rules-docker

RISK: 'apt-get upgrade' at build time pulls unpinned package versions, breaking reproducibility and potentially replacing a pinned base image's tested libraries. FIX: Rebuild on an updated base image tag/digest instead; install only the specific packages you need with 'apt-get install -y --no-install-recommends <pkg>=<version>'.

RISK: CAP_SYS_ADMIN (and ALL/SYS_MODULE/SYS_PTRACE/DAC_READ_SEARCH) is effectively equivalent to root — it enables mount, kernel-module load, ptrace of host processes, and has been the pivot in multiple container-escape CVEs. FIX: Drop all capabilities and add back only the specific ones (e.g. NET_BIND_SERVICE) you need.

RISK: chmod 777 inside the image makes files world-writable across every container user, defeating the non-root USER hardening and enabling tamper-on-write attacks. FIX: Set ownership with 'COPY --chown=app:app' and use 0755/0644.

RISK: ':latest' image tags in docker-compose are not pinned to an immutable digest; a silent tag re-push can introduce new CVEs or supply-chain compromises into your stack without any git diff. FIX: Pin to an explicit version tag or immutable digest, e.g. 'image: postgres:16.2@sha256:<digest>'.

RISK: 'curl ... | sh' in a build layer executes arbitrary upstream content with no integrity check — a compromised CDN or typo-squatted domain becomes RCE in every rebuild. FIX: Download to a file, verify sha256, then execute; or install from a pinned package repository.

RISK: Binding 0.0.0.0 exposes the port on every host interface, including public ones, which has caused repeated unauthenticated DB exposures (Redis, Mongo, Elastic). FIX: Bind to 127.0.0.1 for dev; in prod rely on a reverse proxy or explicit firewall rules.

RISK: Mounting /var/run/docker.sock grants the container control of the host Docker daemon (spawn privileged containers = host root). FIX: Use a scoped socket proxy (e.g. tecnativa/docker-socket-proxy) or the rootless API.

RISK: Sharing the host network/PID/IPC namespace removes a core isolation boundary — the container can sniff host traffic, send signals to host processes, and access host SysV IPC. FIX: Use a user-defined bridge network and default namespaces; expose only the ports you need.

RISK: ':latest' (or untagged) base images break reproducibility and silently pull in new CVEs or malicious tag re-pushes. FIX: Pin to an immutable digest, e.g. 'FROM node:20.11.1-alpine@sha256:<digest>'.

RISK: ADD auto-extracts tar archives and fetches URLs with no checksum, introducing path-traversal and tampering surface. FIX: Use COPY for local files; for remote fetches use RUN curl with a verified sha256.

RISK: Without 'security_opt: [no-new-privileges:true]' a setuid binary inside the container can still gain privileges, undermining a non-root USER. FIX: Add 'security_opt:\n - no-new-privileges:true' to each service.

RISK: --privileged disables seccomp/AppArmor/capability dropping, giving the container full kernel access (equivalent to host root). FIX: Remove and grant only the specific capabilities needed via cap_add.

RISK: Containers default to UID 0; combined with a runtime flaw (e.g. runc CVE-2025-31133/52565/52881) this yields host root. FIX: Add 'USER nonroot' (or a dedicated uid) before the final CMD/ENTRYPOINT.

RISK: ARG values are recorded in image history (docker history --no-trunc) and leak even when unset in the final image — documented by Docker build-checks SecretsUsedInArgOrEnv. FIX: Use 'RUN --mount=type=secret,id=foo' with BuildKit.

RISK: Secrets in ENV or literal compose values are baked into the image layer and surfaced by 'docker inspect'/'docker history' forever. FIX: Use BuildKit '--mount=type=secret' at build time and Docker/K8s secrets or env-file injection at runtime.