get update or dnf update either alone or in a single line in any Dockerfiles used to generate images under review. Adding update instructions in a single line on the Dockerfile will cause the update layer to be cached. When you then build any image later using the same instruction, this will cause the previously cached update layer ... Reported as a manual review item: the audit needs a site-specific judgement.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Step 1: Run the command below to get the list of images: docker images Step 2: Run the command below against each image in the list above, looking for any update instructions which are incorporated in a single line: docker history <Image_ID> Alternatively, if you have access to the Dockerfile for the image, you should verify that there are no update instructions configured as described above.

조치 방법

조치 방식: 가이드 또는 인프라 패치

You should use update instructions together with install instructions and version pinning for packages while installing them. This will prevent caching and force the extraction of the required versions. Alternatively, you could use the --no-cache flag during the docker build process to avoid using cached layers.

속성

운영 체제: 모두
태그: dockermanual
참고 자료: CIS Docker Benchmark v1.9.0 - 4.6 Ensure update instructions are not used alone in Dockerfiles