Securing Docker Images on OCI — OCIR, Docker Scout, and OCI Vault

# Scan a local image
docker scout cves my-api:latest

# Quick view — just critical and high severity
docker scout cves my-api:latest --only-severity critical,high

# Compare two image versions
docker scout compare my-api:v2 --to my-api:v1

# Get remediation recommendations
docker scout recommendations my-api:latest

Recommended fixes:
  Base image: golang:1.22-alpine → golang:1.22.4-alpine
  Fixes: CVE-2024-24790, CVE-2024-24789

  Base image: alpine:3.19 → alpine:3.20
  Fixes: 3 vulnerabilities

# .github/workflows/security.yml
name: Container Security
on:
  push:
    branches: [main]
  pull_request:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t my-api:${{ github.sha }} .

      - name: Docker Scout scan
        uses: docker/scout-action@v1
        with:
          command: cves
          image: my-api:${{ github.sha }}
          only-severities: critical,high
          exit-code: true  # Fail the build if critical/high CVEs found

      - name: Docker Scout recommendations
        if: always()
        uses: docker/scout-action@v1
        with:
          command: recommendations
          image: my-api:${{ github.sha }}

# Create a repository with scanning enabled
oci artifacts container repository create \
  --compartment-id $COMPARTMENT_ID \
  --display-name "production-api" \
  --is-immutable true \
  --readme-enabled true

# Tag and push
docker tag my-api:v1.2.3 iad.ocir.io/$TENANCY/production-api:v1.2.3
docker push iad.ocir.io/$TENANCY/production-api:v1.2.3

# Trigger a scan (or it runs automatically)
oci vulnerability-scanning container scan create \
  --compartment-id $COMPARTMENT_ID \
  --image-id <image-ocid>

# Check scan results
oci vulnerability-scanning container scan result list \
  --compartment-id $COMPARTMENT_ID \
  --image-id <image-ocid>

# Terraform — scan policy
resource "oci_vulnerability_scanning_container_scan_recipe" "strict" {
  compartment_id = var.compartment_id
  display_name   = "strict-scan-recipe"

  scan_settings {
    scan_level = "STANDARD"
  }
}

resource "oci_vulnerability_scanning_container_scan_target" "production" {
  compartment_id            = var.compartment_id
  container_scan_recipe_id  = oci_vulnerability_scanning_container_scan_recipe.strict.id
  display_name              = "production-registry-scan"

  target_registry {
    compartment_id = var.compartment_id
    type           = "OCIR"
    repositories   = ["production-api"]
  }
}

# WRONG — secrets baked into the image
ENV DATABASE_PASSWORD=hunter2
ENV API_KEY=sk-abc123

# WRONG — secrets in compose file committed to git
environment:
  - DATABASE_PASSWORD=hunter2

# Create a vault
oci kms management vault create \
  --compartment-id $COMPARTMENT_ID \
  --display-name "docker-secrets-vault" \
  --vault-type DEFAULT

# Create a master encryption key
oci kms management key create \
  --compartment-id $COMPARTMENT_ID \
  --display-name "docker-secrets-key" \
  --key-shape '{"algorithm": "AES", "length": 32}' \
  --endpoint $VAULT_MGMT_ENDPOINT

# Store a secret
echo -n "my-database-password" | base64 | \
oci vault secret create-base64 \
  --compartment-id $COMPARTMENT_ID \
  --vault-id $VAULT_ID \
  --key-id $KEY_ID \
  --secret-name "prod-db-password" \
  --secret-content-content "$(cat -)"

#!/bin/sh
# entrypoint.sh — fetch secrets from OCI Vault before starting the app

# Using instance principal authentication (no credentials needed)
export DATABASE_PASSWORD=$(oci secrets secret-bundle get-secret-bundle-by-name \
  --vault-id $VAULT_ID \
  --secret-name "prod-db-password" \
  --stage CURRENT \
  --query 'data."secret-bundle-content".content' \
  --raw-output | base64 -d)

export API_KEY=$(oci secrets secret-bundle get-secret-bundle-by-name \
  --vault-id $VAULT_ID \
  --secret-name "prod-api-key" \
  --stage CURRENT \
  --query 'data."secret-bundle-content".content' \
  --raw-output | base64 -d)

# Start the application
exec /server

FROM gcr.io/distroless/static-debian12:nonroot
COPY --from=builder /app/server /server
COPY entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: app-secrets
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: oci-vault
    kind: ClusterSecretStore
  target:
    name: app-secrets
  data:
    - secretKey: DATABASE_PASSWORD
      remoteRef:
        key: "prod-db-password"
    - secretKey: API_KEY
      remoteRef:
        key: "prod-api-key"

# 1. Build
docker build -t my-api:v1.2.3 .

# 2. Scan locally (fail fast)
docker scout cves my-api:v1.2.3 --only-severity critical,high --exit-code

# 3. Push to OCIR (triggers registry scan)
docker tag my-api:v1.2.3 iad.ocir.io/$TENANCY/production-api:v1.2.3
docker push iad.ocir.io/$TENANCY/production-api:v1.2.3

# 4. Deploy (secrets pulled from Vault at runtime)
oci container-instances container-instance create \
  --containers '[{
    "imageUrl": "iad.ocir.io/'$TENANCY'/production-api:v1.2.3",
    "environmentVariables": {
      "VAULT_ID": "'$VAULT_ID'"
    }
  }]' \
  ...