feat(docker): Add Phase 1 critical security rules (4 new rules)

[shivasurya]

Phase 1: Critical Security Rules Implementation

This PR adds 4 high-priority security rules based on comprehensive analysis of 59 reference rules from industry best practices. These rules focus on critical security issues that have significant real-world impact.

📊 Coverage Analysis Summary

Analysis document: /cpf_plans/docker_rules_comparison.md

• Total reference rules analyzed: 59
• Current coverage before this PR: 18 rules (30.5%)
• Total missing rules identified: 38
• Phase 1 implementation: 4 critical security rules
• New coverage: 22 rules (37.3%)

🎯 Phase 1 Rules (This PR)

Dockerfile Security Rules

1. DOCKER-SEC-001: Last USER Instruction is Root (HIGH)

• Impact: Container escape and privilege escalation
• Detection: Uses final_stage_has() to check if final build stage has USER root
• CWE: CWE-269 (Improper Privilege Management)
• Real-world risk: Compromised container immediately has root access

# VULNERABLE
FROM ubuntu
RUN apt-get update
USER root  # ❌ Final user is root
CMD ["app"]

# SECURE
FROM ubuntu
RUN apt-get update
USER appuser  # ✅ Runs as non-root
CMD ["app"]

2. DOCKER-SEC-007: Sudo Usage in Dockerfile (MEDIUM)

• Impact: Unnecessary attack surface, privilege escalation path
• Detection: Matches various sudo patterns in RUN instructions
• CWE: CWE-250 (Execution with Unnecessary Privileges)
• Rationale: sudo in containers is redundant (already root) and dangerous if present in final image

# VULNERABLE
RUN sudo apt-get install nginx  # ❌ Unnecessary sudo

# SECURE
RUN apt-get install nginx  # ✅ Already root during build

Docker-Compose Security Rules

3. COMPOSE-SEC-009: Missing no-new-privileges (MEDIUM)

• Impact: Setuid/setgid privilege escalation attacks
• Detection: Checks for missing no-new-privileges:true in security_opt
• CWE: CWE-732 (Incorrect Permission Assignment)
• Protection: Blocks privilege escalation via setuid binaries

# VULNERABLE
services:
  web:
    image: nginx
    # ❌ No no-new-privileges protection

# SECURE
services:
  web:
    image: nginx
    security_opt:
      - no-new-privileges:true  # ✅ Blocks setuid escalation

4. COMPOSE-SEC-010: SELinux Separation Disabled (MEDIUM)

• Impact: Removes mandatory access control layer
• Detection: Detects label:disable in security_opt
• CWE: CWE-732 (Incorrect Permission Assignment)
• Protection: SELinux confines containers even when running as root

# VULNERABLE
services:
  web:
    security_opt:
      - label:disable  # ❌ Disables SELinux protection

# SECURE
services:
  web:
    # ✅ SELinux enabled by default (no label:disable)

🏗️ Technical Implementation

DSL Infrastructure

• container_decorators.py: @dockerfile_rule and @compose_rule decorators
• container_matchers.py: Pattern matching (instruction, service_has, service_missing)
• container_combinators.py: Logic operators (all_of, any_of, none_of, final_stage_has)
• container_ir.py: JSON IR compilation for Go executor

Rule Structure

Each rule includes:

• ✅ Comprehensive security impact documentation
• ✅ Real-world attack scenarios with examples
• ✅ Vulnerable and secure code examples
• ✅ Step-by-step remediation guidance
• ✅ CWE mappings and external references
• ✅ Defense-in-depth recommendations

📈 Future Phases

Phase 2: Package Manager Best Practices (11 rules)

• avoid-*-upgrade rules (apt, apk, dnf, yum)
• Cache cleanup rules (dnf, yum, zypper)
• Shell best practices (set -o pipefail)

Phase 3: Dockerfile Correctness (7 rules)

• Port validation, multiple CMD/ENTRYPOINT
• Image versioning and digest pinning

Phase 4: Additional Best Practices (~13 rules)

• COPY vs ADD, JSON notation, WORKDIR usage

✅ Quality Metrics

• Syntax: All rules successfully imported and validated
• Documentation: Each rule has 100+ lines of security context
• Examples: Vulnerable and secure patterns for each rule
• CWE Mapping: All rules mapped to MITRE CWE database
• Testing: Rules load correctly via Python import test

🔗 Dependencies

• Depends on Python DSL infrastructure (container_decorators, matchers, combinators)
• Can be merged independently or stacked after PR feat(docker): Complete Docker/Compose integration with runtime rule loading (PR 8/8) #426

📚 References

• Industry best practices from reference collection
• OWASP Docker Security Cheat Sheet
• CIS Docker Benchmark
• MITRE CWE Database

---

Note: This PR does NOT mention the source collection anywhere in code or rule names, as requested.

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.5 [email protected]

[safedep]

SafeDep Report Summary

No dependency changes detected. Nothing to scan.

_{This report is generated by SafeDep Github App}

[shivasurya]

Closing to rebase on docker/08 and add more rules in comprehensive PR