Project: Terrascan (Provisioning / Security & Compliance)
File: docker.md

| Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | MEDIUM | Ensure platform flag with FROM command is not used for Docker file | ACDOCKER0041 | ACDOCKER0041 | | Infrastructure Security | json | MEDIUM | Ensure platform flag with FROM command is not used for Docker file | ACDOCKER0001 | ACDOCKER0001 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | LOW | Ensure use Curl or Wget instead of Add to fetch packages from remote URLs, because using Add is strongly discouraged | ACDOCKER0035 | ACDOCKER0035 | | Infrastructure Security | json | LOW | Ensure use of COPY instead of ADD unless, running a tar file | ACDOCKER0032 | ACDOCKER0032 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | LOW | Ensure only the ports that your application needs are used and avoid exposing ports like SSH (22) | ACDOCKER0026 | ACDOCKER0026 | | Infrastructure Security | json | HIGH | Ensure range of ports is from 0 to 65535 | ACDOCKER0011 | ACDOCKER0011 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | LOW | Ensure that HEALTHCHECK is being used. | ACDOCKER0047 | ACDOCKER0047 | | Infrastructure Security | json | MEDIUM | Ensure the command SHELL to override the default shell instead of the RUN

| ACDOCKER0020 | ACDOCKER0020 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | MEDIUM | Ensure Pinned Pip Package Version | ACDOCKER0010 | ACDOCKER0010 | | Infrastructure Security | json | MEDIUM | Ensure when installing packages with pip, the '--no-cache-dir' flag should be set to make Docker images smaller | ACDOCKER0031 | ACDOCKER0031 | | Infrastructure Security | json | HIGH | Ensure to avoid RUN with sudo command | ACDOCKER0007 | ACDOCKER0007 | | Infrastructure Security | json | MEDIUM | Ensure WORKDIR command is getting used instead of proliferating instructions like RUN | ACDOCKER0018 | ACDOCKER0018 | | Infrastructure Security | json | LOW | Ensure any apt-get installs don't use '--no-install-recommends' flag | ACDOCKER0014 | ACDOCKER0014 | | Infrastructure Security | json | MEDIUM | Ensure apt is not used with RUN command for Docker file | ACDOCKER0002 | ACDOCKER0002 | | Infrastructure Security | json | MEDIUM | Ensure apk upgrade is not being used. | ACDOCKER0039 | ACDOCKER0039 | | Infrastructure Security | json | MEDIUM | Ensure dnf Update is not used for Docker file | ACDOCKER0003 | ACDOCKER0003 | | Infrastructure Security | json | MEDIUM | Ensure that there is only be one CMD instruction in a Dockerfile. If you list more than one CMD then only the last CMD will take effect | ACDOCKER0053 | ACDOCKER0053 | | Infrastructure Security | json | MEDIUM | Ensure yum install allow manual input with RUN command for Docker file | ACDOCKER0004 | ACDOCKER0004 | | Infrastructure Security | json | MEDIUM | Ensure instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement | ACDOCKER0049 | ACDOCKER0049 | | Infrastructure Security | json | MEDIUM | Ensure package version is specified to avoid failures | ACDOCKER0033 | ACDOCKER0033 | | Infrastructure Security | json | MEDIUM | Ensure Cached package data should be cleaned after installation to reduce image size | ACDOCKER00025 | ACDOCKER00025 | | Infrastructure Security | json | MEDIUM | Ensure Yum Clean All is used after Yum Install | ACDOCKER0009 | ACDOCKER0009 | | Infrastructure Security | json | HIGH | Ensure Yum update is being used | ACDOCKER0029 | ACDOCKER0029 | | Infrastructure Security | json | MEDIUM | Ensure root with RUN command is not used for Docker file | ACDOCKER0005 | ACDOCKER0005 | | Infrastructure Security | json | HIGH | Ensure that Commands 'apt-get upgrade' and 'apt-get dist-upgrade' are not being used | ACDOCKER0052 | ACDOCKER0052 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | HIGH | Ensure the use absolute paths for your WORKDIR. | ACDOCKER0013 | ACDOCKER0013 | | Category | Resource | Severity | Description | Reference ID | ID | | -- | -- | -- | -- | | -- | | Infrastructure Security | json | MEDIUM | Ensure not to use --chown flag when user only needs execution permission | ACDOCKER00024 | ACDOCKER00024 |