2

Is there any service that provides certified, security hardened Docker images for common platforms like Python, PHP, Node, Java, etc. with 0 major/critical CVEs.

Currently, we are using the ones from RedHat but the problem is, even If I scan the RedHat provided image with A level (means clean), through Docker trusted registry CVE database, I found at least 50 critical and more than 50 major CVEs in them; therefore, I can't establish a baseline on top of which I can scan the user added apps for CVEs and could decide to fail the security scanning test.

We need that kind of service to establish a secure image build pipeline, so that we don't start overlooking at the application level CVEs , once we fix all the CVEs in base images , or get base images in which all the CVEs are being fixed regularly then we will be able to clearly decide automatically that the CVE is due to application and stop promoting the image in the pipeline.

2

I would consider the Center For Internet Security (CIS) Benchmarks the current gold standard for hardening. I'd caution against a pre-hardened image and instead recommend that you harden it yourself using an open source script that can be reviewed/approved to ensure you are not introducing malicious/purposeful flaws into your environment.

CIS Benchmarks for Docker can be found here: https://www.cisecurity.org/benchmark/docker/

An open source hardening example (there are many out there) can be found here: https://github.com/florianutz/DockerCE-CIS

Docker then offers the following script to check that the changes have been made successfully: https://github.com/docker/docker-bench-security

  • Hi, the docker bench is good for checking the docker configuration is secure for production use , My question is how to get the base images that can pass all the scanning tests , we need that kind of service to establish a secure image build pipeline. – Ijaz Ahmad Khan Oct 16 '18 at 21:27
  • 1
    By scanning tests, do you mean vulnerability scans? If so, that could be challenging since new vulns are released far more frequently than images are updated. Usually the best way to fix that is to have an update command scripted into the build process so that new builds are always running the latest and greatest. – HashHazard Oct 16 '18 at 21:38
  • I mean we are looking for a way to keep the base image clean as reported by CVE scanner so that we can catch the CVEs in the rest of the layers. kind of automating the decsion that the CVE is in the app layers and fail the test in that case. if we have CVEs in the base images then we cant decide automatically whther its in the base image or in the app layers. that will need manual work – Ijaz Ahmad Khan Oct 16 '18 at 21:58
  • @IjazKhan: test the images from the ground up. Suppose you have a CVE scanner loaded with rules version 1.2.3 For an image Z based on images Y, itself based on X, you would test in the following order: X, Y, Z. Stop when a CVE appears. At that point you are in the image that needs fixing. (You may, as an optimization, cache the images tested and version of rules used, so if X passed 5 minutes ago the same set of rules, consider it as passed) – Ángel Oct 16 '18 at 22:42
  • The CVEs in the bease images are there for years , so I think they cant be fixed , I need some way to tell the scanner to ACK or ignore the base image CVEs – Ijaz Ahmad Khan Oct 17 '18 at 8:39
1

The only images which have any form of assurance on Docker Hub are the "official" images maintained by Docker.

However it's important to recognize that the maintainers have taken the approach that they're not necessarily going to update the image for every CVE released (more here)

If you want CVE scanner clean images, I'd recommend something like

  1. Start with an official image
  2. Launch a container based on that image
  3. Use the package manager to update
  4. Save the resultant container as an image
  5. (optional) squash the image back down to a single layer

And then have this process run as regularly as required to maintain a clean image.

AFAIK no-one has produced certified hardened images past this.

  • hi , thanks for the ideas +1 , do you think running the update will fix the CVEs? the use case is we need the base image to be clean of CVEs so that that automated system can detect and decide that if there is any CVE , it is because of application layers and hence fail the promotion of image to production. – Ijaz Ahmad Khan Oct 17 '18 at 16:03
  • Or putting it other way , is there any system that can decide automatically that a particular CVE is in base image or application layer and decide on the result accordingly? in docker DTR it just shows you the results and there is no option of chosing promotion based on the layer level CVE , it just shows overall results for major and cirtical , and minor – Ijaz Ahmad Khan Oct 17 '18 at 16:06
  • My guess is that it should address this. The reason is that claire/anchore/dagda all use the distro sec-DBs as their "source of truth" with regards to CVEs. so if you patch all the issue that the distro knows about you should have addressed the problem (for OS/base packages only, obv. for app. code that's a different problem) – Rоry McCune Oct 17 '18 at 16:32
  • Yes , for the OS base packages , so if i download an image the latest one build a day go from redhat or other vendors , they still have CVEs, very strange, maybe they are using different db , than the one used by docker ee – Ijaz Ahmad Khan Oct 17 '18 at 18:11
  • yeah the official images will still have CVEs 'cause the Docker team that maintain them don't rebuild on every CVE. that's why you need to get the official image and update it to get the latest fixes :) If you're seeing CVEs after having done an update using the OS package manager, that's interesting! I've not not Docker EE to hand to test exactly what they're doing. – Rоry McCune Oct 17 '18 at 22:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.