Creating CI/build and run policies for container image labels / Dockerfile instructions

[patriciar]

We have been deploying custom build and run policies via Checkov (targeting Terraform resources, i.e.: VMs). We do this via the Governance pane in the Prisma Cloud "Cloud Security" component. These policies check usage of tags. Cool.

Now we're trying to create an equivalent set of policies for Container Images Labels. Specifically, we want to create guardrails and alerting around the usage of container images labels.

Anyone have an idea on how to create custom policies for this with Prisma Cloud? (either from CSPM/governance or the CWP/runtime compliance checks, the documentation and examples is not loads extensive and support seems to be missing at times).

Thoughts?

Prisma Cloud 

[JNeytchev]

Hi Patriciar,

If you would like to check for existence of labels in a Dockerfile at build time you can write a simple custom check, for example to check for org and purpose labels:

metadata:
  id: "MyLabelCheck"
  name: "Ensure org and purpose labels are present"
  category: "APPLICATION_SECURITY"
definition:
  and:
    - cond_type: attribute
      resource_types:
        - LABEL
      attribute: value
      operator: contains
      value: "purpose="
    - cond_type: attribute
      resource_types:
        - LABEL
      attribute: value
      operator: contains
      value: "org="

That will check against the LABEL directive in Dockerfile, for example

FROM node:alpine
LABEL org=Accounting purpose=Appserver
RUN useradd -m appuser
USER appuser
WORKDIR /usr/src/app
..etc..

Then you can tell checkov to load the additional check from the directory where you placed the yaml file

checkov [other paramereters] --framework dockerfile --external-checks-dir my_yaml_checks_dir/ --check MyLabelCheck 

Hope this helps