SQ41102
Detected container images that use ADD instructions.
| priority | CI/CD status | severity | effort | RL level | RL assessment |
|---|---|---|---|---|---|
 | pass | low | medium | None | None |
About the issue
Containers typically run in one of two modes, as executables or as services. Regardless of how they are used, they typically require one or more executable, data and configuration files, and other dependencies and environment-related files required to run the containerized application or service. The Dockerfile is a sequence of instructions that defines how an image should be built, and ADD or COPY instructions are used to include external content in an image layer. However, the ADD instruction, apart from simple copy functionality, can also fetch data from remote destinations and unpack compressed files (such as filesystem images). It's possible for remote destinations to change ownership, and become excellent targets for supply chain compromise. By separating the download phase from the inclusion phase, it introduces a way to review what has been downloaded before the image is built. The only exception here should be the inclusion of the base filesystem layer (usually the root filesystem). Otherwise, it's a better practice to use the COPY instruction, as it's more transparent, and doesn't include implicit but possibly unwanted side effects.
How to resolve the issue
- Inspect your Dockerfile for any ADD instructions unrelated to the base filesystem, and change them. Pay special attention to any ADD instructions that refer to remote destinations.
Incidence statistics
ReversingLabs periodically collects and analyzes the contents of popular software package repositories for threat research purposes.
For every repository, the chart shows the percentage of projects that triggered the software assurance policy. In other words, it shows how many projects were found to have the specific issue described on this page.
The percentages are calculated from the total amount of packages analyzed:
- RubyGems: 174K
- Nuget: 189K
- PyPi: 403K
- NPM: 2.1M
Recommended reading
- Dockerfile reference - ADD (External resource - Docker)
- Dockerfile on Windows (External resource - Microsoft)
- General best practices for writing Dockerfiles (External resource - Docker)