SQ40103
Detected container images that might expose the FTP port.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | high | medium | None | None |
About the issue
Containers are a simple, yet powerful approach to process and filesystem isolation. When configured correctly, a container runs a set of processes isolated from their host system. Containers typically run as executables or as services, but regardless of their use, they must be properly secured. Although it might seem practical for data sharing, FTP is an insecure protocol that transmits unencrypted credentials, and can inadvertently expose sensitive files if not configured properly. Additionally, containers should only mount volumes with data required by containerized services during their execution, and are typically not used for long-term storage.
How to resolve the issue
- You should not run FTP in containers.
- Check if there's a running FTP daemon or service in the container's process list bound to port 21, or if one is executed on startup, and remove it.
Recommended reading
- Docker Expose Port: What It Means and What It Doesn't Mean (External resource - CloudBees)
- FTP Server (External resource - Ubuntu)