docker-security — sample repo for image scanning

This repository contains a tiny Flask app, a Dockerfile, a Jenkinsfile, and a deployment.yaml so you can build and scan a container image and document High/Critical CVEs.

Steps to reproduce locally

1. Build the image:

docker build -t docker-security:latest .

2. Scan the image with Docker Scan (Snyk) or Trivy:

docker scan docker-security:latest
# or if you prefer Trivy (install it first):
trivy image docker-security:latest

3. Note any High or Critical CVEs found. Recommended fixes are typically:

• update base image (e.g., use a newer python:3.11-slim)
• pin & upgrade dependencies to safe versions in requirements.txt
• remove unnecessary packages and use multi-stage builds where possible

What to include in the final report

• Screenshots of scan results showing any High/Critical findings
• A short remediation section listing fixes applied (base image bump, package upgrades)
• Updated Dockerfile or requirements.txt if changes were needed

Vulnerability Scan Results

Latest scan performed on: November 2, 2025

Summary

Total vulnerabilities found: 53

• CRITICAL: 0
• HIGH: 0
• MEDIUM: 2 (1 in SQLite3, 1 in pip)
• LOW: 51 (mostly in base system packages)

Key Findings

1. Python Package Vulnerabilities:

   • pip (MEDIUM): CVE-2025-8869 - Missing checks on symbolic link extraction
     • Current version: 24.0
     • Fixed in: 25.3

2. Base Image (debian:13.1) Vulnerabilities:

   • All found vulnerabilities are LOW severity
   • Most are in system libraries that cannot be easily upgraded without breaking compatibility

Applied Fixes

1. Already implemented:

   • Using Python 3.11-slim base image (reduced attack surface)
   • Running as non-root user (mitigation against container breakout)
   • Using latest Flask version (3.1.2)
   • Cleaning pip cache after installation

2. Additional recommended fixes:

   # In Dockerfile, upgrade pip to fix CVE-2025-8869
   RUN python -m pip install --upgrade pip==25.3

Security Best Practices in Place

1. Base Image Security:

   • Using official Python slim image
   • Running latest stable Python 3.11

2. Runtime Security:

   • Non-root user execution
   • Minimal installed packages
   • No development tools in final image

3. Build Process:

   • No cache directories
   • Separate build stages for dependencies
   • Proper file permissions

Remaining Risk Assessment

The current image has no HIGH or CRITICAL vulnerabilities. The single MEDIUM vulnerability in pip:

1. Requires local access to exploit
2. Only impacts pip during package installation (not during runtime)
3. Can be fixed by upgrading pip to 25.3

The LOW severity OS-level vulnerabilities:

1. Are common in most Debian-based images
2. Have minimal real-world impact
3. Many are theoretical or require local access

Next Steps

1. Upgrade pip to version 25.3 to resolve the MEDIUM severity issue
2. Consider using multi-stage builds to further reduce the image size
3. Implement regular automated scanning in CI/CD (already configured in Jenkinsfile)
4. Monitor for new vulnerabilities and update dependencies regularly

Jenkins pipeline (build + run)

This repository includes a Jenkinsfile (declarative pipeline). The pipeline will:

• Build the Docker image (docker build -t docker-security:latest .)
• Run the container (docker run -d --name docker-security -p 8080:8080 docker-security:latest)
• Perform a smoke test by curling http://localhost:8080
• Print container logs and clean up the container after the run

Create a Jenkins job

1. Install Jenkins with Docker permissions (Jenkins must be able to run Docker on the host). If using the Docker-in-Docker approach or the Docker socket, ensure the Jenkins agent has access to Docker CLI and daemon.
2. In Jenkins, create a new item -> "Pipeline".
3. Under Pipeline configuration, select "Pipeline script from SCM" and choose Git, then provide the repository URL and branch.
4. Set the script path to Jenkinsfile (default).
5. Save and run the job. The pipeline will execute the steps in the Jenkinsfile.

What the pipeline shows (where to take screenshots)

• Build stage: screenshot the Jenkins "Build" stage console output showing successful docker build completion.
• Run / Smoke test: screenshot the console output showing the curl output (should show the app response) or the successful Performing smoke test (HTTP) step.
• Container output: after the run, open a browser to http://<jenkins-host>:8080 (or http://localhost:8080 if running Jenkins on your machine) and capture a screenshot of the app response.

Note: If Jenkins runs on a different host than where Docker runs, ensure port 8080 is reachable from your browser or use the Jenkins agent machine to run the container and then use curl from the agent to validate.

Local verification (before/after running Jenkins)

You can verify the pipeline steps locally before configuring Jenkins with these commands:

# Build locally
cd <repo-root>
docker build -t docker-security:latest .

# Run locally
docker run -d --name docker-security -p 8080:8080 docker-security:latest

# Check container output
curl http://localhost:8080

# Stop and remove
docker rm -f docker-security

Taking screenshots (Windows)

1. After a successful Jenkins build, open the Jenkins job and click the build number, then click "Console Output". Use the Snipping Tool/Win+Shift+S to capture the console showing the successful docker build and curl output.
2. To capture the running app, open a browser to http://localhost:8080 (or your Jenkins host IP + port) and take a screenshot of the response.
3. Save screenshots into the repo (e.g., docs/screenshots/jenkins-build.png and docs/screenshots/app-output.png) and commit them.

Suggested quick remediations (apply before or after scanning)

• Bump base image to a newer patch/major (example: python:3.11-slim) to pick up OS-level fixes.
• Upgrade Python dependencies in requirements.txt, e.g. use a supported Flask version (e.g. Flask>=2.1.0 or newer) and re-run scans.
• Minimize installed packages and enable --no-cache-dir (already used) and consider multi-stage builds for compiled deps.

After you run the scan locally, paste High/Critical CVE output (and screenshots) below and update this file with the applied fixes and the commit that fixed them.