ISSUE-101HighCI/CD Container Images

Untrusted image source

Control:CTRL-101Container images must come from authorized sources

📋 What is this?

The origin of a container image you are using to run your CI/CD is not trusted, posing a security risk.

⚠️ Impact

Untrusted image sources can introduce malicious code into your pipeline. For instance, a malicious image can steal your API tokens, your source code, and even alter it.

🔧 How to fix

Replace the container image with an image coming from a source declared as trusted in your Policy controls.

✗ BeforeImages from unknown registries could be compromised.

# .gitlab-ci.yml: ❌ Images from untrusted registries
security-scan:
  image: untrusted-registry.example.com/scanner:2.0
  script:
    - scan --project .

sast:
  image: attacker-registry.example.com/malicious/sast:latest
  script:
    - sast-scan .

✓ AfterOnly images from trusted registries should be used.

# .gitlab-ci.yml: ✅ Images from authorized registries
security-scan:
  image: registry.gitlab.com/security-products/secrets:7
  script:
    - scan --project .

sast:
  image: $CI_REGISTRY_IMAGE/custom-sast:1.2.0
  script:
    - sast-scan .

💡 Tips

Enable trustDockerHubOfficialImages: true to allow official Docker Hub images (e.g., python, node).
Use wildcard patterns in trustedUrls (e.g., gcr.io/your-org/*).
Consider setting up a private registry mirror for external images.

⚙️ Configure this control

On the Plumber Platform: open the Policies page and set control CTRL-101 on the policy that governs the project.

With the CLI alone: set it in your configuration file. Every field and default is in the controls configuration reference, CTRL-101.

📋 What is this?

⚠️ Impact

🔧 How to fix

💡 Tips

⚙️ Configure this control

🔗 Related issues