Before You docker build: 7 Supply-Chain Checks for Third-Party Repos
You cloned a repo, read the README, and your fingers are already typing docker compose up . Stop. A third-party repository is untrusted input — and the build/run pipeline executes it. Most "it's just a demo repo" incidents I've audited started with a skipped two-minute review. Here are seven checks, in the order that catches the most problems first. None takes more than a few minutes. 1. Read the…
When you clone a third-party repository and immediately attempt to run it with `docker compose up`, pause and consider seven essential supply-chain checks. These checks focus on the security implications of using untrusted input, specifically the `Dockerfile`, base image, Docker Compose configuration, CI workflows, secrets, dependencies, and container runtime isolation.
1. Examine the `Dockerfile` line by line, particularly the `RUN` instructions. These commands execute with the builder's privileges, potentially running remote scripts or downloading files without verification. Be wary of remote scripts piped to a shell, downloads without checksums, `COPY --from=` stages pulling from unexpected images, and environment variables or arguments that may contain sensitive information.
2. Verify the base image specified in the `FROM` directive. The `latest` tag represents an ever-changing target. Prefer pinned tags or digests for more stable and auditable images. Compare the base image against the project's claimed stack to ensure compatibility.
3. Audit the Docker Compose file for ports and volumes. Avoid publishing ports to `0.0.0.0` unless absolutely necessary, and restrict access to localhost only if required. Be cautious of mounting sensitive host paths, such as the Docker socket, which grants the container root-equivalent control over the host system. Scrutinize volume mounts for any paths containing sensitive data, like `~/.ssh`, `~/.aws`, or `/etc`.
4. Review the CI workflows before trusting the project's badges. Inspect the workflows for pinned actions (e.g., `actions/checkout@sha`) versus floating tags (`@v4`). Look for workflows that post secrets to external endpoints or run untrusted code with write tokens. Remember that green badges indicate passing tests, but not necessarily safe code.
5. Quickly scan the repository for secrets and suspicious patterns. Use grep commands to search for common secret indicators, such as API keys, tokens, passwords, and remote-execution command patterns. Be alert for committed production keys or post-installation scripts that transmit data to external services.
6. Pin and review dependencies used during runtime. Utilize `docker compose config` to see what will actually run, with variables resolved. Examine package manifests and look for post-installation or prepare scripts that execute during the installation process. Be wary of any code that runs automatically upon installation, as it may introduce additional risks.
7. Finally, run unfamiliar stacks in a controlled environment. Avoid using your primary machine or workstation for testing purposes. Instead, utilize a separate VM or dedicated machine. Run the container with a non-privileged user, employ read-only filesystems, and drop unnecessary capabilities. Ensure the container runtime is up-to-date and maintain separate network and browser profiles for any UI exposed by the container.
Treat every third-party repository with the same level of caution as you would a binary download from the past, ensuring it does not run on your machine until you have thoroughly evaluated its trustworthiness.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
