4.7 Do not use update instructions alone in the Dockerfile

Information

Do not use update instructions such as apt-get updatealone or in a single line in the Dockerfile.

Rationale:

Adding the update instructions in a single line on the Dockerfile will cache the update layer. Thus, when you build any image later using the same instruction, previously cached update layer will be used. This could potentially deny any fresh updates to go in the later builds.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Use update instructions along with install instructions (or any other) and version pinning for packages while installing them. This would bust the cache and force to extract the required versions.

Alternatively, you could use --no-cache flag duringdocker buildprocess to avoid using cached layers.

Impact:

None

Default Value:

By default, docker does not enforce any restrictions on using update instructions.

See Also

https://workbench.cisecurity.org/files/1476

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Unix

Control ID: d8815313ddbed9c80badee770f892cc81b619b77db9e7f9e036bba2196dca31d