Docker Security Scanning Guide

Docker has an enormous worldwide user base, recently surpassing 10 million users and 242 billion image pulls and has changed the way applications are built.

With the accelerated development velocity that containerization enables, additional security responsibilities are shifting to developers, who now need to maintain container images in addition to their code.

What Is Docker?

Docker is a set of platform-as-a-service (PaaS) products used to run applications and services within their own dedicated sandboxes, called containers, which are run using OS-level virtualization.

Docker allows you to install all of the dependencies a service needs inside a container so you don’t have to worry about installing unwanted or different versions of the same package natively on your computer. This makes it easy to distribute the complete working environment of an application to others within or outside your team.

You can easily upload or push your Docker images to Docker’s own DockerHub, which offers both free and paid accounts; or to third-party repositories such as Amazon Elastic Container Registry (ECR) or Google’s Container Registry (GCR).

But how do you tell a container what dependencies or tools to install inside a container? Dockerfile was designed for this specific purpose.

What Is a Dockerfile?

A Dockerfile is used to tell Docker how to prepare a container. Once you’ve written all the instructions in Dockerfile, you can then “build” an image from that Dockerfile. In order to share your images, you can either simply share the Dockerfile blueprint, which will allow anybody to build the image; or, you can share the images directly. The advantage here is that once you’ve shared your image, there’s no need to rebuild them.

Docker Security Scanning Explained

Snyk Container puts developer-focused container security scanning directly in your Developers hands. With it, you can now scan your container image via the Snyk CLI, as well as the Snyk Container extension within Docker Desktop (available in the Docker Desktop Extensions Marketplace),   Scanning from the command line is easy, you can get started here:

Test your image via the Snyk CLI with this command:

snyk container test <image-name>

This gives you the opportunity to find vulnerabilities in container images and fix them before pushing the image to Docker Hub, ECR, GCR, Harbor, or any other registries you may use.

The Snyk-powered vulnerability scans are a little different than what you might be used to seeing from other vulnerability scans. Aside from simply listing all the issues, Snyk’s goal is to guide developers toward action:

• By including the Dockerfile along with the image through the --file <path/to/Dockerfile> option, the results from docker scan include details on how to select a more recent and/or smaller base image with fewer vulnerabilities.

• Vulnerabilities are mapped to the Dockerfile instruction that introduced them, along with the relevant dependencies needed to track down an issue and take care of it.

• The command snyk container monitor will continuously check your existing containers for newly discovered vulnerabilities, as well as alert you when something is discovered.

Why is Docker Security Scanning Important?

Container image security scanning is important because it is the primary way to find and fix vulnerabilities in container images before pushing the image to Docker Hub, ECR, GCR, Harbor or any other registries you may use.

If you’re using a container orchestration service like Kubernetes, while you might think that these security issues are already taken care of, this isn’t necessarily the case. Though Kubernetes has security policies on how to run pods (Pods are essentially containers.), it doesn’t offer much in terms of security for the code or services running inside these pods. Instead, this responsibility lies with the user. When configuring your Kubernetes cluster, which is also done using code, it is important to follow Kubernetes security best practices.

Types of Docker Security Scanning

Checking for known vulnerabilities against the packages listed in your Docker images through the aforementioned CVE database, is not always enough. Security vulnerabilities could be lurking in many different places. To this end, there are a range of security scanning tools and services available for Docker containers:

• Network configuration tools: These tools scan Docker image port and network configuration to identify and flag such issues. Examples include Cilium and Sysdig Falco.

• Identity & access management tools: Preventing your container from having complete access to all your resources is an important security measure. This involves assigning certain roles and responsibilities to Docker containers. There are tools to facilitate this and also enforce and monitor these roles. Notary is one such tool.

• User-defined policy tools: Some tools even allow you to define and enforce your own security policies in your containers. Grafeas is a popular tool in this category.

• Open-source tools: There are a number of available open-source vulnerability scanning tools. Open-source scanning and SBOM generation tools are popular among developers that use other open-source tools, such as frameworks, operating systems, or IDEs. Security experts also prefer open-source, because they are easy to audit and provide better visibility. If you’re new to Docker or containers, you’ll also want to know which instruction in the Dockerfile is causing security issues in your container; and there are tools for that. Snyk Open Source is a great example of an open-source security scanning tool (also known as a Software Composition Analysis tool), you can sign up to use it for free.

• Application security tools: Different tool types are available to help you secure the code that's running inside your docker containers, including SAST tools like Snyk Code, which works alongside developers to help them secure their applications.

While no security scanning tool can guarantee 100% security of any Docker image or container, this kind of Docker image security scanning tool can help you minimize the risk of vulnerability issues in your application and infrastructure. Moreover, some tools offer constant container monitoring and alerting, so you’re notified if and when such an issue is detected. And by following docker security best practices, you can minimize the risk of introducing security vulnerabilities. Create and ship container-based applications with confidence. Secure your containerized applications with Snyk’s Docker vulnerability scanner.

Key Takeaways for Docker security scanning

The Snyk Container CLI scanner is a simple, yet powerful tool for detecting and remediating vulnerabilities early in the development process. This solution can be run immediately after you build so that issues are resolved before the image is even pushed to your registry. If you have questions or you’ve come up with a clever use case, we’d love to hear from you on the Snyk Community site.