Container Checks

Eleven checks inspect Docker containers via the Docker API and static analysis of Dockerfiles and docker-compose.yml files.

Requires Docker access. Container checks require --docker-host or a locally running Docker daemon. Without it, all container checks return WARN and are excluded from scoring.

Key Checks Explained

CONT-USER-001 — Non-Root Container User

A container running as root means that if the application is compromised, the attacker has root privileges inside the container. Combined with HOST-SSH-001 (SSH root login permitted), this forms an active attack path to host takeover.

Auto-fix adds to Dockerfile:

RUN addgroup --system appgroup && adduser --system --ingroup appgroup appuser
USER appuser

CONT-SEC-001 — No Secrets in Environment

Searches environment variables in container inspection data for values matching common secret patterns: passwords, API keys, tokens, database connection strings. Returns CRITICAL if found.

Fix: Use Docker secrets or a secrets manager instead of environment variables for sensitive values.

# docker-compose.yml — use secrets instead of env vars
secrets:
  db_password:
    file: ./secrets/db_password.txt
 
services:
  app:
    secrets:
      - db_password

CONT-REG-001 — Pinned Base Image

Using FROM python:latest means your image changes whenever upstream publishes a new version — potentially breaking your application or introducing vulnerabilities without warning.

Fix:

# Pin to a specific digest
FROM python:3.11.9-slim@sha256:abc123...
 
# Or at minimum a specific version tag
FROM python:3.11.9-slim

CT-CONF-COMPOSE-PORTS — Compose Port Exposure

Checks whether docker-compose.yml binds ports to all interfaces (0.0.0.0) rather than localhost only. A database port bound to 0.0.0.0:5432:5432 is accessible from the public internet.

Fix:

ports:
  - "127.0.0.1:5432:5432"  # localhost only
  # not:
  - "5432:5432"  # all interfaces