Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Chore: reduce attack surface for Docker image #61

Merged
merged 1 commit into from Jun 7, 2023
Merged

Chore: reduce attack surface for Docker image #61

merged 1 commit into from Jun 7, 2023

Conversation

bqcuong
Copy link
Contributor

@bqcuong bqcuong commented Apr 18, 2023

Hi,

This pull request includes a small improvement for the Dockerfile, which should help improve the security of container and reduce the risk of potential attacks.

In detail:

  • I added --no-install-recommends to remove unnecessary apt packages, that were not needed for the container's functionality. Not only can this change trim your image size but it also can also reduce the attack surface.

As quoted from CIS Docker Benchmark v1.5.0:

4.3 Ensure that unnecessary packages are not installed in the container
Description:
Containers should have as small a footprint as possible, and should not contain unnecessary software packages which could increase their attack surface.
Rationale:
Unnecessary software should not be installed into containers, as doing so increases their attack surface. Only packages strictly necessary for the correct operation of the application being deployed should be installed.

The differences between two builds are summarized in the below table:

Before improvement After improvement
Newly intalled packages 16 15
Image size 450MB 450MB
Build time 104s 88s
  • Removed unnecessary packages after the improvement: libpng-tools.

I hope that you find them useful. Please let me know if you have any concerns.

Thank you.

@Wylbur Wylbur merged commit f13aa16 into backdrop-ops:master Jun 7, 2023
@Wylbur
Copy link
Contributor

Wylbur commented Jun 7, 2023

@bqcuong
Merged, thanks for your help!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants