SEGURANÇA EM DOCKER: AÇÕES QUE COMPROMETEM IMAGENS SELADAS E AVALIAÇÃO DE FERRAMENTAS DE DETECÇÃO

Abstract

Docker is a containerization tool that has become popular among developers due to its portability and security. The tool uses images available on Docker Hub, which may have security seals that guarantee security and identify the project to which they belong. Even though these images have guaranteed initial security, users often ignore their security limitations. These vulnerabilities are created from misuse of the tool, making them insecure and unsuitable for compliance with laws such as the LGPD (Brazilian General Data Protection Law) and ISO 27001. Therefore, there are some open-source tools like Syft and Grype, Trivy, along with Docker Scout, a Docker-specific tool, that can scan containers for these vulnerabilities. These tools scan containers and compare them with databases of common vulnerabilities, searching for the mentioned flaws and displaying the results on the screen. Thus, it is possible to compare results and analyze which tool would be most efficient and effective in identifying these flaws. However, it is possible to observe that the results demonstrate some scenarios that lead to the conclusion that using the tools together is more efficient for identifying vulnerabilities in packages and for addressing failures in best practices. This highlights the need for attention to this issue and reinforces the need for improvements that address these flaws in scanning tools. Given that scanners can assist in compliance with ISO standards and the LGPD (Brazilian General Data Protection Law), this work also opens the possibility for a future study to identify which of these mentioned tools is the most efficient, as this work does not have this objective within this context.