backdrop-ops / backdrop-docker

Backdrop on Docker
12 stars 9 forks source link

Chore: reduce attack surface for Docker image #61

Closed bqcuong closed 1 year ago

bqcuong commented 1 year ago

Hi,

This pull request includes a small improvement for the Dockerfile, which should help improve the security of container and reduce the risk of potential attacks.

In detail:

As quoted from CIS Docker Benchmark v1.5.0:

4.3 Ensure that unnecessary packages are not installed in the container Description: Containers should have as small a footprint as possible, and should not contain unnecessary software packages which could increase their attack surface. Rationale: Unnecessary software should not be installed into containers, as doing so increases their attack surface. Only packages strictly necessary for the correct operation of the application being deployed should be installed.

The differences between two builds are summarized in the below table: Before improvement After improvement
Newly intalled packages 16 15
Image size 450MB 450MB
Build time 104s 88s

I hope that you find them useful. Please let me know if you have any concerns.

Thank you.

Wylbur commented 1 year ago

@bqcuong Merged, thanks for your help!