Skip to main content

Apply Docker security best practices

org.openrewrite.docker.DockerSecurityBestPractices

Apply security-focused Docker best practices to Dockerfiles. This includes running as a non-root user (CIS 4.1) and using COPY instead of ADD where appropriate (CIS 4.9).

Tags​

Recipe source​

GitHub: docker.yml, Issue Tracker, Maven Central

info

This recipe is composed of more than one recipe. If you want to customize the set of recipes this is composed of, you can find and copy the GitHub source for the recipe from the link above.

This recipe is available under the Apache License Version 2.0.

Definition​

Used by​

This recipe is used as part of the following composite recipes:

Usage​

This recipe has no required configuration parameters and comes from a rewrite core library. It can be activated directly without adding any dependencies.

  1. Add the following to your build.gradle file:
    build.gradle
    plugins {
        id("org.openrewrite.rewrite") version("latest.release")
    }

    rewrite {
        activeRecipe("org.openrewrite.docker.DockerSecurityBestPractices")
        setExportDatatables(true)
    }

    repositories {
        mavenCentral()
    }
  2. Run gradle rewriteRun to run the recipe.

See how this recipe works across multiple open-source repositories​

Run this recipe on OSS repos at scale with the Moderne SaaS.

The community edition of the Moderne platform enables you to easily run recipes across thousands of open-source repositories.

Please contact Moderne for more information about safely running the recipes on your own codebase in a private SaaS.

Data Tables​

End-of-life Docker images​

org.openrewrite.docker.table.EolDockerImages

Records Docker base images that have reached end-of-life.

Column NameDescription
Source fileThe Dockerfile containing the EOL base image.
Stage nameThe build stage name (from AS clause), if specified.
Image nameThe name of the base image.
TagThe image tag.
EOL dateThe date when the image reached end-of-life.
Suggested replacementRecommended newer version to migrate to.