NShiftKey

• Image user should not be 'root'

  • Description : Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
  • Countermeasure : Specify at least 1 USER command in Dockerfile with non-root user as argument
    • Target Code : lemur/Dockerfile [view change history] [ignore this]
      https://github.com/junyongk/lemur/blob/c83900e7b4aeabedff29b7f4bbd8d51dca5e422f/Dockerfile#L0-L1
        

• 'RUN <package-manager> update' instruction alone

  • Description : The instruction 'RUN update' should always be followed by ' install' in the same RUN statement.
  • Countermeasure : The instruction 'RUN update' should always be followed by ' install' in the same RUN statement.
    • Target Code : lemur/Dockerfile [view change history] [ignore this]
      

      lemur/Dockerfile

      Lines 1 to 3 in c83900e

      	FROM python:3.5
      	RUN apt-get update
      	RUN apt-get install -y make python-software-properties curl

      
        
    • Target Code : lemur/Dockerfile [view change history] [ignore this]
      

      lemur/Dockerfile

      Lines 4 to 6 in c83900e

      	RUN curl -sL https://deb.nodesource.com/setup_7.x | bash -
      	RUN apt-get update
      	RUN apt-get install -y nodejs

      
        

• 'apt-get' missing '--no-install-recommends'

  • Description : 'apt-get' install should use '--no-install-recommends' to minimize image size.
  • Countermeasure : '--no-install-recommends' flag is missed: 'apt-get install -y make python-software-properties curl'
    • Target Code : lemur/Dockerfile [view change history] [ignore this]
      

      lemur/Dockerfile

      Lines 2 to 4 in c83900e

      	RUN apt-get update
      	RUN apt-get install -y make python-software-properties curl
      	RUN curl -sL https://deb.nodesource.com/setup_7.x | bash -

      
        
    • Target Code : lemur/Dockerfile [view change history] [ignore this]
      

      lemur/Dockerfile

      Lines 5 to 7 in c83900e

      	RUN apt-get update
      	RUN apt-get install -y nodejs
      	RUN pip install -U setuptools

      
        

• No HEALTHCHECK defined

  • Description : You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
  • Countermeasure : Add HEALTHCHECK instruction in your Dockerfile
    • Target Code : lemur/Dockerfile [view change history] [ignore this]
      https://github.com/junyongk/lemur/blob/c83900e7b4aeabedff29b7f4bbd8d51dca5e422f/Dockerfile#L0-L1