Skip to content

Security

Risks

CI/CD is the automation of most (if not all) process in your software lifecycle going from building to running the application in production. With so many things happening, attackers have a wide range of capabilities in case of a compromise:

  • introduce dubious components (i.e. backdoor) in the application,
  • leak (to the Internet) credentials granting access to internal services or infrastructures,
  • access said services or infrastructures,
  • impersonate an employee,
  • leak intellectual property,
  • ...

Every CI/CD job is executed inside a container image which contains various tools required by the job. When you are executing the job, you are trusting the people building the image and the tools.

In some cases, the image may have been corrupted by an attacker. This is what we call a supply chain attack. There are famous cases like the Codecov incident in which hackers managed to leak credentials from several services and cloud platforms.

Mitigations

Variables scoping

To prevent leakage, CI/CD variables has to be present only in jobs that need them. By example in the Maven template, only the mvn-sonar job actually needs the SONAR_TOKEN environment variable so others jobs (mvn-build, mvn-release...) should not access this secret.

You can find more info about how to protect your CI/CD variables in the official GitLab documentation.

Image selection

As much as we can, we try to select either official images (ex: Maven, Python), or at least images maintained by an active community. Each of those images can be freely overridden with the appropriate configuration variable to select fixed versions (more info here) or any alternative that would suit you more.

By default, to be continuous templates mostly use the latest tag from upstream images since it is a maintenance-less default that works for nearly everyone. However latest images are prone to supply chain attacks and are also likely to introduce breaking changes.

to be continuous is not responsible of any possible security issue from a default container image.

To mitigate the risks of using latest images, you should always use a fixed version tag (maven:3.9.1 instead of maven:latest) or build your own image.

Additional dependencies

However, the direct counterpart of using official images is that many default image do not ship all the required tools used by the template (think about git and curl utilities). For this reason, many templates check the presence of these additional dependencies and install them on the fly (see maybe_install_pkg function).

This is a good practice to avoid bloating the image with unnecessary tools, but it also means that you are trusting the upstream repositories of your distribution (i.e. Debian, Alpine, etc.) to not be compromised and requiring network access to download packages.

Every project is encouraged to maintain his own Docker image in order to fit to their needs, avoid extraneous downloading for additional dependencies and simplify the work of security team (it's easy to scan a Docker image). While doing so, we recommend to use a minimal distribution and root-less images to prevent some container escalation vulnerabilities against your runner provider.

Tip

Whenever building your own image or using an upstream image, you can use Renovate to watch updates for your tools, test the new version and integrate them seamlessly.

Vulnerability Reports (Trivy)

Important

When reviewing vulnerabilities from containers, you have to consider the following principes :

  • containers are usually very short-lived in a CI/CD environment
  • no direct user access is possible
  • most job does not expose any exteral services (i.e. HTTP server) making attacks reliant on user interaction very hard if not impossible to exploit

In short, risks are often low in the CI/CD context but carefully reviewing vulnerabilities are an essential step to secure your pipeline.

Here are vulnerability reports for each default image used by to be continuous templates (generated every day):

Template Image Variable Default Image Vulnerabilities
AnsibleANSIBLE_IMAGEdocker.io/cytopia/ansible:latest-tools 1 High, 11 Medium, 1 Low, 2 Unknown
AnsibleANSIBLE_LINT_IMAGEdocker.io/haxorof/ansible-lint:latest
Amazon Web ServicesAWS_CLI_IMAGEdocker.io/amazon/aws-cli:latest
AzureAZURE_CLI_IMAGEmcr.microsoft.com/azure-cli:latest 1 High
BashBASH_BATS_IMAGEdocker.io/bats/bats:latest
BashBASH_SHELLCHECK_IMAGEdocker.io/koalaman/shellcheck-alpine:stable
BrunoBRU_IMAGEdocker.io/library/node:lts-alpine
GitLab ButlerBUTLER_IMAGEregistry.gitlab.com/to-be-continuous/tools/gitlab-butler:latest
Cloud FoundryCF_CLI_IMAGEdocker.io/governmentpaas/cf-cli 6 Critical, 28 High, 64 Medium, 3 Low, 1 Unknown
Cloud Native BuildpacksCNB_BUILDER_IMAGEdocker.io/paketobuildpacks/builder-jammy-base:latest 37 Critical, 100 High, 1405 Medium, 153 Low
Cloud Native BuildpacksCNB_SKOPEO_IMAGEquay.io/containers/skopeo:latest
Cloud Native BuildpacksCNB_TRIVY_IMAGEdocker.io/aquasec/trivy:latest 1 High, 1 Medium
CypressCYPRESS_IMAGEdocker.io/cypress/included:13.13.3 24 Critical, 166 High, 325 Medium, 324 Low, 29 Unknown
dbtDBT_IMAGEghcr.io/dbt-labs/dbt-core:latest 4 Critical, 347 High, 1135 Medium, 627 Low, 10 Unknown
Docker ComposeDCMP_IMAGEdocker.io/library/docker:latest 2 Medium
DefectDojoDEFECTDOJO_BASE_IMAGEdocker.io/library/node:alpine3.11 1 Critical, 25 High, 3 Medium, 2 Low
Dependency TrackDEPTRACK_SBOM_SCANNER_IMAGEregistry.gitlab.com/to-be-continuous/tools/dt-sbom-scanner:latest
DockerDOCKER_BUILDAH_IMAGEquay.io/containers/buildah:latest
DockerDOCKER_DIND_IMAGEdocker.io/library/docker:dind 2 Medium
DockerDOCKER_HADOLINT_IMAGEdocker.io/hadolint/hadolint:latest-alpine
DockerDOCKER_IMAGEdocker.io/library/docker:latest 2 Medium
DockerDOCKER_KANIKO_IMAGEgcr.io/kaniko-project/executor:debug 10 High, 10 Medium
DockerDOCKER_SBOM_IMAGEdocker.io/anchore/syft:debug 1 Medium
DockerDOCKER_SKOPEO_IMAGEquay.io/containers/skopeo:latest
DockerDOCKER_TRIVY_IMAGEdocker.io/aquasec/trivy:latest 1 High, 1 Medium
.NETDOTNET_IMAGEmcr.microsoft.com/dotnet/sdk:latest 1 Critical, 9 High, 15 Medium, 105 Low, 1 Unknown
Google CloudGCP_CLI_IMAGEgcr.io/google.com/cloudsdktool/cloud-sdk:latest 4 Critical, 160 High, 555 Medium, 572 Low, 9 Unknown
GitleaksGITLEAKS_IMAGEdocker.io/zricethezav/gitleaks:latest 1 High, 1 Medium
GitOpsGITOPS_IMAGEdocker.io/alpine/git:latest
GitLab PackageGLPKG_IMAGEdocker.io/curlimages/curl:latest
GoGO_CI_LINT_IMAGEdocker.io/golangci/golangci-lint:latest-alpine 2 Medium, 1 Low
GoGO_IMAGEdocker.io/library/golang:bookworm 2 Critical, 149 High, 534 Medium, 443 Low, 7 Unknown
GoGO_SBOM_IMAGE$GO_IMAGE not fetched
GoGO_SEMGREP_IMAGEdocker.io/semgrep/semgrep:latest 1 High, 1 Medium
GradleGRADLE_IMAGEdocker.io/library/gradle:latest 41 Medium, 32 Low
HelmfileHELMFILE_CLI_IMAGEghcr.io/helmfile/helmfile:latest 2 Critical, 15 High, 41 Medium, 2 Low
HelmHELM_CLI_IMAGEdocker.io/alpine/helm:latest
HelmHELM_KUBE_SCORE_IMAGEdocker.io/zegl/kube-score 8 Critical, 56 High, 76 Medium, 3 Low
HelmHELM_YAMLLINT_IMAGEdocker.io/cytopia/yamllint 7 High, 12 Medium, 2 Unknown
HurlHURL_IMAGEghcr.io/orange-opensource/hurl:latest
k6K6_IMAGEdocker.io/grafana/k6:latest
KubernetesK8S_KUBECTL_IMAGEdocker.io/alpine/k8s:MUST_SET_VERSION not fetched
KubernetesK8S_KUBE_SCORE_IMAGEdocker.io/zegl/kube-score:latest 8 Critical, 56 High, 76 Medium, 3 Low
LighthouseLHCI_IMAGEdocker.io/cypress/browsers:latest 1 Critical, 13 High, 42 Medium, 206 Low, 6 Unknown
GNU MakeMAKE_IMAGEdocker.io/alpinelinux/build-base 2 Low
MavenMAVEN_IMAGEdocker.io/library/maven:latest 40 Medium, 32 Low
MkDocsMKD_IMAGEdocker.io/squidfunk/mkdocs-material:latest 2 High
MkDocsMKD_LYCHEE_IMAGEdocker.io/lycheeverse/lychee:latest 1 Critical, 4 High, 11 Medium, 60 Low, 1 Unknown
MobSFMOBSF_CLIENT_IMAGEdocker.io/badouralix/curl-jq
MobSFMOBSF_CODE_IMAGEdocker.io/opensecurity/mobsfscan:latest 6 Critical, 391 High, 1140 Medium, 448 Low, 8 Unknown
AngularNG_CLI_IMAGEdocker.io/trion/ng-cli-karma:latest 2 Critical, 157 High, 549 Medium, 546 Low, 9 Unknown
Node.jsNODE_IMAGEdocker.io/library/node:lts-alpine
Node.jsNODE_SEMGREP_IMAGEdocker.io/semgrep/semgrep:latest 1 High, 1 Medium
OSS Review Toolkit (ORT)ORT_SCANNER_IMAGEghcr.io/oss-review-toolkit/ort:latest 13 Critical, 78 High, 1235 Medium, 159 Low
OpenShiftOS_CLI_IMAGEquay.io/openshift/origin-cli:latest 1 High, 2 Medium, 1 Low
PHPPHP_IMAGEdocker.io/library/php:latest 46 High, 146 Medium, 343 Low, 2 Unknown
PlaywrightPLAYWRIGHT_IMAGEmcr.microsoft.com/playwright:latest 5 High, 699 Medium, 143 Low
PostmanPOSTMAN_IMAGEdocker.io/postman/newman:latest 6 High, 30 Medium, 8 Low, 2 Unknown
pre-commitPRE_COMMIT_IMAGEdocker.io/library/python:3-alpine
PuppeteerPUPPETEER_IMAGEghcr.io/puppeteer/puppeteer:latest 39 Critical, 243 High, 683 Medium, 778 Low, 11 Unknown
PythonPYTHON_IMAGEdocker.io/library/python:3-slim 1 Medium, 51 Low
RenovateRENOVATE_IMAGEdocker.io/renovate/renovate:latest 2 High, 998 Medium, 71 Low
Robot FrameworkROBOT_BASE_IMAGEdocker.io/ppodgorsek/robot-framework:latest 1 High
RPMRPM_BASE_IMAGEdocker.io/fedora
RPMRPM_BUILD_IMAGE$RPM_BASE_IMAGE not fetched
RPMRPM_LINT_IMAGE$RPM_BASE_IMAGE not fetched
Source-to-ImageS2I_DIND_IMAGEdocker.io/library/docker:dind 2 Medium
Source-to-ImageS2I_SKOPEO_IMAGEquay.io/containers/skopeo:latest
Source-to-ImageS2I_TRIVY_IMAGEdocker.io/aquasec/trivy:latest 1 High, 1 Medium
S3 (Simple Storage Service)S3_CMD_IMAGEdocker.io/d3fk/s3cmd:latest
Scala/SBTSBT_IMAGEdocker.io/sbtscala/scala-sbt:17.0.2_1.6.2_3.1.3 52 Critical, 233 High, 311 Medium, 643 Low, 10 Unknown
Scala/SBTSBT_SBOM_IMAGEdocker.io/anchore/syft:debug 1 Medium
semantic-releaseSEMREL_IMAGEdocker.io/library/node:lts-slim 1 Critical, 4 High, 11 Medium, 58 Low, 1 Unknown
SonarQubeSONAR_SCANNER_IMAGEdocker.io/sonarsource/sonar-scanner-cli:latest 26 High, 18 Medium, 1 Low
SpectralSPECTRAL_IMAGEdocker.io/stoplight/spectral:latest 6 High, 29 Medium, 8 Low, 2 Unknown
SphinxSPHINX_IMAGEghcr.io/sphinx-doc/sphinx:latest 18 Critical, 45 High, 54 Medium, 187 Low, 2 Unknown
SphinxSPHINX_LYCHEE_IMAGEdocker.io/lycheeverse/lychee:latest 1 Critical, 4 High, 11 Medium, 60 Low, 1 Unknown
SQLFluff lintSQLFLUFF_IMAGEdocker.io/sqlfluff/sqlfluff:latest 3 Critical, 9 High, 23 Medium, 85 Low, 1 Unknown
Test SSLTESTSSL_IMAGEdocker.io/drwetter/testssl.sh:latest
TerraformTF_CHECKOV_IMAGEdocker.io/bridgecrew/checkov 4 High, 8 Medium, 88 Low
TerraformTF_DOCS_IMAGEquay.io/terraform-docs/terraform-docs:edge 2 High, 2 Medium
TerraformTF_IMAGEdocker.io/hashicorp/terraform:latest 2 High, 1 Medium
TerraformTF_INFRACOST_IMAGEdocker.io/infracost/infracost 72 Critical, 764 High, 586 Medium, 20 Low, 2 Unknown
TerraformTF_PUBLISH_IMAGEdocker.io/curlimages/curl:latest
TerraformTF_TFLINT_IMAGEghcr.io/terraform-linters/tflint-bundle:latest 7 Critical, 42 High, 133 Medium, 5 Low, 2 Unknown
TerraformTF_TFSEC_IMAGEdocker.io/aquasec/tfsec-ci 11 High, 10 Medium, 3 Low
TerraformTF_TRIVY_IMAGEdocker.io/aquasec/trivy 1 High, 1 Medium