4.9 Use COPY instead of ADD in Dockerfile

Information

Use COPY instruction instead of ADD instruction in the Dockerfile.

Rationale:

COPY instruction just copies the files from the local host machine to the container file system. ADDinstruction potentially could retrieve files from remote URLs and perform operations such as unpacking. Thus, ADD instructionintroduces risks such as adding malicious files from URLs without scanning and unpacking procedure vulnerabilities.

Solution

Use COPY instructions in Dockerfiles.

Impact:

You would need to take care of the functionalities provided by ADD instructions such as fetching files from remote URLs.

Default Value:

Not Applicable

See Also

https://workbench.cisecurity.org/files/1476

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7b.

Plugin: Unix

Control ID: 5a912477d751d45a6afcea5a293d2ef9cb8906c1591485d640973f5d82030fc0