Container Security

Critical security rules for Docker containers

Security Rules

Run All Container Security Rules

pathfinder scan --ruleset cpf/docker/security

Detects Dockerfiles without USER instruction, causing containers to run with root privileges

Detects ARG instructions with names suggesting secrets. Build args are visible in image history

Detects Docker socket mount which gives container full control over host Docker daemon

Detects use of sudo in RUN instructions which is an anti-pattern indicating privilege model confusion