Scan results · a7e137f
main · 2 critical · 14 high · 59 medium · 82 low
- medium Sudo Usage in Dockerfile sast-engine/Dockerfile:6
Dockerfile uses 'sudo' in RUN instructions. This is unnecessary during build (already root) and increases security risk if sudo remains in the final image. Use USER instruction for privilege changes instead.
- medium Avoid apt-get upgrade sast-engine/Dockerfile:6
Avoid apt-get upgrade in Dockerfiles. Use specific base image versions instead.
- medium Sudo Usage in Dockerfile sast-engine/Dockerfile:10
Dockerfile uses 'sudo' in RUN instructions. This is unnecessary during build (already root) and increases security risk if sudo remains in the final image. Use USER instruction for privilege changes instead.
- medium Sudo Usage in Dockerfile sast-engine/Dockerfile:13
Dockerfile uses 'sudo' in RUN instructions. This is unnecessary during build (already root) and increases security risk if sudo remains in the final image. Use USER instruction for privilege changes instead.
- medium Missing pipefail in Shell Commands sast-engine/Dockerfile:13
RUN instruction uses pipes without 'set -o pipefail'. This masks failures in piped commands.
- medium Sudo Usage in Dockerfile sast-engine/Dockerfile:16
Dockerfile uses 'sudo' in RUN instructions. This is unnecessary during build (already root) and increases security risk if sudo remains in the final image. Use USER instruction for privilege changes instead.
- medium Privileged Port Exposed sast-engine/Dockerfile:21
Exposing port below 1024 typically requires root privileges to bind. Consider using non-privileged ports (>1024) with port mapping or granting CAP_NET_BIND_SERVICE capability.
- medium Multiple CMD Instructions sast-engine/Dockerfile:23
Multiple CMD instructions detected. Only the last one takes effect.
- medium Using Host IPC Mode sast-engine/docker-compose.yml:9
[Service: web] Service uses host IPC namespace. Container shares inter-process communication with host.
- medium SELinux Separation Disabled sast-engine/docker-compose.yml:14
[Service: web] Service has 'label:disable' in security_opt, which disables SELinux mandatory access control. This removes a critical security layer and increases the impact of container compromises. Remove label:disable or use custom SELinux labels instead.
Get this for your repo.
Pathfinder runs the same scan on your own repos free. Connect via GitHub in 30 seconds.