RUN using sudo

ID

run_using_sudo

Severity

high

Family

Container Security

Tags

dockerfile, excessive-privileges, reachable, security, supply-chain

Description

Avoid installing or using sudo as it has unpredictable TTY and signal-forwarding behavior that can cause problems.

Reference: Avoid installing or using sudo, in Best Practices for Dockerfile Instructions.

Security

If you absolutely need functionality similar to sudo, such as initializing a daemon as root but running it as non-root, consider using gosu.

Examples

FROM alpine:3.5

# issue, sudo not allowed
RUN apk add --update --no-cache py2-pip && \
    sudo pip install --upgrade pip

CMD python /usr/src/app/app.py

Mitigation / Fix

FROM alpine:3.5

# fixed
RUN apk add --update --no-cache py2-pip && \
    pip install --upgrade pip

CMD python /usr/src/app/app.py