Why should we ensure apt is not used with RUN command for Docker file (AC_DOCKER_0002)

[tr4l]

A bunch of new compliance rules has been added recently (which is nice!)

Several of them relate to the fact that we don't want to update system package of docker image.

I mostly share the point of view of Itamar Turner-Trauring- on that matter and we can see that hadolint also allow apt update/upgrade but disallow dist-upgrade.

Did you have any other reason/pointer on "why" I should not run apt on my docker creation image ?

[TechnicallyJoe]

Hi

I cannot find any reason online as to why this is. I even asked Chatgpt!
Why should we ensure apt is not used with a RUN command in dockerfiles and what would be the better approach?

[jstbillz]

@TechnicallyJoe
I don't think it's just apt - it will complain if you change it to apt-get.
The better practice is, as described here , to always combine apt-get with apt-get update in the same RUN

[jstbillz]

@TechnicallyJoe

So what you have to do is always combine apt-get update with apt-get install. Here is an example:

The scan will complain here:

RUN  apt-get install -y git 

But will not complain here:

RUN apt-get update && apt-get install -y git 

The reference is in the docker documentation in this link https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run :

It reads:

Always combine RUN apt-get update with apt-get install in the same RUN statement.

As another reference, BridgeCrew also enforces this:
https://docs.bridgecrew.io/docs/ensure-docker-apt-is-not-used

[TechnicallyJoe]

@TechnicallyJoe

So what you have to do is always combine apt-get update with apt-get install. Here is an example:

The scan will complain here:

RUN  apt-get install -y git 

But will not complain here:

RUN apt-get update && apt-get install -y git 

The reference is in the docker documentation in this link https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#run :

It reads:

Always combine RUN apt-get update with apt-get install in the same RUN statement.

As another reference, BridgeCrew also enforces this: https://docs.bridgecrew.io/docs/ensure-docker-apt-is-not-used

Are you reading something im not?

The bridgecrew link says this:

Docker APT is used
Description
It is generally a best practice to avoid using APT (Advanced Package Tool) when working with Docker containers. This is because APT is designed to work with traditional server-based environments, and may not be well-suited for use with containers.

Using APT with Docker containers can create potential security risks, as it may allow packages to be installed that are not designed to work with containers. This can lead to compatibility issues and potentially compromise the security of your containers.

It makes no mention of using apt update.

[jstbillz]

My bad, wrong scratch that bridgecrew reference out.

[tfrokt]

I don't understand why trunk doesn't give a recommendation. This error is not helpful.

[jaredquinn]

I am still getting this failure when lines wrap:

RUN apt-get update && \
         apt-get install -y git ... && \
         apt-get clean && rm -rf /var/lib/apt/lists/*