Ensure update instructions are not used alone in Dockerfiles

SrednjaNivo 1Ručni pregleddocker

Opis

You should not use OS package manager update instructions such as apt-get update or dnf update either alone or in a single line in any Dockerfiles used to generate images under review. Adding update instructions in a single line on the Dockerfile will cause the update layer to be cached. When you then build any image later using the same instruction, this will cause the previously cached update layer ... Reported as a manual review item: the audit needs a site-specific judgement.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Step 1: Run the command below to get the list of images: docker images Step 2: Run the command below against each image in the list above, looking for any update instructions which are incorporated in a single line: docker history <Image_ID> Alternatively, if you have access to the Dockerfile for the image, you should verify that there are no update instructions configured as described above.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

You should use update instructions together with install instructions and version pinning for packages while installing them. This will prevent caching and force the extraction of the required versions. Alternatively, you could use the --no-cache flag during the docker build process to avoid using cached layers.

Svojstva

Operativni sistemi: Bilo koji
Oznake: dockermanual
Referenca: CIS Docker Benchmark v1.9.0 - 4.6 Ensure update instructions are not used alone in Dockerfiles