Assess Dockerfile Security with cnspec

Use cnspec to scan Dockerfiles for security misconfigurations and policy violations before they reach production.

Scan a Dockerfile

Scan a single Dockerfile, substituting the path and name of the file for FILEPATH:

cnspec scan docker file FILEPATH

Find nested Dockerfiles within a directory, substituting the directory path for PATH:

cnspec scan docker file PATH

Example checks

Run cnspec shell docker file FILEPATH to open the cnspec interactive shell. From there you can make checks like the examples below.

Ensure the Dockerfile does not use the root user

cnspec> docker.file.user.user != "root"
[ok] value: true

Ensure a HEALTHCHECK instruction is defined

cnspec> docker.file.healthcheck.test.length > 0
[ok] value: true

List all base images used in the Dockerfile

cnspec> docker.file.from.list { image tag }

List all exposed ports

cnspec> docker.file.expose.list { port protocol }

List all stages in a multi-stage build

cnspec> docker.file.stages { name from.image }

Scan options

Learn more

• To scan Docker images, read Assess Docker Image Security.

• To scan running containers, read Assess Docker Container Security.

• To learn more about how the MQL query language works, read Write Effective MQL.

• Explore the Dockerfile resource reference.