Test 4.6 does not always output affected images

[scenthound]

docker-bench-security/tests/4_container_images.sh

Lines 138 to 142 in 93c619f

	imgName=$(docker inspect --format='{{.RepoTags}}' "$img" 2>/dev/null)
	if ! [ "$imgName" = '[]' ]; then
	warn " * No Healthcheck found: $imgName"
	no_health_images="$no_health_images $imgName"
	fi

The 4.6 check is supposed to display, as a list, all images that are discrepant. However, this check is based on the inclusion of a repotag field which some images may not have.

[konstruktoid]

Hi @scenthound, but in which case doesn't an image have a RepoTags field?
According to https://docs.docker.com/engine/api/v1.40/#operation/ImageList it's an required value.

[scenthound]

Hi @konstruktoid - The inspect command shows RepoTags are not required (https://docs.docker.com/engine/api/v1.40/#operation/ImageInspect)

To be more specific, images that do not have Healthcheck enabled and are correctly failed - flagging the test as a WARN. However, the subsequent code flagged above only reports the image (in console and the resultant json) if the array return by RepoTags is not empty. It's possible to have failed images that do not have associated RepoTags. This could "hide" the fact that there are more discrepant images than are actually being reported.

[konstruktoid]

I don't think can create an image without an RepoTag with the common tools, but I can add an fallback that just prints the$img if imgName= is empty.

[konstruktoid]

I believe this is fixed with #451

[scenthound]

Verified. Output looks much better now. Thanks @konstruktoid !