OWASP DockSec

FROM python:3.12-slim

The base image has one or more critical CVEs according to Docker Scout. Critical vulnerabilities have a high likelihood of being exploitable and can lead to full system compromise. Update to a patched image version or switch to a more secure base image. Note: CVE data is sourced from Docker Scout at the time of the last data rebuild — coverage is not guaranteed to be complete, and a clean result does not confirm the image is free of CVEs.

RUN curl -sL -o /usr/local/bin/hadolint https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64 \
  && chmod +x /usr/local/bin/hadolint

A file is downloaded at build time (curl/wget) and made executable — written into a bin directory or chmod +x'd — without verifying its integrity. The contents are unverified, so a compromised or malicious source — or a silently changed artifact — substitutes an arbitrary executable that then runs with build-time (and often runtime) privileges. The risk is greatest when the URL is unpinned (e.g. a /latest/ release URL), since the artifact can change at any time. Pin a specific version and verify a published SHA-256 checksum or a GPG/cosign signature before use, or COPY a pre-verified binary into the image.

RUN curl -sfL https://raw.githubusercontent.com/aquasec/trivy/main/contrib/install.sh \
  | sh -s -- -b /usr/local/bin

A curl download is piped directly into a shell interpreter (sh, bash, etc.) without any integrity check. The transport is normally HTTPS, so the risk is not interception but the source itself: a compromised or malicious server — or a change to the script between builds — runs arbitrary shell commands with full build-time privileges, with no chance to inspect them first. Download to a file, verify a checksum or GPG signature, then execute.

Container user

The final container is running under the context of the root user.

RUN apt-get update \
  && apt-get install -y curl git \
  && rm -rf /var/lib/apt/lists/*

An apt-family tool (apt, apt-get, aptitude, dpkg) is used to install packages but upgrade was not called first to patch existing packages.

COPY . .

Using COPY with a wildcard can introduce unnecessary files into the image.

FROM python:3.12-slim

The base image is referenced by tag rather than by digest. Tags are mutable — the same tag can be silently updated to point to a different image. Pinning to a digest (e.g. image:tag@sha256:...) guarantees you always build from exactly the image you reviewed. If you rebuild frequently with docker build --pull, the freshness risk is lower — though supply-chain reproducibility still benefits from digest pinning. Note: digest-pinning fixes the image layer but does not protect against newly-discovered CVEs in that layer — vulnerability scanning should still be performed regularly even when digests are in use.

RUN curl -sfL https://raw.githubusercontent.com/aquasec/trivy/main/contrib/install.sh \
  | sh -s -- -b /usr/local/bin

A RUN instruction contains a shell pipe (cmd1 | cmd2) but pipefail is not enabled. By default the pipeline exit status is that of the last command only, so a failure in an earlier stage (for example a failed download in curl ... | tar, or a failed fetch in wget ... | sh) is silently ignored and the build proceeds on partial or corrupt input. Enable pipefail so any stage failure aborts the build: set the shell once with SHELL ["/bin/bash", "-o", "pipefail", "-c"], or prefix the command with set -o pipefail &&.

ENTRYPOINT ["/entrypoint.sh"]

A shell script is copied into the image (COPY/ADD) and then executed by a RUN, ENTRYPOINT, or CMD instruction. DockerSec analyses the Dockerfile only; the script contents are not inspected, so security-relevant operations inside it (package installs, credential handling, network configuration, privilege changes) are not covered by this scan. There is latent risk here: review the script manually. Where practical, inline the script logic into the Dockerfile so it can be analysed, or keep the script minimal and audited.

RUN pip install --no-cache-dir .

pip is used in this stage but pip itself is never upgraded. An outdated pip may resolve packages against a stale index and may itself contain known vulnerabilities. Add pip install --upgrade pip (or pip install -U pip) before installing other packages.