Python / uvicorn

Official Python getting-started example from the Docker documentation.

← Examples

Source: Docker

3 issues foundCritical: 1Low: 2Recommendations: 2
DockerfileLines with findings are highlighted
SHA-256: …
1FROM python:3.13Critical
2WORKDIR /usr/local/app
3COPY requirements.txt ./
4RUN pip install --no-cache-dir -r requirements.txtLow
5COPY src ./src
6EXPOSE 8080
7RUN useradd app
8USER app
9CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8080"]
Findings
3 issues found
FROM python:3.13
Critical CVEs in base image
The base image has one or more critical CVEs according to Docker Scout. Critical vulnerabilities have a high likelihood of being exploitable and can lead to full system compromise. Update to a patched image version or switch to a more secure base image. Note: CVE data is sourced from Docker Scout at the time of the last data rebuild — coverage is not guaranteed to be complete, and a clean result does not confirm the image is free of CVEs.
CriticalBase Image
FROM python:3.13
FROM without image digest
The base image is referenced by tag rather than by digest. Tags are mutable — the same tag can be silently updated to point to a different image. Pinning to a digest (e.g. image:tag@sha256:...) guarantees you always build from exactly the image you reviewed. If you rebuild frequently with docker build --pull, the freshness risk is lower — though supply-chain reproducibility still benefits from digest pinning. Note: digest-pinning fixes the image layer but does not protect against newly-discovered CVEs in that layer — vulnerability scanning should still be performed regularly even when digests are in use.
LowBase Image
RUN pip install --no-cache-dir -r requirements.txt
pip used without upgrading pip itself
pip is used in this stage but pip itself is never upgraded. An outdated pip may resolve packages against a stale index and may itself contain known vulnerabilities. Add pip install --upgrade pip (or pip install -U pip) before installing other packages.
LowPackage Manager
RUN pip install --no-cache-dir -r requirements.txt
pip install from requirements without hash verification
pip installs from a requirements file without --require-hashes, so even pinned versions are not cryptographically verified — a compromised or substituted package served by the index would be installed silently. Generate a hash-locked requirements file (pip-tools or uv) and install with pip install --require-hashes -r requirements.txt so the build fails if any artifact does not match its expected hash.
Package Manager
No HEALTHCHECK defined
No HEALTHCHECK defined in final stage
The final image stage does not define a HEALTHCHECK instruction. Without one, container orchestrators and the Docker daemon cannot distinguish a running container from one that is alive but unhealthy (deadlocked, crashed dependencies, etc.), increasing the risk of traffic being routed to a broken container. Add a HEALTHCHECK CMD instruction that tests whether the application is functioning correctly. Note: if the base image already defines a HEALTHCHECK it will be inherited, but this cannot be verified from the Dockerfile alone.