Docker Images - Slim Image, Security & Vulnerabilities

SUMMARY:
A) Slim Images
B) Vulnerabilities
C) Security

A) SLIM IMAGES

Important pointers for Docker Images (SLIM IMAGES):

1. docker images need to be created in minimal size. if the requirement of the docker image gets fulfilled in the minimal version of the required docker images then use the minimal version.

for example if alpine is sufficient, then use it instead of ubuntu or centos which both are bigger in size than alpine. 

2. docker images need to be created with minimal setup (one method is by multistage)

for example if you are creating a maven project, you will use the multistage dockerfile

3. docker image need to be created with a specified tag instead of latest tag because the latest image is different time to time (cause whatever is latest today may be not latest tomorrow, so to avoid mismatch of versions, SPECIFY TAG).

for example if you are downloading a base image, use the tag:

          FROM ubuntu:18.04

4. Docker Images should pass all the vulnerability check, so that only authenticated images should be used for your application.

for example Dockerfile should be passed through linter: https://hadolint.github.io/hadolint/ . Docker Image should be passed through scanners: Trivy / Snyk.

5. Before Creating a Docker image from the Dockerfile it is better to use the docker linter tool to verify the steps of the Dockerfile.

6. Run the container with a non-root user so that attackers will have fewer chances to hack the containers completely.

7. Use the distroless images (provided by google) if required.

8. Use Scratch images if you want to create a docker image from scratch like debian based etc.

B) VULNERABILITIES

Vulnerability
Vulnerability scanning for Docker local images allows developers and development teams to review the security state of the container images and take actions to fix issues identified during the scan, resulting in more secure deployments.

CVE
CVE is short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws. When someone refers to a CVE, they mean a security flaw that's been assigned a CVE ID number. Security advisories issued by vendors and researchers almost always mention at least one CVE ID.

Scanners

There are several vulnerability scanners in docker, in-built will be docker scan. There are also others such as trivy. you can refer to this website: https://docs.docker.com/engine/scan/ OR https://aquasecurity.github.io/trivy/v0.18.3/installation/

Docker Scan Plugin
Docker scan plugin runs on Snyk engine (a third-party engine), providing users with visibility into the security posture of their local Dockerfiles and local images. To scan Docker images to check the vulnerability using docker scan:

First, you will need to install docker scan plugin

mkdir -p ~/.docker/cli-plugins

curl https://github.com/docker/scan-cli-plugin/releases/latest/download/docker-scan_linux_amd64 -L -s -S -o ~/.docker/cli-plugins/docker-scan

chmod +x ~/.docker/cli-plugins/docker-scan

Step 2: test by downloading hello-world image and scan the vulnerabilities

docker pull hello-world

docker scan hello-world

It will give the docker image vulnerabilities scan report on the basis of that you can decide to use this docker image or not.

Step 3: Lets scan docker image ramansharma95/webapp

docker scan ramansharma95/webapp

    docker scan ramansharma95/mysql 

It will return a report which shows the Low/Medium/High/Critical severity issues, refer pic below:

Trivy Scan:

sudo apt-get install wget apt-transport-https gnupg lsb-release

wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -

echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list

sudo apt-get update

sudo apt-get install trivy

to scan:

trivy image <imagename>

refer pic below:

 

Dockerfile Linter