Checks

There can only be one CMD instruction in a Dockerfile. If you list more than one CMD then only the last CMD will take effect.

The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.

Cached package data should be cleaned after installation to reduce image size.

The layer and image size should be reduced by deleting unneeded caches after running zypper.

'apt-get' calls should use the flag '-y' to avoid manual user input.

MAINTAINER has been deprecated since Docker 1.13.0.

Providing more than one HEALTHCHECK instruction per stage is confusing and error-prone.

You should use 'apk add' with '--no-cache' to clean package cached data and reduce image size.

You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.

Cached package data should be cleaned after installation to reduce image size.

'apt-get' install should use '--no-install-recommends' to minimize image size.

WORKDIR should not be mounted on system directories to avoid container breakouts

Passing secrets via build-args or envs or copying secret files can leak them out

OpenStack images are evaluated to verify that the hw_mem_encryption property is set to True. Hardware memory encryption (AMD SEV) protects guest memory from host-level attacks by encrypting it with a per-VM key managed by the CPU. Best practices recommend enabling memory encryption for workloads processing sensitive data in shared infrastructure.

OpenStack images are evaluated to verify that visibility is not set to 'public'. Public images are accessible to all tenants in the cloud, potentially exposing operating system configurations, embedded credentials, proprietary software, and security hardening details. Best practices recommend keeping images private or shared only with specific trusted projects.

OpenStack images are evaluated to verify that shared images do not exceed a configurable member threshold (default: 5 accepted members). Images shared with many projects amplify the blast radius of any vulnerability found in the image, as all consuming projects would be affected. Best practices recommend limiting image sharing to the minimum set of projects required.

OpenStack images are evaluated to verify that the protected flag is set to True. Protected images cannot be deleted, preventing accidental or malicious removal of base images that dependent workloads rely on. Best practices recommend enabling deletion protection on all production images.

OpenStack images are evaluated to verify that the os_secure_boot property is set to 'required'. Secure Boot ensures that only signed and trusted bootloaders and firmware execute during the boot process, protecting against bootkits, rootkits, and firmware-level attacks. Best practices recommend requiring Secure Boot for all production workloads.

OpenStack images are evaluated to verify that all four signature properties are configured: img_signature, img_signature_hash_method, img_signature_key_type, and img_signature_certificate_uuid. Signed images allow Nova to verify integrity before booting, detecting tampering or corruption.

Amazon Inspector2 active findings are assessed across eligible resources when the service is ENABLED.

Indicates whether any findings remain in the Active state versus none.

Amazon Inspector active findings for CISA Known Exploited Vulnerabilities are compared with the remediation due date (dateDue) that CISA assigns to each entry of the KEV catalog. Findings that are still active after that date are reported.

The result is reported per Region where Inspector is enabled.

Amazon Inspector active findings are cross-referenced with the CISA Known Exploited Vulnerabilities (KEV) catalog, using the CISA data that Inspector returns in the finding details (BatchGetFindingDetails) of each CVE.

The result is reported per Region where Inspector is enabled.

Amazon Inspector active findings are evaluated against the configurable inspector2_active_finding_max_age_days threshold (192 days by default), using the time since each finding was first observed (firstObservedAt). Suppressed and closed findings are not active and are not evaluated.

The result is reported per Region where Inspector is enabled.

Amazon Inspector coverage is evaluated for every actively monitored resource. The time since the resource was last scanned (lastScannedAt) is compared with the configurable inspector2_max_days_since_last_scan threshold (3 days by default).

Resources still pending their first scan are not evaluated.