Public | Automated Build

Last pushed: 21 days ago
Short Description
Dockerfile containing known vulnerabilities
Full Description

Bad Dockerfile


Reference Dockerfile containing software with known vulnerabilities.

Includes vulnerable binaries (bash shellshock, wget directory traversal) with
CVE entries for testing Docker image scanning solutions.

For full details see:

Created by Adrian Portelli.

Image available here:

But note that it's insecure!

How to

Pull an already-built image

docker pull imiell/bad-dockerfile

Build locally

If your build host can reach the Internet:

docker build -t imiell/bad-dockerfile ./

If your build host needs proxy settings to reach the Internet:

# Replace ... with exotic curl options for your build environment.
docker build -t imiell/bad-dockerfile --build-arg CURL_OPTIONS="..." ./

View labels

Each built image has labels that generally follow

View a specific label, such as the image description:

docker inspect \
  -f '{{ index .Config.Labels "org.label-schema.description" }}' \

Query all the labels inside a built image:

docker inspect imiell/bad-dockerfile | jq -M '.[].Config.Labels'
Docker Pull Command
Source Repository