# Official Keycloak docker image has many critical security issues

**URL:** https://forum.keycloak.org/t/official-keycloak-docker-image-has-many-critical-security-issues/6082
**Category:** Securing applications
**Created:** [November 23, 2020, 4:21pm UTC](https://forum.keycloak.org/t/official-keycloak-docker-image-has-many-critical-security-issues/6082 "2020-11-23T16:21:59Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![claytonpassos](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/claytonpassos/32/1733_2.png) [@claytonpassos](https://forum.keycloak.org/u/claytonpassos)
#### Post date: [November 23, 2020, 4:21pm UTC](https://forum.keycloak.org/t/official-keycloak-docker-image-has-many-critical-security-issues/6082/1 "2020-11-23T16:21:59Z")

</div>

Official Keycloak( 10.0.1 ~ 11.0.3) docker image has many critical security issues.  
How can I handle with this situation?  
Would I have make my own docker image?  
Do we have other secure images available?

I have a eight pages of security issues, below you can see the most critical for the first page

CVE-2019-2201, CVE-2019-14889, CVE-2019-14889, CVE-2019-18276, CVE-2019-12900, CVE-2018-20843, CVE-2018-16428 , CVE-2019-1010022, CVE-2019-9169, CVE-2019-1010022, CVE-2019-9169, CVE-2019-1010022, CVE-2019-9169, CVE-2019-1010022, CVE-2019-9169, CVE-2019-18224, CVE-2018-1000654, CVE-2020-8492

---

<div class="post-metadata">

### Author: ![jangaraj](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/jangaraj/32/5175_2.png) [@jangaraj](https://forum.keycloak.org/u/jangaraj)
#### Post date: [November 23, 2020, 8:28pm UTC](https://forum.keycloak.org/t/official-keycloak-docker-image-has-many-critical-security-issues/6082/2 "2020-11-23T20:28:49Z")

</div>

Official Keycloak Docker image is based on minimal Red Hat Universal Base Image. Red Hat do a lot on the security, probably you can find any listed issue to be addressed by Red Hat. Some of them may have status won’t do, some of them patched, but dumb security scanner doesn’t recognize security patches usually.

So if you really want to satisfy your security scanner, then you need to build your own image. And of course you need to scan&build image periodically. I would say good luck.  
Even with “the safest” Alpine image you may have still security issues detected (edge release may help sometimes).

---

<div class="post-metadata">

### Author: ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)
#### Post date: [November 24, 2020, 6:41am UTC](https://forum.keycloak.org/t/official-keycloak-docker-image-has-many-critical-security-issues/6082/3 "2020-11-24T06:41:04Z")

</div>

This is, as @jangaraj already mentioned, heavily dependent of your security scanner.

If you look at the official Docker repo of RH, [quay.io](http://quay.io), you’ll see that there are less current issues: [https://quay.io/repository/keycloak/keycloak?tab=tags](https://quay.io/repository/keycloak/keycloak?tab=tags)

Also our own Docker repo mentions just the one issue which [quay.io](http://quay.io) mentions.