Ensure that Docker commands always make use of the latest version of their image

Trung bìnhCấp 1Xem xét thủ côngdocker

Mô tả

You should always ensure that you are using the latest version of the images within your repository and not cached older versions. Multiple Docker commands such as docker pull, docker run etc. are known to have an issue where by default, they extract the local copy of the image, if present, even though there is an updated version of the image with ... Reported as a manual review item: the audit needs a site-specific judgement.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

You should carry out the following steps: Step 1: Open your image repository and list the image version history for the image you are inspecting. Step 2: Observe the status when the docker pull command is triggered. If the status is shown as Image is up to date, it means that you are getting the cached version of the image. Step 3: Match the version of the image you are running to the latest version reported in your repository and this will tell you whether you are running the cached version or the latest copy.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

You should use proper version pinning mechanisms (the "latest" tag which is assigned by default is still vulnerable to caching attacks) to avoid extracting cached older versions. Version pinning mechanisms should be used for base images, packages, and entire images. You can customize version pinning rules according to your requirements.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: dockermanual
Tham chiếu: CIS Docker Benchmark v1.9.0 - 5.28 Ensure that Docker commands always make use of the latest version of their image