4.3 Do not install unnecessary packages in the container


Containers tend to be minimal and slim down versions of the Operating System. Do not install anything that does not justify the purpose of container.


Bloating containers with unnecessary software could possibly increase the attack surface of the container. This also voids the concept of minimal and slim down versions of container images. Hence, do not install anything else apart from what is truly needed for the purpose of the container.


At the outset, do not install anything on the container that does not justify the purpose. If the image had some packages that your container does not use, uninstall them.

Consider using a minimal base image rather than the standard Redhat/Centos/Debian images if you can. Some of the options include BusyBox and Alpine.

Not only does this trim your image size from >150Mb to ~20 Mb, there are also fewer tools and paths to escalate privileges. You can even remove the package installer as a final hardening measure for leaf/production containers.



Default Value:

Not Applicable.

See Also


Item Details


References: 800-53|CM-7

Plugin: Unix

Control ID: 5bd67fa79c697ea39f151c0d468c56b36e8754b6d8d80985342fbf40de9b091e