Metadata

ID: docker-best-practices/only-use-allowed-registry

Language: Docker

Severity: Error

Category: Best Practices

Description

This rule enforces the use of only allowed registries in the FROM instruction of a Dockerfile. It ensures that base images are pulled from trusted and verified sources, reducing the risk of introducing malicious or unverified software into your container environment.

To comply with this rule, always specify base images using registries that are explicitly permitted by your organization’s policies. For example, use FROM python:3.6 or FROM docker.io/python:3.6 instead of FROM randomrepo/python:3.6. This practice helps ensure that the images you use are reliable and vetted.

You can specify the exact list of registries to check by defining the registries argument and separate them with a comma. There is an example of how to tweak your configuration file to add registry1 and registry2.

rulesets:
  - docker-best-practices:
    rules:
      only-use-allowed-registry:
        arguments:
          registries: registry1,registry2

Arguments

• registries: comma-separated list of trusted registries

Non-Compliant Code Examples

FROM registry.somedomain.com/images/mirror/dgraph/dgraph:v1.1.0

FROM x.com/debian

FROM randomrepo/python:3.6
FROM registry.something.io/images/base/ubuntu_2204:release
RUN acommand

Compliant Code Examples

FROM ubuntu:18.04 AS builder1
FROM builder1 AS builder2

FROM python:3.6
RUN acommand

FROM docker.io/python:3.6
FROM scratch
RUN acommand