NShiftKey

• Image user should not be 'root'

  • Description : Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
  • Countermeasure : Specify at least 1 USER command in Dockerfile with non-root user as argument
    • Target Code : abp/modules/basic-theme/test/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Demo/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/basic-theme/test/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Demo/Dockerfile#L0-L1
        
    • Target Code : abp/modules/cms-kit/database/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/cms-kit/database/Dockerfile#L0-L1
        
    • Target Code : abp/modules/cms-kit/host/Volo.CmsKit.HttpApi.Host/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/cms-kit/host/Volo.CmsKit.HttpApi.Host/Dockerfile#L0-L1
        
    • Target Code : abp/modules/cms-kit/host/Volo.CmsKit.IdentityServer/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/cms-kit/host/Volo.CmsKit.IdentityServer/Dockerfile#L0-L1
        
    • Target Code : abp/modules/docs/app/VoloDocs.Migrator/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/docs/app/VoloDocs.Migrator/Dockerfile#L0-L1
        
    • Target Code : abp/modules/docs/app/VoloDocs.Web/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/docs/app/VoloDocs.Web/Dockerfile#L0-L1
        
    • Target Code : abp/npm/verdaccio-containers/publish-packages/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/npm/verdaccio-containers/publish-packages/Dockerfile#L0-L1
        
    • Target Code : abp/npm/verdaccio-containers/serve-app/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/npm/verdaccio-containers/serve-app/Dockerfile#L0-L1
        
    • Target Code : abp/templates/module/aspnet-core/database/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/templates/module/aspnet-core/database/Dockerfile#L0-L1
        
    • Target Code : abp/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/Dockerfile#L0-L1
        
    • Target Code : abp/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.HttpApi.Host/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.HttpApi.Host/Dockerfile#L0-L1
        

• 'RUN <package-manager> update' instruction alone

  • Description : The instruction 'RUN update' should always be followed by ' install' in the same RUN statement.
  • Countermeasure : The instruction 'RUN update' should always be followed by ' install' in the same RUN statement.
    • Target Code : abp/npm/verdaccio-containers/publish-packages/Dockerfile [view change history] [ignore this]
      

      abp/npm/verdaccio-containers/publish-packages/Dockerfile

      Lines 8 to 10 in 28afef4

      	RUN apt-get update
      	RUN apt-get install nano

      
        
    • Target Code : abp/npm/verdaccio-containers/serve-app/Dockerfile [view change history] [ignore this]
      

      abp/npm/verdaccio-containers/serve-app/Dockerfile

      Lines 6 to 8 in 28afef4

      	RUN apt-get update
      	RUN apt-get install nano

      
        

• 'apt-get' missing '-y' to avoid manual input

  • Description : 'apt-get' calls should use the flag '-y' to avoid manual user input.
  • Countermeasure : '-y' flag is missed: 'apt-get install nano'
    • Target Code : abp/npm/verdaccio-containers/publish-packages/Dockerfile [view change history] [ignore this]
      

      abp/npm/verdaccio-containers/publish-packages/Dockerfile

      Lines 9 to 11 in 28afef4

      	RUN apt-get update
      	RUN apt-get install nano
      	RUN chmod +x ./entrypoint.sh

      
        
    • Target Code : abp/npm/verdaccio-containers/serve-app/Dockerfile [view change history] [ignore this]
      

      abp/npm/verdaccio-containers/serve-app/Dockerfile

      Lines 7 to 9 in 28afef4

      	RUN apt-get update
      	RUN apt-get install nano
      	RUN chmod +x ./entrypoint.sh

      
        

• 'apt-get' missing '--no-install-recommends'

  • Description : 'apt-get' install should use '--no-install-recommends' to minimize image size.
  • Countermeasure : '--no-install-recommends' flag is missed: 'apt-get install nano'
    • Target Code : abp/npm/verdaccio-containers/publish-packages/Dockerfile [view change history] [ignore this]
      

      abp/npm/verdaccio-containers/publish-packages/Dockerfile

      Lines 9 to 11 in 28afef4

      	RUN apt-get update
      	RUN apt-get install nano
      	RUN chmod +x ./entrypoint.sh

      
        
    • Target Code : abp/npm/verdaccio-containers/serve-app/Dockerfile [view change history] [ignore this]
      

      abp/npm/verdaccio-containers/serve-app/Dockerfile

      Lines 7 to 9 in 28afef4

      	RUN apt-get update
      	RUN apt-get install nano
      	RUN chmod +x ./entrypoint.sh

      
        

• ':latest' tag used

  • Description : When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated.
  • Countermeasure : Specify a tag in the 'FROM' statement for image 'mcr.microsoft.com/mssql-tools'
    • Target Code : abp/modules/cms-kit/database/Dockerfile [view change history] [ignore this]
      

      abp/modules/cms-kit/database/Dockerfile

      Lines 11 to 13 in 28afef4

      	FROM mcr.microsoft.com/mssql-tools AS final
      	WORKDIR /src

      
        
    • Target Code : abp/templates/module/aspnet-core/database/Dockerfile [view change history] [ignore this]
      

      abp/templates/module/aspnet-core/database/Dockerfile

      Lines 11 to 13 in 28afef4

      	FROM mcr.microsoft.com/mssql-tools AS final
      	WORKDIR /src

      
        

• No HEALTHCHECK defined

  • Description : You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
  • Countermeasure : Add HEALTHCHECK instruction in your Dockerfile
    • Target Code : abp/modules/basic-theme/test/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Demo/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/basic-theme/test/Volo.Abp.AspNetCore.Mvc.UI.Bootstrap.Demo/Dockerfile#L0-L1
        
    • Target Code : abp/modules/cms-kit/database/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/cms-kit/database/Dockerfile#L0-L1
        
    • Target Code : abp/modules/cms-kit/host/Volo.CmsKit.HttpApi.Host/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/cms-kit/host/Volo.CmsKit.HttpApi.Host/Dockerfile#L0-L1
        
    • Target Code : abp/modules/cms-kit/host/Volo.CmsKit.IdentityServer/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/cms-kit/host/Volo.CmsKit.IdentityServer/Dockerfile#L0-L1
        
    • Target Code : abp/modules/docs/app/VoloDocs.Migrator/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/docs/app/VoloDocs.Migrator/Dockerfile#L0-L1
        
    • Target Code : abp/modules/docs/app/VoloDocs.Web/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/modules/docs/app/VoloDocs.Web/Dockerfile#L0-L1
        
    • Target Code : abp/npm/verdaccio-containers/publish-packages/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/npm/verdaccio-containers/publish-packages/Dockerfile#L0-L1
        
    • Target Code : abp/npm/verdaccio-containers/serve-app/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/npm/verdaccio-containers/serve-app/Dockerfile#L0-L1
        
    • Target Code : abp/templates/module/aspnet-core/database/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/templates/module/aspnet-core/database/Dockerfile#L0-L1
        
    • Target Code : abp/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.AuthServer/Dockerfile#L0-L1
        
    • Target Code : abp/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.HttpApi.Host/Dockerfile [view change history] [ignore this]
      https://github.com/2lambda123/abp/blob/28afef46fcb4e58d8796bc2dac1348aa762ec345/templates/module/aspnet-core/host/MyCompanyName.MyProjectName.HttpApi.Host/Dockerfile#L0-L1