Docker
TMA-DOCKER-4.6
Ensure update instructions are not used alone in Dockerfiles
Mô tả
You should not use OS package manager update instructions such as apt-get update or dnf update either alone or in a single line in any Dockerfiles used to generate images under review. Adding update instructions in a single line on the Dockerfile will cause the update layer to be cached. When you then build any image later using the same instruction, this will cause the previously cached update layer ... Reported as a manual review item: the audit needs a site-specific judgement.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Step 1: Run the command below to get the list of images: docker images Step 2: Run the command below against each image in the list above, looking for any update instructions which are incorporated in a single line: docker history <Image_ID> Alternatively, if you have access to the Dockerfile for the image, you should verify that there are no update instructions configured as described above.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
You should use update instructions together with install instructions and version pinning for packages while installing them. This will prevent caching and force the extraction of the required versions. Alternatively, you could use the --no-cache flag during the docker build process to avoid using cached layers.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- dockermanual
- Tham chiếu
- CIS Docker Benchmark v1.9.0 - 4.6 Ensure update instructions are not used alone in Dockerfiles