105 lines
3.1 KiB
Plaintext
105 lines
3.1 KiB
Plaintext
When building a Docker image from a Dockerfile, a context directory is used and
|
|
sent to the Docker daemon before the actual build starts. This context
|
|
directory usually contains the Dockerfile itself, along with all the files that
|
|
will be necessary for the build to succeed. This generally includes:
|
|
|
|
* the source code of applications to set up in the container.
|
|
* configuration files for other software components.
|
|
* other necessary packages or components.
|
|
|
|
The `COPY` and `ADD` directives in the Dockerfiles are then used to actually
|
|
copy content from the context directory to the image file system.
|
|
|
|
When `COPY` or `ADD` are used to recursively copy entire top-level directories
|
|
or multiple items whose names are determined at build-time, unexpected files
|
|
might get copied to the image filesystem. It could affect their
|
|
confidentiality.
|
|
|
|
|
|
== Ask Yourself Whether
|
|
|
|
* The copied files and directories might contain sensitive data that should be
|
|
kept confidential.
|
|
* The context directory contains files and directories that have no functional
|
|
purpose for the final container image.
|
|
|
|
There is a risk if you answered yes to any of those questions.
|
|
|
|
Keep in mind that the content of the context directory might change depending
|
|
on the build environment and over time.
|
|
|
|
|
|
== Recommended Secure Coding Practices
|
|
|
|
* Limit the usage of globbing in the `COPY` and `ADD` sources definition.
|
|
* Avoid copying the entire context directory to the image filesystem.
|
|
* Prefer providing an explicit list of files and directories that are required for the image to properly run.
|
|
|
|
|
|
== Sensitive Code Example
|
|
|
|
Copying the complete context directory:
|
|
[source,docker]
|
|
----
|
|
FROM ubuntu:22.04
|
|
# Sensitive
|
|
COPY . .
|
|
CMD /run.sh
|
|
----
|
|
|
|
Copying multiple files and directories whose names are expanded at build time:
|
|
[source,docker]
|
|
----
|
|
FROM ubuntu:22.04
|
|
# Sensitive
|
|
COPY ./example* /
|
|
COPY ./run.sh /
|
|
CMD /run.sh
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
[source,docker]
|
|
----
|
|
FROM ubuntu:22.04
|
|
COPY ./example1 /example1
|
|
COPY ./example2 /example2
|
|
COPY ./run.sh /
|
|
CMD /run.sh
|
|
----
|
|
|
|
== See
|
|
|
|
* https://docs.docker.com/engine/reference/builder/#copy[Dockerfile reference] - COPY directive
|
|
* https://docs.docker.com/engine/reference/builder/#add[Dockerfile reference] - ADD directive
|
|
* CWE - https://cwe.mitre.org/data/definitions/668[CWE-668 - Exposure of Resource to Wrong Sphere]
|
|
* CWE - https://cwe.mitre.org/data/definitions/497[CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere]
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
== Message
|
|
|
|
When a dangerous wildcard is found:
|
|
|
|
* COPY: Copying using a glob pattern might inadvertently add sensitive data to the container. Make sure it is safe here.
|
|
* ADD: Adding files using a glob pattern might inadvertently add sensitive data to the container. Make sure it is safe here.
|
|
|
|
In any other case:
|
|
|
|
* COPY: Copying recursively might inadvertently add sensitive data to the container. Make sure it is safe here.
|
|
* ADD: Adding files recursively might inadvertently add sensitive data to the container. Make sure it is safe here.
|
|
|
|
== Highlighting
|
|
|
|
The `COPY` or `ADD` dangerous source.
|
|
|
|
'''
|
|
|
|
endif::env-github,rspecator-view[]
|
|
|