apt-get Without --no-install-recommends

low

Detects apt-get install without --no-install-recommends flag, which installs unnecessary packages increasing image size and attack surface.

Rule Information

Language
Docker
Category
Best Practices
Author
Code Pathfinder Team
Last Updated
2024-12-19
Tags
dockeraptdebianubuntuimage-sizesecuritybest-practice

Interactive Playground

Experiment with the vulnerable code and security rule below. Edit the code to see how the rule detects different vulnerability patterns.

pathfinder scan --rule cpf/apt-without-no-recommends
Vulnerable Code
1
2
3
4
5
6
7
8
9
10
11
12
Security Rule

Similar Rules

Explore related security rules for Docker

low

apk add Without --no-cache

Detects RUN instructions using Alpine Linux's apk add command without the --no-cache flag, which unnecessarily increases Docker image size by 2-5 MB.

critical

Docker Socket Mounted as Volume

Detects VOLUME instructions that mount the Docker socket, giving a container full control over the host's Docker daemon, equivalent to unrestricted root access.

info

Deprecated MAINTAINER Instruction

Detects usage of the deprecated MAINTAINER instruction, which has been deprecated since Docker 1.13 in favor of LABEL instructions with standardized OCI metadata keys.

Frequently Asked Questions

Common questions about apt-get Without --no-install-recommends

Detects apt-get install without --no-install-recommends flag, which installs unnecessary packages increasing image size and attack surface.
This vulnerability is rated as low severity, which means it should be addressed when convenient as it represents a lower security risk but still indicates areas for improvement in code quality and security posture.

Use Code Pathfinder to scan your Docker codebase and automatically detect instances of this vulnerability pattern. Install Code Pathfinder and run the following command in your project directory:

pathfinder scan --rule cpf/apt-without-no-recommends

This rule is aligned with industry-standard security frameworks and classifications:

  • Tags: docker, apt, debian, ubuntu, image-size, security, best-practice
Yes! Code Pathfinder allows you to customize rules to match your specific security requirements and coding standards. You can modify the detection patterns, adjust severity levels, add custom sanitizers, and configure the rule to fit your organization's security policies. The interactive playground above lets you experiment with the rule and see how it behaves with different code patterns.
When this vulnerability is detected in your code, review the flagged instances carefully. Check the "Vulnerable Code" section above for examples of insecure patterns and the "Security Rule" section to understand what the rule is looking for. Follow security best practices for Docker and consult the CWE/CVE references for detailed remediation guidance. Always test your fixes thoroughly before deploying to production.
Back to Best PracticesAll Languages →