Why Don't CIS Benchmarks Exist for Alpine Docker Images?
Asked by
TechieNerd42
Hey everyone! I'm trying to enhance my environment to meet CIS level-1 and FedRamp compliance, and I'm focusing on hardening various Docker images like Ubuntu, RHEL, and Alpine. However, I've noticed that unlike the other distributions, Alpine doesn't seem to have any CIS benchmarks or specific profiles available for scanning Docker images. I've looked into the Official CIS website, AWS Inspector, OpenSCAP, and other tools, but none of them offer support for Alpine in this regard. Does anyone know why this is the case? Why is there a lack of Alpine hardening support? Thanks for your help!
Answers
Alpine isn't one of the major players in the Linux world, so there hasn’t been much demand for CIS benchmarks for it. However, you can manually secure your Alpine images by following best practices found here: https://wiki.alpinelinux.org/wiki/Securing_Alpine_Linux# and check out this GitHub repo for more info: https://github.com/ironpeakservices/iron-alpine. You might need to create a local secured image for your deployments.
Reply to this answer
If you still want to stick with Alpine, you can look into using the Docker CIS benchmarks as a guideline. The Dockle scanner is also a good option if you're interested in scanning your images.
Reply to this answer
I’d recommend using Distroless images based on Debian instead. They’re about the same size as Alpine or even smaller, but without the compatibility issues that can come with Alpine.
Reply to this answer
Most of these benchmarks were designed for traditional systems and don’t adapt well to containers. They typically focus on audit logging and SSH setup that don’t really apply at the container level. You could try tweaking the benchmarks for Ubuntu or RHEL, but honestly, it’s a hassle. Security auditors might still push for it, but that’s why Alpine lacks benchmarks. If you’re looking for scanning tools, Trivy can check against the Docker CIS standards. Also, Chainguard has made some SCAP content related to Alpine that might be useful.
Reply to this answer
CIS benchmarks can take a while to be released. If Alpine doesn’t have one yet, it’s probably best not to wait around for it. There are enterprise-ready images available now if you need them, like Echo, which meets the standards for Debian Linux CIS and general-purpose STIG.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions