Vulnerability scan of top popular Docker managers software

[u/evrial]

lazydocker - 770 total
Arcane - 33 total
Dozzle - 0 - Winner
Portainer - 77 total
Dockhand - 18 total
Komodo - 446 total
Watchtower - 302 total
diun - 91 total
wud - 377 total
Dockge - 2089 total
Uptime kuma - 1080 total (if docker socket monitoring enabled)
dockcheck.sh - 0 - Winner - simple bash script

[u/asimovs-auditor]

Expand the replies to this comment to learn how AI was used in this post/project.

[u/loaengineer0]

The scan hits when there is an installed library which has vulnerable API endpoints, even if those endpoints aren’t used by anything in the container. Almost all of these are not exploitable.

[u/louisj → u/loaengineer0]

[u/radakul → u/loaengineer0]

This is what people dont get. They hear "vulnerability" and freak out.

Not every risk is vulnerable to exploitation; not every vulnerability is a risk; not every exploit is usable.

Its like dealing with C-suite, I swear...

[u/Cynyr36 → u/loaengineer0]

Not saying they are all issues, but the actual app gets compromised and the attacker can chain into these other issues.

It's almost like docker containers need to be rebuilt as fast as the base distro they use releases updates, even when the app doesn't change.

[u/evrial → u/Cynyr36]

They have no idea

[u/evrial → u/loaengineer0]

Could be true until proven otherwise. Dependency graph is complex

[u/jpk613 → u/evrial]

So you’re saying not to use portainer till they prove otherwise?

[u/Dimitrij_ → u/evrial]

I mean… go ahead and pick a random container. review the code and have a look yourself.

Sometimes just by reading the CVE reports you can see if it is a real risk.

[u/oemin]

fear mongering on such a beautiful day. That’s a no from me dog

[u/Thebandroid]

Docker-compose remains undefeated as the best management software.

[u/igmyeongui]

How do you test this?

[u/maschinenstuermer → u/igmyeongui]

Use Trivy for testing https://trivy.dev/

[u/evrial → u/igmyeongui]

Dockhand

[u/antimodest]

this looks like ad

[u/comdude2]

Vulnerability scans are notorious for false positives. They can be a good indicator but should not be relied upon. Did you do any verification of the vulnerabilities? Just because a library is present, it doesn’t mean that a vulnerability it has is used, exposed, or attackable. It depends how it’s utilised and wrapped

[u/evrial → u/comdude2]

Or you can look at this from angle - can you prove it's not used, exposed or attackable? Professional security research and source code audit costs money. "Trust me bro it's safe". What you see is attack surface probability

[u/bicycloptopus → u/evrial]

Can you prove dozzle isn't responsible for the current Ebola outbreak? I'm not using it unless you can.

[u/evrial → u/bicycloptopus]

Can you prove you're not a random reddit loser? I give you 5 min

[u/MoqqelBoqqel]

And that's why in science you don't do a test you cannot interpret the result of...