T08 · Insecure Dependencies
- Location
docker/docker-compose.yml:5- Finding
Unpinned Mutable Container Image
- Content
View full analysis
Vulnerability Details
File Location:
docker/docker-compose.yml, line 5
Vulnerability Type: Supply-chain risk from a mutable container image tag
Risk Level: MediumVulnerable Code
yaml services: searxng: image: searxng/searxng:latestTechnical Analysis
The deployment uses the mutable
latesttag rather than a reviewed version and immutable image digest. Consequently, the image executed by a future deployment may differ from the image that was available during this audit. The effective code can change without any modification to this repository.An upstream compromise, registry-account compromise, or unexpected image update could therefore cause arbitrary altered container code to run when the image is pulled. This is a supply-chain weakness rather than evidence that the current upstream image is malicious.
The container is hardened by dropping all Linux capabilities and restoring only
CHOWN,SETGID, andSETUID. Its configuration mount is read-only, and port8888is published only on loopback. These controls reduce but do not eliminate the risk: the container retains outbound network access and executes code locally with the three restored capabilities inside its container boundary.Attack Path
- An attacker compromises the upstream image publication channel, or an unreviewed upstream release is assigned to
searxng/searxng:latest. - A user runs
docker compose -f docker/docker-compose.yml up -d, or otherwise pulls the mutable tag. - Docker resolves
latestto the changed image without repository-level integrity pinning. - The altered entry point and application code execute inside the container.
- Malicious code could use the container's outbound network access, inspect its runtime environment and mounted SearXNG configuration, or abuse vulnerabilities in the container runtime or host kernel. Host compromise would require an additional container-escape or runt ...[truncated 782 chars]
- An attacker compromises the upstream image publication channel, or an unreviewed upstream release is assigned to
- Remediation
View remediation
Remediation Suggestions
-
Replace
latestwith a reviewed release and immutable digest:yaml services: searxng: image: searxng/searxng:<reviewed-version>@sha256:<verified-digest> -
Obtain the digest from a trusted registry source and verify image provenance or signatures where supported.
-
Introduce an explicit update process that reviews release notes, scans the candidate image, tests it in an isolated environment, and then updates the pinned digest.
-
Enable automated monitoring for vulnerabilities affecting the pinned image, while keeping upgrades subject to review.
-
Continue using the existing loopback binding, read-only mount, and capability restrictions. Consider additionally enabling
security_opt: ["no-new-privileges:true"], a read-only root filesystem where compatible, resource limits, and outbound-network restrictions appropriate to the required search engines.
-