DEV Community: Tomoya Amachi

The One Thing You Should Do After Building Best-Practice Docker Image (in 3 minutes)

Tomoya Amachi — Wed, 19 Jun 2019 14:48:22 +0000

Overview

Today, many companies tried to use Docker. This article is for wrote/writing best-practice Dockerfiles.

I created a tool analyzes your Dockerfile via the built image in 3 minutes.

Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start

Dockle is able to check deeply. (file permissions, credential files...) So, Dockle the best tool to check important rules, especially for security.

(I'm also the main committer of Vuls and Trivy. These are famous vulnerability scanners.)

It's NOT a Dockerfile Linter (like a hadolint).

It's able to check security risks on a container base image too. Dockerfile Linter never does it.

I hope you star it!

How to use

Homebrew (Mac / Linux)

$ export DOCKER_CONTENT_TRUST=1
$ docker build -t test-image:v1 .
$ brew install goodwithtech/dockle/dockle
$ dockle test-image:v1

Linux

$ export DOCKER_CONTENT_TRUST=1
$ docker build -t test-image:v1 .
$ VERSION=$(
 curl --silent "https://api.github.com/repos/goodwithtech/dockle/releases/latest" | \
 grep '"tag_name":' | \
 sed -E 's/.*"v([^"]+)".*/\1/' \
) && curl -L -o dockle.tar.gz https://github.com/goodwithtech/dockle/releases/download/v${VERSION}/dockle_${VERSION}_Linux-64bit.tar.gz
$ tar zxvf dockle.tar.gz
$ ./dockle test-image:v1

Windows

$ export DOCKER_CONTENT_TRUST=1
$ docker build -t test-image:v1 .
$ VERSION=$(
 curl --silent "https://api.github.com/repos/goodwithtech/dockle/releases/latest" | \
 grep '"tag_name":' | \
 sed -E 's/.*"v([^"]+)".*/\1/' \
) && curl -L -o dockle.zip https://github.com/goodwithtech/dockle/releases/download/v${VERSION}/dockle_${VERSION}_Windows-64bit.zip
$ unzip dockle.zip && rm dockle.zip
$ ./dockle.exe test-image:v1

via Docker

$ VERSION=$(
 curl --silent "https://api.github.com/repos/goodwithtech/dockle/releases/latest" | \
 grep '"tag_name":' | \
 sed -E 's/.*"v([^"]+)".*/\1/' \
) && docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
 goodwithtech/dockle:v${VERSION} test-image:v1

You only need -v /var/run/docker.sock:/var/run/docker.sock when you'd like to scan the image on your host machine.

Results

PASS    - CIS-DI-0001: Create a user for the container
PASS    - CIS-DI-0005: Enable Content trust for Docker
PASS    - CIS-DI-0006: Add HEALTHCHECK instruction to the container image
PASS    - CIS-DI-0007: Do not use update instructions alone in the Dockerfile
PASS    - CIS-DI-0008: Remove setuid and setgid permissions in the images
PASS    - CIS-DI-0009: Use COPY instead of ADD in Dockerfile
PASS    - CIS-DI-0010: Do not store secrets in ENVIRONMENT variables
PASS    - CIS-DI-0010: Do not store secret files
PASS    - DKL-DI-0001: Avoid sudo command
PASS    - DKL-DI-0002: Avoid sensitive directory mounting
PASS    - DKL-DI-0003: Avoid apt-get/apk/dist-upgrade
PASS    - DKL-DI-0004: Use apk add with --no-cache
PASS    - DKL-DI-0005: Clear apt-get caches
PASS    - DKL-DI-0006: Avoid latest tag
PASS    - DKL-LI-0001: Avoid empty password
PASS    - DKL-LI-0002: Be unique UID
PASS    - DKL-LI-0002: Be unique GROUP

This tool checks CIS Benchmarks and Best practices for writing Dockerfiles
.

Dockle shows short messages suggestions for improvement when there are problems.

WARN    - CIS-DI-0001: Create a user for the container
        * Last user should not be root
PASS    - CIS-DI-0005: Enable Content trust for Docker
WARN    - CIS-DI-0006: Add HEALTHCHECK instruction to the container image
        * not found HEALTHCHECK statement
PASS    - CIS-DI-0007: Do not use update instructions alone in the Dockerfile
INFO    - CIS-DI-0008: Remove setuid and setgid permissions in the images
        * Found setuid file: usr/lib/openssh/ssh-keysign urwxr-xr-x
FATAL   - CIS-DI-0009: Use COPY instead of ADD in Dockerfile
        * Use COPY : /bin/sh -c #(nop) ADD file:81c0a803075715d1a6b4f75a29f8a01b21cc170cfc1bff6702317d1be2fe71a3 in /app/credentials.json
FATAL   - CIS-DI-0010: Do not store secrets in ENVIRONMENT variables
        * Suspicious ENV key found : MYSQL_PASSWD
FATAL   - CIS-DI-0010: Do not store secret files
        * Suspicious filename found : app/credentials.json
PASS    - DKL-DI-0001: Avoid sudo command
FATAL   - DKL-DI-0002: Avoid sensitive directory mounting
        * Avoid mounting sensitive dirs : /usr
PASS    - DKL-DI-0003: Avoid apt-get/apk/dist-upgrade
PASS    - DKL-DI-0004: Use apk add with --no-cache
FATAL   - DKL-DI-0005: Clear apt-get caches
        * Use 'rm -rf /var/lib/apt/lists' after 'apt-get install' : /bin/sh -c apt-get update && apt-get install -y git
PASS    - DKL-DI-0006: Avoid latest tag
FATAL   - DKL-LI-0001: Avoid empty password
        * No password user found! username : nopasswd
PASS    - DKL-LI-0002: Be unique UID
PASS    - DKL-LI-0002: Be unique GROUP

You can check details to searching analysys codes(CIS-DI-0001...) on README.

You don't mind if your image doesn't pass checkpoints.
It's one of an indicator.

Sometimes you have to run as root.

Sometimes CLI tool doesn't need HEALTHCHECK.

Sometimes use ADD statement when you'd like to add tar files.

I hope this is reminder that really you'd like to do so.

You can be specified to ignore rules to give --ignore, -i option or create .dockleignore.

$ dockle -i CIS-DI-0001 -i CIS-DI-0006 [IMAGE_NAME]

# run as root
CIS-DI-0001
# don't use HEALTHCHECK
CIS-DI-0006
# use latest tag
DKL-DI-0006

Let's do it again.

IGNORE  - CIS-DI-0001: Create a user for the container
INFO    - CIS-DI-0005: Enable Content trust for Docker
        * export DOCKER_CONTENT_TRUST=1 before docker pull/build
IGNORE  - CIS-DI-0006: Add HEALTHCHECK instruction to the container image
PASS    - CIS-DI-0007: Do not use update instructions alone in the Dockerfile
INFO    - CIS-DI-0008: Remove setuid and setgid permissions in the images
        * Found setuid file: usr/lib/openssh/ssh-keysign urwxr-xr-x
IGNORE  - CIS-DI-0009: Use COPY instead of ADD in Dockerfile
FATAL   - CIS-DI-0010: Do not store secrets in ENVIRONMENT variables
        * Suspicious ENV key found : MYSQL_PASSWD
FATAL   - CIS-DI-0010: Do not store secret files
        * Suspicious filename found : app/credentials.json
PASS    - DKL-DI-0001: Avoid sudo command
FATAL   - DKL-DI-0002: Avoid sensitive directory mounting
        * Avoid mounting sensitive dirs : /usr
PASS    - DKL-DI-0003: Avoid apt-get/apk/dist-upgrade
PASS    - DKL-DI-0004: Use apk add with --no-cache
FATAL   - DKL-DI-0005: Clear apt-get caches
        * Use 'rm -rf /var/lib/apt/lists' after 'apt-get install' : /bin/sh -c apt-get update && apt-get install -y git
PASS    - DKL-DI-0006: Avoid latest tag
FATAL   - DKL-LI-0001: Avoid empty password
        * No password user found! username : nopasswd
PASS    - DKL-LI-0002: Be unique UID
PASS    - DKL-LI-0002: Be unique GROUP

Closing

Dockle is NOT a Dockerfile Linter, but a Docker Image Linter.

Dockle can check deeply. (file permissions, credential files...) So, Dockle is able to check important rules than others, especially for security.

And Dockle is able to analyze an image created by stdin, too. You could use it in many places.

docker build -<<EOF
FROM busybox
RUN echo "hello world"
EOF

I hope you like it!

Thanks!!

How to keep secure your Docker Image

Tomoya Amachi — Fri, 14 Jun 2019 15:17:09 +0000

Overviews

Containers are one of the best tools in recent years.
But it hasn't been established for DevSecOps for containers. Many organizations are unable to keep secure containers' ecosystem.

This article aims to what is the security best practices Docker Images.

Do you know Clair and Docker Bench for Security? but It's insufficient.

TL;DL

CIS Benchmarks published Docker security checkpoints
Check your images by Dockle and Trivy
Easy to check in CI before docker push

CIS Benchmarks

One of the best security best practice provided by The Center for Internet Security(CIS).
Their Container Images and Build File has 11 checkpoints.

Create a user for the container
Use trusted base images for containers
Do not install unnecessary packages in the container
Scan and rebuild the images to include security patches
Enable Content trust for Docker
Add HEALTHCHECK instruction to the container image
Do not use update instructions alone in the Dockerfile
Remove setuid and setgid permissions in the images
Use COPY instead of ADD in Dockerfile
Do not store secrets in Dockerfiles
Install verified packages only

Clair only supports Scan and rebuild the images to include security patches.

What is `Dockle`

Dockle is Simple Security Auditing and helping build the Best Docker Image tool.

	Dockle	Docker Bench for Security	Clair	Trivy
1. Create a user for the container	✅	✅	-	-
2. Use trusted base images for containers	-	-	-	-
3. Do not install unnecessary packages in the container	-	-	-	-
4. Scan and rebuild the images to include security patches	-	-	✅	✅
5. Enable Content trust for Docker	✅	✅	-	-
6. Add HEALTHCHECK instruction to the container image	✅	✅	-	-
7. Do not use update instructions alone in the Dockerfile	✅	✅	-	-
8. Remove setuid and setgid permissions in the images	✅	-	-	-
9. Use COPY instead of ADD in Dockerfile	✅	✅	-	-
10. Do not store secrets in Dockerfiles	✅	-	-	-
11. Install verified packages only	-	-	-	-

and Dockle can detect CVE-2019-5021 and some other securityholes.

Use Dockle

You can start easy!

Homebrew (Mac / Linux)



$ export DOCKER_CONTENT_TRUST=1
$ docker build -t test-image:v1 .
$ brew install goodwithtech/dockle/dockle
$ dockle test-image:v1

Linux



$ export DOCKER_CONTENT_TRUST=1
$ docker build -t test-image:v1 .
$ VERSION=$(
 curl --silent "https://api.github.com/repos/goodwithtech/dockle/releases/latest" | \
 grep '"tag_name":' | \
 sed -E 's/.*"v([^"]+)".*/\1/' \
) && curl -L -o dockle.tar.gz https://github.com/goodwithtech/dockle/releases/download/v${VERSION}/dockle_${VERSION}_Linux-64bit.tar.gz
$ tar zxvf dockle.tar.gz
$ ./dockle test-image:v1

Windows



$ export DOCKER_CONTENT_TRUST=1
$ docker build -t test-image:v1 .
$ VERSION=$(
 curl --silent "https://api.github.com/repos/goodwithtech/dockle/releases/latest" | \
 grep '"tag_name":' | \
 sed -E 's/.*"v([^"]+)".*/\1/' \
) && curl -L -o dockle.zip https://github.com/goodwithtech/dockle/releases/download/v${VERSION}/dockle_${VERSION}_Windows-64bit.zip
$ unzip dockle.zip && rm dockle.zip
$ ./dockle.exe test-image:v1

You can check installation here.

Run Result is here.

Check in CI

You can use Trivy instead of Clair.
Trivy is easy to start and supports library packages and better accuracy than Clair.

CircleCI



jobs:

  build:

    docker:

      - image: docker:18.09-git

    steps:

      - checkout

      - setup_remote_docker

      - restore_cache:

          key: vulnerability-db

      - run:

          name: Build image

          command: docker build -t ci-test:${CIRCLE_SHA1} .

      - run:

          name: Install dockle

          command: |

            apk add --update curl

            VERSION=$(

                curl --silent "https://api.github.com/repos/goodwithtech/dockle/releases/latest" | </span>

                grep '"tag_name":' | </span>

                sed -E 's/."v([^"]+)"./\1/'

            )

        <span class="s">wget https://github.com/goodwithtech/dockle/releases/download/v${VERSION}/dockle_${VERSION}_Linux-64bit.tar.gz</span>
        <span class="s">tar zxvf dockle_${VERSION}_Linux-64bit.tar.gz</span>
        <span class="s">mv dockle /usr/local/bin</span>
  <span class="pi">-</span> <span class="na">run</span><span class="pi">:</span>
      <span class="na">name</span><span class="pi">:</span> <span class="s">Scan the local image with dockle</span>
      <span class="na">command</span><span class="pi">:</span> <span class="s">dockle --exit-code 1 ci-test:${CIRCLE_SHA1}</span>          

  <span class="pi">-</span> <span class="na">run</span><span class="pi">:</span>
      <span class="na">name</span><span class="pi">:</span> <span class="s">Install trivy</span>
      <span class="na">command</span><span class="pi">:</span> <span class="pi">|</span>
        <span class="s">apk add --update curl</span>
        <span class="s">VERSION=$(</span>
            <span class="s">curl --silent "https://api.github.com/repos/knqyf263/trivy/releases/latest" | \</span>
            <span class="s">grep '"tag_name":' | \</span>
            <span class="s">sed -E 's/.*"v([^"]+)".*/\1/'</span>
        <span class="s">)</span>
        <span class="s">wget https://github.com/knqyf263/trivy/releases/download/v${VERSION}/trivy_${VERSION}_Linux-64bit.tar.gz</span>
        <span class="s">tar zxvf trivy_${VERSION}_Linux-64bit.tar.gz</span>
        <span class="s">mv trivy /usr/local/bin</span>
  <span class="pi">-</span> <span class="na">run</span><span class="pi">:</span>
      <span class="na">name</span><span class="pi">:</span> <span class="s">Scan the local image with trivy</span>
      <span class="na">command</span><span class="pi">:</span> <span class="s">trivy --exit-code 1 --quiet --auto-refresh trivy-ci-test:${CIRCLE_SHA1}</span>
  <span class="pi">-</span> <span class="na">save_cache</span><span class="pi">:</span>
      <span class="na">key</span><span class="pi">:</span> <span class="s">vulnerability-db</span>
      <span class="na">paths</span><span class="pi">:</span>
        <span class="pi">-</span> <span class="s">$HOME/.cache/trivy</span>



workflows:

  version: 2

  release:

    jobs:

      - build

TravisCI



services:

  - docker

env:

  global:

    - COMMIT=${TRAVIS_COMMIT::8}

before_install:

  - docker build -t ci-test:${COMMIT} .

  - export DOCKLE_VERSION=$(curl --silent "https://api.github.com/repos/goodwithtech/dockle/releases/latest" | grep '"tag_name":' | sed -E 's/."v([^"]+)"./\1/')

  - wget https://github.com/goodwithtech/dockle/releases/download/v${DOCKLE_VERSION}/dockle_${DOCKLE_VERSION}_Linux-64bit.tar.gz

  - tar zxvf dockle_${DOCKLE_VERSION}Linux-64bit.tar.gz

  - export TRIVY_VERSION=$(curl --silent "https://api.github.com/repos/knqyf263/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/."v([^"]+)"./\1/')

  - wget https://github.com/knqyf263/trivy/releases/download/v${TRIVY_VERSION}/trivy${TRIVY_VERSION}Linux-64bit.tar.gz

  - tar zxvf trivy${TRIVY_VERSION}_Linux-64bit.tar.gz

script:

  - ./dockle --exit-code 1 ci-test:${COMMIT}

  - ./trivy --exit-code 1 --quiet --auto-refresh ci-test:${COMMIT}

cache:

  directories:

    - $HOME/.cache/trivy

Conclusion

You can check your Docker Container Images to use Dockle and Trivy!
These are OSS tools.

If you feel like I missed something, got some details wrong, or just want to say hi, please feel free to leave a comment below or reach out to me on GitHub or Twitter.

DEV Community: Tomoya Amachi

The One Thing You Should Do After Building Best-Practice Docker Image (in 3 minutes)

Overview

How to use

Homebrew (Mac / Linux)

Linux

Windows

via Docker

Results

Closing

How to keep secure your Docker Image

Overviews

TL;DL

CIS Benchmarks

What is Dockle

Use Dockle

Homebrew (Mac / Linux)

Linux

Windows

Check in CI

CircleCI

TravisCI

Conclusion

What is `Dockle`