OWASP Dependency Check

OWASP Dependency Check Dockerfile

← Examples

Source: Docker

6 issues foundHigh: 2Medium: 3Low: 1Recommendations: 4
DockerfileLines with findings are highlighted
SHA-256: …
1FROM openjdk:8-jre-slimHigh
2ENV user=dependencycheck
3ENV version_url=https://jeremylong.github.io/DependencyCheck/current.txt
4ENV download_url=https://dl.bintray.com/jeremy-long/owasp
5RUN apt-get update && apt-get install -y --no-install-recommends wget ruby mono-runtime && gem install bundle-audit && gem cleanupMedium
6RUN wget -O /tmp/current.txt ${version_url} && version=$(cat /tmp/current.txt) && file="dependency-check-${version}-release.zip" && wget "$download_url/$file" && unzip ${file} && rm ${file} && mv dependency-check /usr/share/ && useradd -ms /bin/bash ${user} && chown -R ${user}:${user} /usr/share/dependency-check && mkdir /report && chown -R ${user}:${user} /report && apt-get remove --purge -y wget && apt-get autoremove -y && rm -rf /var/lib/apt/lists/* /tmp/*High
7USER ${user}
8VOLUME ["/src" "/usr/share/dependency-check/data" "/report"]
9WORKDIR /src
10CMD ["--help"]
11ENTRYPOINT ["/usr/share/dependency-check/bin/dependency-check.sh"]
Findings
6 issues found
RUN wget -O /tmp/current.txt ${version_url} \
  && version=$(cat /tmp/current.txt) \
  && file="dependency-check-${version}-release.zip" \
  && wget "$download_url/$file" \
  && unzip ${file} \
  && rm ${file} \
  && mv dependency-check /usr/share/ \
  && useradd -ms /bin/bash ${user} \
  && chown -R ${user}:${user} /usr/share/dependency-check \
  && mkdir /report \
  && chown -R ${user}:${user} /report \
  && apt-get remove --purge -y wget \
  && apt-get autoremove -y \
  && rm -rf /var/lib/apt/lists/* /tmp/*
Unverified archive downloaded and extracted at build time
A remote archive (zip/tar) is downloaded at build time and unpacked into the image without verifying its integrity. The extracted contents usually become part of the runtime image or are executed later (for example as the ENTRYPOINT), so a compromised or substituted archive — or a download from a defunct or hijacked host — introduces arbitrary files into the image. The risk is greatest when the version or URL is resolved dynamically (e.g. from a remote current.txt or an ENV-built URL), since the artifact can change at any time. Pin a specific version and verify a published SHA-256 checksum or a GPG/cosign signature before extracting.
HighPermissions
FROM openjdk:8-jre-slim
Base image not found on Docker Hub
This image is no longer available on Docker Hub. It may have been removed due to end-of-life, policy changes, or the publisher discontinuing the image. Images that are no longer maintained and cannot be pulled will fail to build, and cannot receive security updates. Replace this base image with an actively maintained alternative.
HighBase Image
RUN apt-get update \
  && apt-get install -y --no-install-recommends wget ruby mono-runtime \
  && gem install bundle-audit \
  && gem cleanup
Apt-family install, but no upgrade
An apt-family tool (apt, apt-get, aptitude, dpkg) is used to install packages but upgrade was not called first to patch existing packages.
RUN apt-get update && apt-get upgrade -y \ && apt-get install -y --no-install-recommends <packages> \ && rm -rf /var/lib/apt/lists/*
MediumPackage Manager
RUN wget -O /tmp/current.txt ${version_url} \
  && version=$(cat /tmp/current.txt) \
  && file="dependency-check-${version}-release.zip" \
  && wget "$download_url/$file" \
  && unzip ${file} \
  && rm ${file} \
  && mv dependency-check /usr/share/ \
  && useradd -ms /bin/bash ${user} \
  && chown -R ${user}:${user} /usr/share/dependency-check \
  && mkdir /report \
  && chown -R ${user}:${user} /report \
  && apt-get remove --purge -y wget \
  && apt-get autoremove -y \
  && rm -rf /var/lib/apt/lists/* /tmp/*
Apt-family use, but no upgrade
An apt-family tool is used without a prior upgrade. Running upgrade before other operations ensures OS-level security patches are applied.
RUN apt-get update && apt-get upgrade -y \ && apt-get install -y --no-install-recommends <packages> \ && rm -rf /var/lib/apt/lists/*
MediumPackage Manager
RUN wget -O /tmp/current.txt ${version_url} \
  && version=$(cat /tmp/current.txt) \
  && file="dependency-check-${version}-release.zip" \
  && wget "$download_url/$file" \
  && unzip ${file} \
  && rm ${file} \
  && mv dependency-check /usr/share/ \
  && useradd -ms /bin/bash ${user} \
  && chown -R ${user}:${user} /usr/share/dependency-check \
  && mkdir /report \
  && chown -R ${user}:${user} /report \
  && apt-get remove --purge -y wget \
  && apt-get autoremove -y \
  && rm -rf /var/lib/apt/lists/* /tmp/*
Download from a decommissioned host
A file is downloaded at build time from a host that has been shut down or decommissioned — for example dl.bintray.com (JFrog Bintray, retired in May 2021). The build breaks when the host is unreachable, and, more seriously, if the abandoned domain is re-registered by a third party it can serve attacker-controlled artifacts to every build that still points at it. Repoint the download at the project current, maintained distribution source and verify the artifact checksum or signature.
MediumPermissions
FROM openjdk:8-jre-slim
FROM without image digest
The base image is referenced by tag rather than by digest. Tags are mutable — the same tag can be silently updated to point to a different image. Pinning to a digest (e.g. image:tag@sha256:...) guarantees you always build from exactly the image you reviewed. If you rebuild frequently with docker build --pull, the freshness risk is lower — though supply-chain reproducibility still benefits from digest pinning. Note: digest-pinning fixes the image layer but does not protect against newly-discovered CVEs in that layer — vulnerability scanning should still be performed regularly even when digests are in use.
LowBase Image
MAINTAINER Timo Pagel <dependencycheckmaintainer@timo-pagel.de>
Deprecated MAINTAINER instruction
The MAINTAINER instruction was deprecated in Docker 1.13 and is ignored by current versions of the build engine. Use a LABEL instruction instead to record author or ownership metadata — for example: LABEL maintainer="name@example.com" or the standard org.opencontainers.image.authors label.
RUN apt-get update \
  && apt-get install -y --no-install-recommends wget ruby mono-runtime \
  && gem install bundle-audit \
  && gem cleanup
apt-get install without version pinning
apt-get install is used without pinning package versions. Without a version constraint (e.g. nginx=1.18.0-0ubuntu1), apt will install whatever is current in the package index at build time, making the build non-reproducible and potentially installing an unexpected newer version on a future rebuild. Pin package versions to ensure consistent, reproducible builds: apt-get install -y nginx=1.18.0-0ubuntu1.
Package Manager
RUN apt-get update \
  && apt-get install -y --no-install-recommends wget ruby mono-runtime \
  && gem install bundle-audit \
  && gem cleanup
gem install without version pinning
gem install is used without pinning the gem version. Without a version constraint, RubyGems installs the latest available version, so builds are not reproducible and an unexpected or malicious release can be pulled at build time. Pin the version with gem install <gem> -v <version> (or <gem>:<version>).
Package Manager
No HEALTHCHECK defined
No HEALTHCHECK defined in final stage
The final image stage does not define a HEALTHCHECK instruction. Without one, container orchestrators and the Docker daemon cannot distinguish a running container from one that is alive but unhealthy (deadlocked, crashed dependencies, etc.), increasing the risk of traffic being routed to a broken container. Add a HEALTHCHECK CMD instruction that tests whether the application is functioning correctly. Note: if the base image already defines a HEALTHCHECK it will be inherited, but this cannot be verified from the Dockerfile alone.