9

Is there any service that provides certified, security hardened Docker images for common platforms like Python, PHP, Node, Java, etc. with 0 major/critical CVEs.

Currently, we are using the ones from RedHat but the problem is, even If I scan the RedHat provided image with A level (means clean), through Docker trusted registry CVE database, I found at least 50 critical and more than 50 major CVEs in them; therefore, I can't establish a baseline on top of which I can scan the user added apps for CVEs and could decide to fail the security scanning test.

We need that kind of service to establish a secure image build pipeline, so that we don't start overlooking at the application level CVEs , once we fix all the CVEs in base images , or get base images in which all the CVEs are being fixed regularly then we will be able to clearly decide automatically that the CVE is due to application and stop promoting the image in the pipeline.

Improve this question
2
  • I have answered such similar question here stackoverflow.com/a/56643545/6790948 Have a look.
    – mchawre
    Commented Jun 30, 2019 at 9:51
  • CVE scanner can only be used to detect vulnerabilities in packages installed from the repositories, and it cannot detect novel vulnerabilities, only previously discovered ones. It cannot detect application level unless that bespoke apps also publishes their vulnerabilities in CVE and provide its version identifiers in a manner usable by the scanner (which most apps don't). In which case, you don't need a CVE scanner, just find out the app version directly and feed it to the CVE checker.
    – Lie Ryan
    Commented Sep 26, 2019 at 0:46

2 Answers 2

Reset to default
8

I would consider the Center For Internet Security (CIS) Benchmarks the current gold standard for hardening.
I'd caution against a pre-hardened image and instead recommend that you harden it yourself using an open source script that can be reviewed/approved to ensure you are not introducing malicious/purposeful flaws into your environment.

CIS Benchmarks for Docker can be found here.

An open source hardening example (there are many out there) can be found here.

Docker then offers the following script to check that the changes have been made successfully.

Improve this answer
6
  • 1
    Hi, the docker bench is good for checking the docker configuration is secure for production use , My question is how to get the base images that can pass all the scanning tests , we need that kind of service to establish a secure image build pipeline.
    – Ijaz Ahmad
    Commented Oct 16, 2018 at 21:27
  • 1
    By scanning tests, do you mean vulnerability scans? If so, that could be challenging since new vulns are released far more frequently than images are updated. Usually the best way to fix that is to have an update command scripted into the build process so that new builds are always running the latest and greatest.
    – HashHazard
    Commented Oct 16, 2018 at 21:38
  • I mean we are looking for a way to keep the base image clean as reported by CVE scanner so that we can catch the CVEs in the rest of the layers. kind of automating the decsion that the CVE is in the app layers and fail the test in that case. if we have CVEs in the base images then we cant decide automatically whther its in the base image or in the app layers. that will need manual work
    – Ijaz Ahmad
    Commented Oct 16, 2018 at 21:58
  • @IjazKhan: test the images from the ground up. Suppose you have a CVE scanner loaded with rules version 1.2.3 For an image Z based on images Y, itself based on X, you would test in the following order: X, Y, Z. Stop when a CVE appears. At that point you are in the image that needs fixing. (You may, as an optimization, cache the images tested and version of rules used, so if X passed 5 minutes ago the same set of rules, consider it as passed)
    – Ángel
    Commented Oct 16, 2018 at 22:42
  • The CVEs in the bease images are there for years , so I think they cant be fixed , I need some way to tell the scanner to ACK or ignore the base image CVEs
    – Ijaz Ahmad
    Commented Oct 17, 2018 at 8:39
3

The only images which have any form of assurance on Docker Hub are the "official" images maintained by Docker.

However it's important to recognize that the maintainers have taken the approach that they're not necessarily going to update the image for every CVE released (more here)

If you want CVE scanner clean images, I'd recommend something like

  1. Start with an official image
  2. Launch a container based on that image
  3. Use the package manager to update
  4. Save the resultant container as an image
  5. (optional) squash the image back down to a single layer

And then have this process run as regularly as required to maintain a clean image.

AFAIK no-one has produced certified hardened images past this.

Improve this answer
5
  • hi , thanks for the ideas +1 , do you think running the update will fix the CVEs? the use case is we need the base image to be clean of CVEs so that that automated system can detect and decide that if there is any CVE , it is because of application layers and hence fail the promotion of image to production.
    – Ijaz Ahmad
    Commented Oct 17, 2018 at 16:03
  • Or putting it other way , is there any system that can decide automatically that a particular CVE is in base image or application layer and decide on the result accordingly? in docker DTR it just shows you the results and there is no option of chosing promotion based on the layer level CVE , it just shows overall results for major and cirtical , and minor
    – Ijaz Ahmad
    Commented Oct 17, 2018 at 16:06
  • My guess is that it should address this. The reason is that claire/anchore/dagda all use the distro sec-DBs as their "source of truth" with regards to CVEs. so if you patch all the issue that the distro knows about you should have addressed the problem (for OS/base packages only, obv. for app. code that's a different problem)
    – Rory McCune
    Commented Oct 17, 2018 at 16:32
  • Yes , for the OS base packages , so if i download an image the latest one build a day go from redhat or other vendors , they still have CVEs, very strange, maybe they are using different db , than the one used by docker ee
    – Ijaz Ahmad
    Commented Oct 17, 2018 at 18:11
  • yeah the official images will still have CVEs 'cause the Docker team that maintain them don't rebuild on every CVE. that's why you need to get the official image and update it to get the latest fixes :) If you're seeing CVEs after having done an update using the OS package manager, that's interesting! I've not not Docker EE to hand to test exactly what they're doing.
    – Rory McCune
    Commented Oct 17, 2018 at 22:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .