aligned_layer
aligned_layer copied to clipboard
fix(docker): Dockerfiles can be vulnerable to supply chain attacks
Overview:
The Dockerfiles used to build the project are vulnerable to supply chain attacks. The vulnerability lies in the FROM directive in the Dockerfiles. The FROM directive is used without specifying a hash. The base image is pulled from the Docker Hub registry. If the base image is compromised, the entire image is compromised.
Mitigation:
Use a specific version of the base image and verifying the integrity of the base image before building the image.
# https://hub.docker.com/_/postgres
FROM postgres:16.3@sha256:d0f363f8366fbc3f52d172c6e76bc27151c3d643b870e1062b4e8bfe65baf609
...
FROM golang:1.22.4@sha256:c8736b8dbf2b12c98bb0eeed91eef58ecef52b8c2bd49b8044531e8d8d8d58e8
...