Docker

# VULNERABLE: Running as root (default)
FROM node:18
COPY . /app
CMD ["node", "app.js"]  # Runs as root

# SAFE: Non-root user
FROM node:18
RUN groupadd -r appgroup && useradd -r -g appgroup appuser
WORKDIR /app
COPY --chown=appuser:appgroup . .
USER appuser
CMD ["node", "app.js"]

# SAFE: Using numeric UID (more portable)
USER 1000:1000

# VULNERABLE: Using latest tag (unpredictable)
FROM node:latest
FROM ubuntu:latest

# VULNERABLE: Using untrusted/unverified base image
FROM randomuser/myimage

# SAFE: Pinned versions with digest
FROM node:18.19.0-alpine@sha256:abc123...
FROM python:3.11.7-slim-bookworm

# SAFE: Official images from verified publishers
FROM docker.io/library/node:18.19.0-alpine

# VULNERABLE: Secrets in build args visible in history
ARG DB_PASSWORD
RUN echo $DB_PASSWORD > /config

# VULNERABLE: Copying secrets into image
COPY .env /app/.env
COPY secrets.json /app/
COPY id_rsa /root/.ssh/

# VULNERABLE: Secrets in environment variables
ENV API_KEY=sk-12345
ENV DB_PASSWORD=mysecret

# SAFE: Mount secrets at runtime
# docker run -v /secrets:/secrets:ro myimage
# Or use Docker secrets in Swarm/K8s

# SAFE: Multi-stage build to exclude secrets
FROM node:18 AS builder
# Use build-time secret (Docker BuildKit)
RUN --mount=type=secret,id=npm_token \
    NPM_TOKEN=$(cat /run/secrets/npm_token) npm install

FROM node:18-alpine
COPY --from=builder /app/node_modules /app/node_modules
# Secret not in final image

# Build with: docker build --secret id=npm_token,src=.npmrc .

# VULNERABLE: Not cleaning up package manager cache
RUN apt-get update && apt-get install -y curl wget
# Leaves cache, increases image size and attack surface

# VULNERABLE: Installing unnecessary packages
RUN apt-get install -y vim nano curl wget git ssh

# SAFE: Minimal installation with cleanup
RUN apt-get update && \
    apt-get install -y --no-install-recommends curl && \
    rm -rf /var/lib/apt/lists/*

# SAFE: Using minimal base images
FROM alpine:3.19
FROM gcr.io/distroless/nodejs18
FROM scratch  # Empty base image

# VULNERABLE: ADD can auto-extract and fetch URLs
ADD https://example.com/file.tar.gz /app/  # Downloads from URL
ADD archive.tar.gz /app/  # Auto-extracts

# SAFE: COPY is more explicit
COPY archive.tar.gz /app/
RUN tar -xzf /app/archive.tar.gz && rm /app/archive.tar.gz

# CHECK: Are all exposed ports necessary?
EXPOSE 22  # FLAG: SSH in container usually unnecessary
EXPOSE 3306  # FLAG: Database port exposed
EXPOSE 80 443 8080 9090 5000  # CHECK: Multiple ports

# SAFE: Only expose what's needed
EXPOSE 8080

# Scan for vulnerabilities
docker scan myimage
trivy image myimage
grype myimage

# Check for secrets in image
trufflehog docker --image myimage
# Or manually inspect layers
docker history --no-trunc myimage

# FLAG: Packages that increase attack surface
RUN apt-get install -y \
    openssh-server \  # SSH access
    sudo \            # Privilege escalation
    netcat \          # Network tools
    nmap \            # Network scanning
    gcc make \        # Compilers (should be in build stage only)
    python3-pip       # Package managers (install deps, then remove)

# VULNERABLE: Running privileged (full host access)
docker run --privileged myimage

# VULNERABLE: Dangerous capabilities
docker run --cap-add=ALL myimage
docker run --cap-add=SYS_ADMIN myimage
docker run --cap-add=NET_ADMIN myimage

# SAFE: Drop all capabilities, add only needed
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE myimage

# SAFE: Read-only root filesystem
docker run --read-only myimage

# SAFE: No new privileges
docker run --security-opt=no-new-privileges myimage

# VULNERABLE: Mounting sensitive host paths
docker run -v /:/host myimage           # Entire host filesystem
docker run -v /etc:/etc myimage         # Host config files
docker run -v /var/run/docker.sock:/var/run/docker.sock  # Docker socket

# VULNERABLE: Writable mounts of sensitive paths
docker run -v /etc/passwd:/etc/passwd myimage

# SAFE: Specific paths, read-only where possible
docker run -v /app/data:/data:ro myimage
docker run -v myvolume:/app/data myimage  # Named volume

# CRITICAL: Docker socket mount = root on host
docker run -v /var/run/docker.sock:/var/run/docker.sock myimage
# Container can create privileged containers, access host

# If required, use read-only and restrict with authz plugin
# Or use Docker API proxy with limited permissions

# VULNERABLE: Host network mode
docker run --network=host myimage  # No network isolation

# SAFE: User-defined networks with isolation
docker network create --internal internal-net  # No external access
docker run --network=internal-net myimage

# SAFE: Restrict inter-container communication
docker network create --driver=bridge --opt com.docker.network.bridge.enable_icc=false isolated

# VULNERABLE: No resource limits (DoS risk)
docker run myimage

# SAFE: Set memory and CPU limits
docker run --memory=512m --cpus=1 myimage

# SAFE: Limit processes
docker run --pids-limit=100 myimage

# VULNERABLE: Secrets in environment
services:
  app:
    environment:
      - DB_PASSWORD=mysecret
      - API_KEY=sk-12345

# SAFE: Use secrets
services:
  app:
    secrets:
      - db_password
    environment:
      - DB_PASSWORD_FILE=/run/secrets/db_password

secrets:
  db_password:
    external: true  # Or file: ./secrets/db_password

# SAFE: Security options in compose
services:
  app:
    image: myimage
    user: "1000:1000"
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    tmpfs:
      - /tmp
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '1'

# SAFE: Internal networks for backend services
services:
  frontend:
    networks:
      - public
      - internal

  backend:
    networks:
      - internal  # Not accessible from outside

  database:
    networks:
      - internal

networks:
  public:
  internal:
    internal: true  # No external access

# SAFE: Exclude sensitive files
.env
.env.*
*.pem
*.key
id_rsa*
secrets/
credentials/
.git/
.gitignore
.dockerignore
Dockerfile
docker-compose*.yml
*.log
node_modules/
__pycache__/
.pytest_cache/
coverage/
.nyc_output/

# FLAG: No .dockerignore may copy secrets into image
# Check if .env, keys, or credentials are copied

# VULNERABLE: Always pulling latest
image: myregistry/myimage:latest

# VULNERABLE: No digest verification
image: myregistry/myimage:1.0

# SAFE: Pinned with digest
image: myregistry/myimage@sha256:abc123...

# VULNERABLE: Credentials in plain text
docker login -u user -p password registry.example.com

# SAFE: Use credential helpers
# ~/.docker/config.json
{
  "credHelpers": {
    "gcr.io": "gcloud",
    "*.dkr.ecr.*.amazonaws.com": "ecr-login"
  }
}

# Running as root
grep -rn "^USER" Dockerfile || echo "No USER directive - runs as root"

# Secrets in environment
grep -rn "^ENV.*PASSWORD\|^ENV.*SECRET\|^ENV.*KEY\|^ENV.*TOKEN" Dockerfile

# Secrets in build args
grep -rn "^ARG.*PASSWORD\|^ARG.*SECRET\|^ARG.*KEY" Dockerfile

# Latest tags
grep -rn "FROM.*:latest\|FROM.*@" Dockerfile | grep -v "@sha256"

# Privileged instructions
grep -rn "^ADD\|EXPOSE 22\|apt-get install.*ssh" Dockerfile

# Missing cleanup
grep -rn "apt-get install" Dockerfile | grep -v "rm -rf"