T08 · Insecure Dependencies
Warning
- Location
SKILL.md:99- Finding
Mutable and Unverified Container Image Used for Production Deployment
- Content
View full analysis
/etc/timezone RUN mkdir -p /root/.cli-proxy-api && chmod 755 /root/.cli-proxy-api WORKDIR /CLIProxyAPI EXPOSE 8317 CMD ["./CLIProxyAPI"] ``` Finally, the mutable tag is used directly for production: ```bash docker run -d \ --name \ -p 8317:8317 \ -v /opt/cliproxyapi/config.yaml:/CLIProxyAPI/config.yaml \ -v /opt/cliproxyapi/auth:/root/.cli-proxy-api \ --restart unless-stopped \ eceasy/cli-proxy-api:latest ``` ### Technical Analysis The `latest` tag is mutable and does not uniquely identify the artifact that was reviewed or tested. The workflow does not pin an immutable image digest, verify an image signature or provenance attestation, or explicitly ensure that the production deployment uses the exact digest exercised during testing. A mutable tag can resolve to different image content after a publisher update, registry-side tag change, or compromise of the publisher or registry account. Thus, an operator may execute an image different from the intended release without any change to the documented command. The container receives writab ...[truncated 2198 chars]- Remediation
View remediation
' docker pull "$IMAGE" ``` 2. **Use the same immutable digest for testing and production** Resolve and record the digest once, test that exact artifact, and deploy the identical reference: ```bash IMAGE='eceasy/cli-proxy-api:2.2.1@sha256:' docker run -d --name cliproxyapi-test \ -p 127.0.0.1:8318:8317 \ -v /opt/cliproxyapi/config.yaml:/CLIProxyAPI/config.yaml \ -v /opt/cliproxyapi/auth:/root/.cli-proxy-api \ "$IMAGE" docker run -d \ --name \ -p 8317:8317 \ -v /opt/cliproxyapi/config.yaml:/CLIProxyAPI/config.yaml \ -v /opt/cliproxyapi/auth:/root/.cli-proxy-api \ --restart unless-stopped \ "$IMAGE" ``` 3. **Verify image authenticity and provenance** Where supported by the publisher, verify a cryptographic signature and build provenance before execution. Establish a policy that rejects unsigned images, unexpected identities, and unapproved digests. 4. **Record the deployed digest** Add the tested and deployed digest to the baseline record: ```bash docker image inspect "$IMAGE" \ --format '{{json .RepoDigests}}' ``` Compare the production digest with the tested digest before replacing the existing container. 5. **Pin custom-image base images** Change the custom Dockerfile to use an immutable base: ```dockerfile FROM eceasy/cli-proxy-api:2.2.1@sha256: ``` 6. **Reduce compromise impact** Run the container as a non-root user where compatible, drop unnecessary Linux capabilities, enable `no-new-privileges`, use a read-only root filesystem, limit outbound network access, and mount only the files required by the service. If configuration does not need runtime modification, mo ...[truncated 178 chars]