imiell/bad-dockerfile repository overview

⁠Bad Dockerfile

⁠Overview

Reference Dockerfile containing software with known vulnerabilities.

Includes vulnerable binaries (bash shellshock, wget directory traversal) with CVE entries for testing Docker image scanning solutions.

For full details see: http://www.stindustries.net/docker/bad-dockerfile/⁠

Created by Adrian Portelli.

Image available here: https://hub.docker.com/r/imiell/bad-dockerfile⁠

But note that it's insecure!

⁠How to

⁠Pull an already-built image

docker pull imiell/bad-dockerfile

⁠Build locally

If your build host can reach the Internet:

docker build -t imiell/bad-dockerfile ./

If your build host needs proxy settings to reach the Internet:

# Replace ... with exotic curl options for your build environment.
docker build -t imiell/bad-dockerfile --build-arg CURL_OPTIONS="..." ./

⁠View labels

Each built image has labels that generally follow http://label-schema.org/⁠

View a specific label, such as the image description:

docker inspect \
  -f '{{ index .Config.Labels "org.label-schema.description" }}' \
  imiell/bad-dockerfile

Query all the labels inside a built image:

docker inspect imiell/bad-dockerfile | jq -M '.[].Config.Labels'