Package managers should not install recommended packages automatically in Dockerfiles.
When apt, apt-get, or aptitude install a package without the --no-install-recommends flag (or
--without-recommends for aptitude), the package manager also installs all packages listed as recommendations by the
requested package. Recommended packages are often not required for the container’s primary purpose, increase image size, and make the installed
dependency set harder to reason about. Installing only strictly required packages keeps images lean, reproducible, and easier to maintain.
Unnecessary packages may contain unidentified vulnerabilities or malicious code, expanding the attack surface of the container.
Larger images also have a direct financial impact: they consume more storage in container registries and increase data transfer costs when pulling images, both of which scale with the number of deployments.
FROM ubuntu:22.04 RUN apt install -y build-essential # Noncompliant RUN apt-get install -y build-essential # Noncompliant RUN aptitude install -y build-essential # Noncompliant
FROM ubuntu:22.04 RUN apt --no-install-recommends install -y build-essential RUN apt-get --no-install-recommends install -y build-essential RUN aptitude --without-recommends install -y build-essential