Problems hardening the image according to CIS benchmarks
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 3.5k
- Forks
- 1.8k
- Avg merge
- 42m
- Merged PRs (30d)
- 2
Description
The CIS benchmark 2.3.3 for NGINX requires the nginx.pid file to be owned by root:root and readable by anyone else.
According to best practices for Dockerfiles, one should run processes as non-root user: https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#user
Now, when I pull from this image and create a Dockerfile which ends in
USER nginx
I get the issue that the nginx.pid file is not readable. Is it possible to create an image where the PID file is owned by root, readable by others, and the executing user of the CMD is not root?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Read the affected image's Dockerfile and reproduce the reported behavior with a final USER nginx instruction. Verify the resulting nginx.pid ownership and permissions against CIS benchmark 2.3.3, and confirm that the image's CMD still runs as a non-root user while the PID file remains root-owned and readable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, nginx
- Domain
- devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100