Checks

Avoid assigning public IP addresses to network interfaces unless necessary.

When creating instances, user data can be used during the initial configuration. User data must not contain sensitive information

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

Plain HTTP is unencrypted and human-readable. This means that if a malicious actor was to eavesdrop on your connection, they would be able to see all of your data flowing back and forth. You should use HTTPS, which is HTTP over an encrypted (TLS) connection, meaning eavesdroppers cannot read your traffic.

Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

When working with a server, you’ll likely spend most of your time in a terminal session connected to your server through SSH. A more secure alternative to password-based logins, SSH keys use encryption to provide a secure way of logging into your server and are recommended for all users.

While upgrading your cluster, workloads will temporarily be moved to new nodes. A small cost will follow, but as a bonus, you won't experience downtime.

Space bucket and bucket object permissions should be set to deny public access unless explicitly required.

Versioning is a means of keeping multiple variants of an object in the same bucket. You can use the Spaces (S3) Versioning feature to preserve, retrieve, and restore every version of every object stored in your buckets. With versioning you can recover more easily from both unintended user actions and application failures.

Enabling force destroy on a Spaces bucket means that the bucket can be deleted without the additional check that it is empty. This risks important data being accidentally deleted by a bucket removal process.

When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Exposing port 22 might allow users to SSH into the container.

You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.

COPY '--from' should not mention the current FROM alias, since it is impossible to copy from itself.

There can only be one ENTRYPOINT instruction in a Dockerfile. Only the last ENTRYPOINT instruction in the Dockerfile will have an effect.

UNIX ports outside the range 0-65535 are exposed.

For clarity and reliability, you should always use absolute paths for your WORKDIR.

Avoid using 'RUN' with 'sudo' commands, as it can lead to unpredictable behavior.

When a COPY command has more than two arguments, the last one should end with a slash.

Different FROMs can't have the same alias defined.

Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.

Avoid using both 'wget' and 'curl' since these tools have the same effect.