Vulnerability scanning for Docker images
Tags: docker, security, containers, devops
Published: 2022-01-17 20:47:55

In my previous blog [Automate docker security audits with docker bench for security](https://dev.to/docker/automate-docker-security-audits-with-docker-bench-for-security-206g), we learned about how to automate Docker Security Audits with Docker Bench for Security.

But, remember that Docker Bench isn’t an exhaustive test. There are other aspects to maintaining Docker security that shouldn’t be overlooked either.

A compromised container could give attackers a foothold into your systems, even if you have strong host-level security. You can reduce this risk by using Docker Bench, alongside active container vulnerability scanners like Docker scan (snyk), Grype, Trivy and Clair. These will help you identify problems within your containers, such as outdated dependencies that could be exploited.

## Vulnerability scanning for Docker local images using 'docker scan'

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vto4eokjayc9jvqpu99x.png)
  
Vulnerability scanning for Docker local images allows developers and development teams to review the security state of the container images and take actions to fix issues identified during the scan, resulting in more secure deployments. **Docker Scan runs on Snyk engine**, providing users with visibility into the security posture of their local Dockerfiles and local images.

```
macpro$ docker scan --accept-license --version
Version:    v0.16.0
Git commit: e135637
Provider:   Snyk (1.809.0)

macpro$ docker scan postgres:12
\ Analyzing container dependencies for postgres:12

Testing postgres:12...

✗ Low severity vulnerability found in tar
  Description: CVE-2005-2541
  Info: https://snyk.io/vuln/SNYK-DEBIAN11-TAR-523480
  Introduced through: meta-common-packages@meta
  From: meta-common-packages@meta > tar@1.34+dfsg-1

✗ Low severity vulnerability found in pcre3/libpcre3
  Description: Out-of-Bounds
  Info: https://snyk.io/vuln/SNYK-DEBIAN11-PCRE3-529490
  Introduced through: pcre3/libpcre3@2:8.39-13, grep@3.6-1
  From: pcre3/libpcre3@2:8.39-13
  From: grep@3.6-1 > pcre3/libpcre3@2:8.39-13

✗ Low severity vulnerability found in pcre3/libpcre3
  Description: Out-of-bounds Read
  Info: https://snyk.io/vuln/SNYK-DEBIAN11-PCRE3-572353
  Introduced through: pcre3/libpcre3@2:8.39-13, grep@3.6-1
  From: pcre3/libpcre3@2:8.39-13
  From: grep@3.6-1 > pcre3/libpcre3@2:8.39-13

✗ Low severity vulnerability found in apt/libapt-pkg6.0
  Description: Improper Verification of Cryptographic Signature
  Info: https://snyk.io/vuln/SNYK-DEBIAN11-APT-522585
  Introduced through: postgresql-12@12.9-1.pgdg110+1
  From: postgresql-12@12.9-1.pgdg110+1 > postgresql-12/postgresql-client-12@12.9-1.pgdg110+1 > postgresql-common/postgresql-client-common@232.pgdg110+1 > pgdg-keyring@2018.2 > apt@2.2.4 > apt/libapt-pkg6.0@2.2.4
  From: postgresql-12@12.9-1.pgdg110+1 > postgresql-12/postgresql-client-12@12.9-1.pgdg110+1 > postgresql-common/postgresql-client-common@232.pgdg110+1 > pgdg-keyring@2018.2 > apt@2.2.4

✗ High severity vulnerability found in perl/perl-base
  Description: Improper Verification of Cryptographic Signature
  Info: https://snyk.io/vuln/SNYK-DEBIAN11-PERL-1925976
  Introduced through: meta-common-packages@meta, perl/libperl5.32@5.32.1-4+deb11u2, perl@5.32.1-4+deb11u2, perl/perl-modules-5.32@5.32.1-4+deb11u2
  From: meta-common-packages@meta > perl/perl-base@5.32.1-4+deb11u2
  From: perl/libperl5.32@5.32.1-4+deb11u2
  From: perl@5.32.1-4+deb11u2 > perl/libperl5.32@5.32.1-4+deb11u2
  and 4 more.

✗ High severity vulnerability found in libgcrypt20
  Description: Information Exposure
  Info: https://snyk.io/vuln/SNYK-DEBIAN11-LIBGCRYPT20-1297892
  Introduced through: gnupg2/dirmngr@2.2.27-2, gnupg2/gnupg@2.2.27-2, postgresql-12@12.9-1.pgdg110+1
  From: gnupg2/dirmngr@2.2.27-2 > libgcrypt20@1.8.7-6
  From: gnupg2/dirmngr@2.2.27-2 > gnupg2/gpgconf@2.2.27-2 > libgcrypt20@1.8.7-6
  From: gnupg2/gnupg@2.2.27-2 > gnupg2/gnupg-utils@2.2.27-2 > libgcrypt20@1.8.7-6
  and 9 more.

✗ Critical severity vulnerability found in glibc/libc-bin
  Description: Use After Free
  Info: https://snyk.io/vuln/SNYK-DEBIAN11-GLIBC-1296898
  Introduced through: glibc/locales@2.31-13+deb11u2, postgresql-12@12.9-1.pgdg110+1, meta-common-packages@meta
  From: glibc/locales@2.31-13+deb11u2 > glibc/libc-bin@2.31-13+deb11u2
  From: glibc/locales@2.31-13+deb11u2 > glibc/libc-l10n@2.31-13+deb11u2
  From: glibc/locales@2.31-13+deb11u2
  and 2 more.


Package manager:   deb
Project name:      docker-image|postgres
Docker image:      postgres:12
Platform:          linux/amd64
Base image:        postgres:12.9-bullseye

Tested 147 dependencies for known vulnerabilities, found 48 vulnerabilities.

According to our scan, you are currently using the most secure version of the selected base image

For more free scans that keep your images secure, sign up to Snyk at https://dockr.ly/3ePqVcp
```
**You get below free scans per month:**
Local vulnerability scans:  10 scans	
Local vulnerability scans with Snyk: 200 scans	

For more information refer to https://docs.docker.com/engine/scan
https://www.docker.com/pricing


## A vulnerability scanner for container images and filesystems using [Grype](https://github.com/anchore/grype)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nc5gkyf4hcy6oiu30nr4.png)
 
Grype is a vulnerability scanner for container images and filesystems. Easily install the binary to try it out. Works with Syft, the powerful SBOM (software bill of materials) tool for container images and filesystems.

## Installation
**Recommended**

```
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
...or, you can specify a release version and destination directory for the installation:

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b <DESTINATION_DIR> <RELEASE_VERSION>
```

**Homebrew**

```
brew tap anchore/grype
brew install grype
```
Note: Currently, Grype is built only for macOS and Linux.


```
macpro$ grype k8s.gcr.io/kube-scheduler:v1.22.5 --scope all-layers
 ✔ Vulnerability DB        [no update available]
 ✔ Loaded image
 ✔ Parsed image
 ✔ Cataloged packages      [3 packages]
 ✔ Scanned image           [0 vulnerabilities]

No vulnerabilities found


macpro$ grype postgres:12 --scope all-layers
 ✔ Vulnerability DB        [no update available]
 ✔ Loaded image
 ✔ Parsed image
 ✔ Cataloged packages      [718 packages]
 ✔ Scanned image           [550 vulnerabilities]

NAME                            INSTALLED         FIXED-IN     VULNERABILITY        SEVERITY
apt                             2.2.4                          CVE-2011-3374        Negligible
coreutils                       8.32-4+b1         (won't fix)  CVE-2016-2781        Low
coreutils                       8.32-4+b1                      CVE-2017-18018       Negligible
github.com/opencontainers/runc  v1.0.1            1.0.3        GHSA-v95c-p5hm-xq8f  Medium
libapt-pkg6.0                   2.2.4                          CVE-2011-3374        Negligible
libc-bin                        2.31-13+deb11u2                CVE-2021-43396       Negligible
libc-bin                        2.31-13+deb11u2                CVE-2021-3998        Unknown
libc-bin                        2.31-13+deb11u2                CVE-2021-3999        Unknown
libc-bin                        2.31-13+deb11u2   (won't fix)  CVE-2022-23218       Unknown
libc-bin                        2.31-13+deb11u2   (won't fix)  CVE-2022-23219       Unknown
libc-bin                        2.31-13+deb11u2                CVE-2010-4756        Negligible
libc-bin                        2.31-13+deb11u2                CVE-2018-20796       Negligible
libc-bin                        2.31-13+deb11u2                CVE-2019-1010022     Negligible
libc-bin                        2.31-13+deb11u2                CVE-2019-1010023     Negligible
libc-bin                        2.31-13+deb11u2                CVE-2019-1010024     Negligible
libc-bin                        2.31-13+deb11u2                CVE-2019-1010025     Negligible
libc-bin                        2.31-13+deb11u2                CVE-2019-9192        Negligible
libc-bin                        2.31-13+deb11u2   (won't fix)  CVE-2021-33574       Critical
libc-l10n                       2.31-13+deb11u2                CVE-2021-43396       Negligible
libc-l10n                       2.31-13+deb11u2                CVE-2021-3998        Unknown
libc-l10n                       2.31-13+deb11u2                CVE-2021-3999        Unknown
libc-l10n                       2.31-13+deb11u2   (won't fix)  CVE-2022-23218       Unknown
libc-l10n                       2.31-13+deb11u2   (won't fix)  CVE-2022-23219       Unknown
libc-l10n                       2.31-13+deb11u2                CVE-2010-4756        Negligible
libc-l10n                       2.31-13+deb11u2                CVE-2018-20796       Negligible
libc-l10n                       2.31-13+deb11u2                CVE-2019-1010022     Negligible
libc-l10n                       2.31-13+deb11u2                CVE-2019-1010023     Negligible
libc-l10n                       2.31-13+deb11u2                CVE-2019-1010024     Negligible
libc-l10n                       2.31-13+deb11u2                CVE-2019-1010025     Negligible
libc-l10n                       2.31-13+deb11u2                CVE-2019-9192        Negligible
libc-l10n                       2.31-13+deb11u2   (won't fix)  CVE-2021-33574       Critical
libc6                           2.31-13+deb11u2                CVE-2021-43396       Negligible
libc6                           2.31-13+deb11u2                CVE-2021-3998        Unknown
libc6                           2.31-13+deb11u2                CVE-2021-3999        Unknown
libc6                           2.31-13+deb11u2   (won't fix)  CVE-2022-23218       Unknown
libc6                           2.31-13+deb11u2   (won't fix)  CVE-2022-23219       Unknown
libc6                           2.31-13+deb11u2                CVE-2010-4756        Negligible
libc6                           2.31-13+deb11u2                CVE-2018-20796       Negligible
libc6                           2.31-13+deb11u2                CVE-2019-1010022     Negligible
libc6                           2.31-13+deb11u2                CVE-2019-1010023     Negligible
libc6                           2.31-13+deb11u2                CVE-2019-1010024     Negligible
libc6                           2.31-13+deb11u2                CVE-2019-1010025     Negligible
libc6                           2.31-13+deb11u2                CVE-2019-9192        Negligible
libc6                           2.31-13+deb11u2   (won't fix)  CVE-2021-33574       Critical
libgcrypt20                     1.8.7-6           (won't fix)  CVE-2021-33560       High
libgcrypt20                     1.8.7-6                        CVE-2018-6829        Negligible
libgnutls30                     3.7.1-5                        CVE-2011-3389        Medium
libgssapi-krb5-2                1.18.3-6+deb11u1               CVE-2004-0971        Negligible
libgssapi-krb5-2                1.18.3-6+deb11u1               CVE-2018-5709        Negligible
libk5crypto3                    1.18.3-6+deb11u1               CVE-2004-0971        Negligible
libk5crypto3                    1.18.3-6+deb11u1               CVE-2018-5709        Negligible
libkrb5-3                       1.18.3-6+deb11u1               CVE-2004-0971        Negligible
libkrb5-3                       1.18.3-6+deb11u1               CVE-2018-5709        Negligible
libkrb5support0                 1.18.3-6+deb11u1               CVE-2004-0971        Negligible
libkrb5support0                 1.18.3-6+deb11u1               CVE-2018-5709        Negligible
libldap-2.4-2                   2.4.57+dfsg-3                  CVE-2015-3276        Negligible
libldap-2.4-2                   2.4.57+dfsg-3                  CVE-2017-14159       Negligible
libldap-2.4-2                   2.4.57+dfsg-3                  CVE-2017-17740       Negligible
libldap-2.4-2                   2.4.57+dfsg-3                  CVE-2020-15719       Negligible
libncursesw6                    6.2+20201114-2                 CVE-2021-39537       Negligible
libpcre3                        2:8.39-13                      CVE-2017-11164       Negligible
libpcre3                        2:8.39-13                      CVE-2017-16231       Negligible
libpcre3                        2:8.39-13                      CVE-2017-7245        Negligible
libpcre3                        2:8.39-13                      CVE-2017-7246        Negligible
libpcre3                        2:8.39-13                      CVE-2019-20838       Negligible
libperl5.32                     5.32.1-4+deb11u2               CVE-2011-4116        Negligible
libperl5.32                     5.32.1-4+deb11u2  (won't fix)  CVE-2020-16156       High
libsepol1                       3.1-1             (won't fix)  CVE-2021-36084       Low
libsepol1                       3.1-1             (won't fix)  CVE-2021-36085       Low
libsepol1                       3.1-1             (won't fix)  CVE-2021-36086       Low
libsepol1                       3.1-1             (won't fix)  CVE-2021-36087       Low
libsqlite3-0                    3.34.1-3                       CVE-2021-36690       Negligible
libssl1.1                       1.1.1k-1+deb11u1               CVE-2007-6755        Negligible
libssl1.1                       1.1.1k-1+deb11u1               CVE-2010-0928        Negligible
libsystemd0                     247.3-6                        CVE-2013-4392        Negligible
libsystemd0                     247.3-6                        CVE-2020-13529       Negligible
libsystemd0                     247.3-6           (won't fix)  CVE-2021-3997        Unknown
libtinfo6                       6.2+20201114-2                 CVE-2021-39537       Negligible
libudev1                        247.3-6                        CVE-2013-4392        Negligible
libudev1                        247.3-6                        CVE-2020-13529       Negligible
libudev1                        247.3-6           (won't fix)  CVE-2021-3997        Unknown
libxslt1.1                      1.1.34-4                       CVE-2015-9019        Negligible
locales                         2.31-13+deb11u2                CVE-2021-43396       Negligible
locales                         2.31-13+deb11u2                CVE-2021-3998        Unknown
locales                         2.31-13+deb11u2                CVE-2021-3999        Unknown
locales                         2.31-13+deb11u2   (won't fix)  CVE-2022-23218       Unknown
locales                         2.31-13+deb11u2   (won't fix)  CVE-2022-23219       Unknown
locales                         2.31-13+deb11u2                CVE-2010-4756        Negligible
locales                         2.31-13+deb11u2                CVE-2018-20796       Negligible
locales                         2.31-13+deb11u2                CVE-2019-1010022     Negligible
locales                         2.31-13+deb11u2                CVE-2019-1010023     Negligible
locales                         2.31-13+deb11u2                CVE-2019-1010024     Negligible
locales                         2.31-13+deb11u2                CVE-2019-1010025     Negligible
locales                         2.31-13+deb11u2                CVE-2019-9192        Negligible
locales                         2.31-13+deb11u2   (won't fix)  CVE-2021-33574       Critical
login                           1:4.8.1-1                      CVE-2007-5686        Negligible
login                           1:4.8.1-1                      CVE-2013-4235        Negligible
login                           1:4.8.1-1                      CVE-2019-19882       Negligible
ncurses-base                    6.2+20201114-2                 CVE-2021-39537       Negligible
ncurses-bin                     6.2+20201114-2                 CVE-2021-39537       Negligible
openssl                         1.1.1k-1+deb11u1               CVE-2007-6755        Negligible
openssl                         1.1.1k-1+deb11u1               CVE-2010-0928        Negligible
passwd                          1:4.8.1-1                      CVE-2007-5686        Negligible
passwd                          1:4.8.1-1                      CVE-2013-4235        Negligible
passwd                          1:4.8.1-1                      CVE-2019-19882       Negligible
perl                            5.32.1-4+deb11u2               CVE-2011-4116        Negligible
perl                            5.32.1-4+deb11u2  (won't fix)  CVE-2020-16156       High
perl-base                       5.32.1-4+deb11u2               CVE-2011-4116        Negligible
perl-base                       5.32.1-4+deb11u2  (won't fix)  CVE-2020-16156       High
perl-modules-5.32               5.32.1-4+deb11u2               CVE-2011-4116        Negligible
perl-modules-5.32               5.32.1-4+deb11u2  (won't fix)  CVE-2020-16156       High
tar                             1.34+dfsg-1                    CVE-2005-2541        Negligible
```


## Conclusion

Hardening a Docker image involves scanning it for vulnerabilities, building a new image with additional mitigating protections, then using that version as the base for your application. You need to scan and rebuild your images regularly to make sure they include latest packages and patches. It’s a best practice to incorporate hardening into your image build pipeline.

Remember that container security best practices don’t just include the delivered applications and container images themselves. You also need to include the full component stack used for building, distributing, and specifically executing the container.

One of the key points of cloud-native security is addressing container security risks as soon as possible. Doing it later in the development life cycle slows down the pace of cloud adoption, while raising security and compliance risks.