Keep your Docker Host and Docker Engine up to date, along with your Docker images.
Docker containers run on the Docker Engine available on host computers. These hosts can be Linux/Mac or Windows. Docker Engine may be one of several available versions. It is extremely important to use the latest stable version, which fixes known issues from previous releases. The same goes for the host operating system.
It’s important to have updates or patches, since each patch fixes vulnerabilities such as CVE-2021-41092. This particular patch fixed a bug that caused credentials used to log in to a Docker registry from the CLI to be sent to “registry-1.docker.io” instead of the intended private registry; this happened because of an incorrectly configured configuration file (usually ~/.docker/config.json ), which lists credsStore or credHelpers.
Avoid storing sensitive data in Dockerfile instructions
A Dockerfile contains instructions for building Docker images. COPY, RUN, ADD, CMD, ENTRYPOINT, etc. are just some of the command instructions that can be part of a Dockerfile. We can also use ENV and ARGS to set variables at runtime or during the build, depending on the requirements. You can use environment variables in Docker containers with the ENV or ARGS instructions. When setting environment variables, keep in mind that you should never assign secrets, credentials, passwords, etc. to variables in a Dockerfile or hardcode them in any command. Consider this one of the best Dockerfile security practices, since ignoring it can lead to potential security threats and cost you dearly.
For example, if you hardcode a password or connection details for your databases in a Dockerfile, assign them to environment variables, and upload the Dockerfile to a public repository, anyone with access to the repository will be able to get those credentials and access the data or connect to the database.
Avoid using an untrusted image registry
An image registry is where Docker images are stored. It can be private or public. Docker Hub is Docker’s official cloud image registry for Docker, and it is used by default when Docker is installed. If you don’t configure a registry, images will be pulled from this public repository.
When you pull Docker images from any public registry, keep their source in mind, since you may not know who created them, how they were created, or whether they’re trustworthy. Whenever you pull an image from an untrusted publisher, be sure to check the source registry and the Dockerfile used to create the image. Also check the base image for your Dockerfile—that is, the FROM instruction.
Beware of recursive copying
When writing a Dockerfile for applications that need files copied from your local machine into a Docker image, you should know that the content is copied using the COPY instruction. Your local machine may contain files with sensitive data or secrets. So, if those files are copied into a Docker image, anyone with access to the container will be able to retrieve them from it. Therefore, to improve Docker container security, it’s very important to copy only the files needed in the container, rather than copying everything as shown in the following instruction.
You can try .dockerignor. It can help exclude files and directories that match patterns and avoid unnecessarily sending large or sensitive files to images using ADD or COPY.
Scan images during development
Docker images are built from Dockerfiles, and Dockerfiles contain instructions for using a base image, installing packages, running applications, etc. A Dockerfile may also accidentally contain hardcoded credentials. So, what if the base image you’re using has some vulnerabilities, and credentials hardcoded in the Dockerfile leak from a container created using an image built with that Dockerfile?
Image scanning is the process of identifying known security vulnerabilities in your Docker images so you can fix them before pushing them to Docker Hub or any other registry.
You can now run Snyk vulnerability scans directly from the Docker Desktop command-line interface, since Snyk and Docker are working together.
