Installing unnecessary dependencies can lead to additional vulnerabilities in the Docker image.
Unnecessary dependencies are installed via a known Debian package manager. These unused dependencies might contain vulnerabilities, thus weakening
the overall security posture of the created containers.
Depending on the introduced vulnerabilities, a malicious actor accessing such a container
could use these for privilege escalation.
Removing the unused dependencies can also significantly reduce your Docker image size.
To be secure, remove the unused dependencies where possible and ensure images are subject to routine vulnerability scans.
Ask Yourself Whether
- Container vulnerability scans are not performed.
There is a risk if you answered yes to the question.
Recommended Secure Coding Practices
- Avoid installing package dependencies that are not strictly required.
Sensitive Code Example
# Sensitive
RUN apt install -y build-essential
# Sensitive
RUN apt-get install -y build-essential
# Sensitive
RUN aptitude install -y build-essential
Compliant Solution
RUN apt install -y --no-install-recommends build-essential
RUN apt-get install -y --no-install-recommends build-essential
RUN aptitude install -y --without-recommends build-essential
See
