sc-docker

SC: Docker Security

Purpose

Performs Docker-specific security analysis covering Dockerfile best practices, secrets exposure in image layers, docker-compose security configuration, runtime security settings, and container image hardening. Extends beyond general IaC scanning with deep Docker expertise.

Activation

Called by sc-orchestrator during Phase 2 when Dockerfile or docker-compose files are detected.

Phase 1: Discovery

File Patterns

**/Dockerfile*, **/docker-compose*, **/.dockerignore,
**/docker/*, **/*.dockerfile

Dockerfile Security Checks

1. Running as Root: Check for missing USER directive after base image.

2. Secrets in Build:

# VULNERABLE: Secret in ENV or ARG
ENV DATABASE_PASSWORD=mysecret
ARG API_KEY=sk_live_abc123
COPY .env /app/.env

# SAFE: Use build secrets (BuildKit)
RUN --mount=type=secret,id=db_password cat /run/secrets/db_password

3. ADD vs COPY:

# RISKY: ADD can auto-extract and fetch URLs
ADD https://example.com/app.tar.gz /app/
ADD . /app/

# SAFE: COPY is explicit
COPY . /app/

4. Missing .dockerignore: Without .dockerignore, sensitive files get copied into the image: .env, .git/, node_modules/, *.pem, *.key

5. Unverified Base Image:

# RISKY: Unverified image
FROM someuser/myimage:latest

# SAFE: Official image with digest
FROM node:18-alpine@sha256:abc123...

Docker Compose Security

# VULNERABLE patterns
services:
  app:
    privileged: true          # Full host access
    network_mode: host        # Shares host network
    pid: host                 # Shares host PID namespace
    volumes:
      - /:/host               # Mounts host root
    cap_add:
      - ALL                   # All capabilities
    env_file:
      - .env                  # Secrets in env file (check .gitignore)

# SAFE patterns
services:
  app:
    read_only: true
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE      # Only what's needed
    tmpfs:
      - /tmp