Ensure that image sprawl is avoided

낮음레벨 1수동 검토docker

설명

You should not keep a large number of container images on the same host. Use only tagged images as appropriate. Tagged images are useful if you need to fall back from the "latest" version to a specific version of an image in production. Images with unused or old tags may contain vulnerabilities that might be exploited if ... Reported as a manual review item: the audit needs a site-specific judgement.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Step 1 Make a list of all image IDs that are currently instantiated by executing the command below: docker images --quiet | xargs docker inspect --format '{{ .Id }}: Image={{ .Config.Image }}' Step 2: List all the images present on the system by executing the command below: docker images Step 3: Compare the list of image IDs from Step 1 and Step 2 and look for images that are currently not in use. If any unused or old images are found, discuss with the system administrator the need to keep such images on the system. If images are no longer needed they should be deleted.

조치 방법

조치 방식: 가이드 또는 인프라 패치

You should keep only the images that you actually need and establish a workflow to remove old or stale images from the host. Additionally, you should use features such as pull-by-digest to get specific images from the registry. You can follow the steps below to find unused images on the system so they can be deleted. Step 1 Make a list of all image IDs that are currently instantiated by executing the command below: docker images --quiet | xargs docker inspect --format '{{ .Id }}: Image={{ .Config.Image }}' Step 2: List all the images present on the system by executing the command below ...

속성

운영 체제: 모두
태그: dockermanual
참고 자료: CIS Docker Benchmark v1.9.0 - 6.1 Ensure that image sprawl is avoided