CRA Compliance for Docker Containers
Specific engineering requirements and security-by-design principles to make Docker Containers compliant with the Cyber Resilience Act.
Core Definition
Building Docker Containers under the Cyber Resilience Act requires strict adherence to secure-by-default and secure-by-design principles. Docker Containers are considered 'products with digital elements' or core components of them, meaning you are legally required to manage their vulnerabilities, patch them effectively for up to 5 years, and maintain complete component transparency via an SBOM.
Key Compliance Steps for Docker Containers
- Generate accurate SBOMs: Use tools specific to Docker Containers to generate CycloneDX or SPDX Software Bill of Materials in your CI/CD pipeline.
- Enforce 'Secure by Default': Ensure Docker Containers ship with the most restrictive permissions, no default passwords, and encryption enabled by default.
- Implement Over-The-Air (OTA) Updates: Guarantee that patches can be successfully deployed to Docker Containers seamlessly to fix critical vulnerabilities.
- Manage Third-Party Risk: Track open-source dependencies within your Docker Containers to prevent supply chain compromise.
How This Plays Out in Practice
Scan images with Trivy or Grype as part of the build pipeline, and pin base images to digest (not just tag) so the SBOM stays accurate between builds.
What to Watch For
Stale base images carrying known CVEs, and containers running as root by default, are the two most common container-specific findings.
Assess Your CRA Readiness
Evaluate your product's Cyber Resilience Act readiness using our interactive tool. Find exactly which of the 22 security requirements apply directly to Docker Containers.