catalog / docker.io/library/memcached

`docker.io/library/memcached`

validated pin current tags: 1.6

memcached — minimum Linux capabilities, derived by drop-test against the
default invocation. cap_drop:[ALL] with NO cap_add — zero-cap, prometheus's
sibling: the image runs as USER memcache (uid 11211) from the first
instruction (no root phase, no drop to perform), binds only the unprivileged
:11211, and persists nothing. All 14 Docker defaults derived removable with
the full set/get round-trip passing. See
criteria/docker.io/library/memcached.md.
filesystem: read_only:true, tmpfs:[]. memcached is an in-memory store and
writes nothing to disk — it runs correctly under a read-only rootfs with no
tmpfs. /tmp was drop-tested and is NOT required. Derived by drop-test.

Use it

services:
  memcached:
    image: docker.io/library/memcached:1.6
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]
    read_only: true

This profile has multiple dimensions and is applied as a unit. Dimensions can interact — a capability can be required only because of a sibling read-only/tmpfs recommendation — so where they do, the minimum was derived under the sibling dimension's context. See the criteria doc and each dimension's recorded invocation below before applying them separately.

Dimension: capabilities

cap_drop: ALL (no cap_add)

tool	`container-sec-derive 0.7.0`
observer	`drop-test`
validated image	`docker.io/library/memcached@sha256:dc561d52bb8a…`
validated date	2026-07-16
confidence	high
validated via	`drop-test`, `ci-smoke`
workload	`profiles/workloads/memcached.sh`
workload sha256	`eb6de7226165…`
ig version	`v0.51.0`

Drop-test evidence

Each candidate removed in turn, the container restarted, and the workload re-verified.

Removed	Verdict	Observed
`CHOWN`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`DAC_OVERRIDE`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`FSETID`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`FOWNER`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`MKNOD`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`NET_RAW`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`SETGID`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`SETUID`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`SETFCAP`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`SETPCAP`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`NET_BIND_SERVICE`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`SYS_CHROOT`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`KILL`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)
`AUDIT_WRITE`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)

Recorded invocation (run_config)

The minimum is valid for this invocation; a different user:, volume state, or entrypoint can change it.

security_opt	`no-new-privileges:true`

Workload script (profiles/workloads/memcached.sh)

#!/usr/bin/env bash
# Workload exerciser for the memcached reference image.
#
# A real set/get round-trip (STORED + the value read back), mirroring the
# official docker-library memcached-basics test, driven over the in-image bash
# /dev/tcp — the image ships bash but no client tool. docker exec inherits
# USER memcache (uid 11211), so the probe exercises nothing beyond what the
# service itself can do.
#
# Required env: MEMCACHEDCONTAINER (target container name or id).
set -euo pipefail

: "${MEMCACHEDCONTAINER:?MEMCACHEDCONTAINER must be set}"
C="${MEMCACHEDCONTAINER}"

deadline=$((SECONDS + 20))
until docker exec "$C" bash -c 'exec 3<>/dev/tcp/127.0.0.1/11211' 2>/dev/null; do
    (( SECONDS >= deadline )) && { echo "memcached never accepted a connection" >&2; exit 1; }
    sleep 1
done

out="$(docker exec "$C" bash -c '
  exec 3<>/dev/tcp/127.0.0.1/11211
  printf "set csd 0 0 5\r\nhello\r\n" >&3
  IFS=$'"'"'\r'"'"' read -r stored <&3
  printf "get csd\r\n" >&3
  IFS=$'"'"'\r'"'"' read -r hdr <&3; IFS=$'"'"'\r'"'"' read -r val <&3; IFS=$'"'"'\r'"'"' read -r end <&3
  printf "quit\r\n" >&3
  echo "$stored|$hdr|$val|$end"')"
if [ "$out" != "STORED|VALUE csd 0 5|hello|END" ]; then
    echo "set/get round-trip failed (got: $out)" >&2
    exit 1
fi

Dimension: filesystem

read_only: true, no tmpfs

tool	`container-sec-derive 0.7.0`
observer	`drop-test`
validated image	`docker.io/library/memcached@sha256:dc561d52bb8a…`
validated date	2026-07-16
confidence	high
validated via	`drop-test`, `ci-smoke`
workload	`profiles/workloads/memcached.sh`
workload sha256	`eb6de7226165…`
ig version	`v0.51.0`

Drop-test evidence

Each candidate removed in turn, the container restarted, and the workload re-verified.

Removed	Verdict	Observed
`/tmp`	removable	correct: set/get round-trip ok, memcached uid=11211 (non-root)

Workload script (profiles/workloads/memcached.sh)

#!/usr/bin/env bash
# Workload exerciser for the memcached reference image.
#
# A real set/get round-trip (STORED + the value read back), mirroring the
# official docker-library memcached-basics test, driven over the in-image bash
# /dev/tcp — the image ships bash but no client tool. docker exec inherits
# USER memcache (uid 11211), so the probe exercises nothing beyond what the
# service itself can do.
#
# Required env: MEMCACHEDCONTAINER (target container name or id).
set -euo pipefail

: "${MEMCACHEDCONTAINER:?MEMCACHEDCONTAINER must be set}"
C="${MEMCACHEDCONTAINER}"

deadline=$((SECONDS + 20))
until docker exec "$C" bash -c 'exec 3<>/dev/tcp/127.0.0.1/11211' 2>/dev/null; do
    (( SECONDS >= deadline )) && { echo "memcached never accepted a connection" >&2; exit 1; }
    sleep 1
done

out="$(docker exec "$C" bash -c '
  exec 3<>/dev/tcp/127.0.0.1/11211
  printf "set csd 0 0 5\r\nhello\r\n" >&3
  IFS=$'"'"'\r'"'"' read -r stored <&3
  printf "get csd\r\n" >&3
  IFS=$'"'"'\r'"'"' read -r hdr <&3; IFS=$'"'"'\r'"'"' read -r val <&3; IFS=$'"'"'\r'"'"' read -r end <&3
  printf "quit\r\n" >&3
  echo "$stored|$hdr|$val|$end"')"
if [ "$out" != "STORED|VALUE csd 0 5|hello|END" ]; then
    echo "set/get round-trip failed (got: $out)" >&2
    exit 1
fi

Evidence & provenance

Validation criteria — per-image scenarios and pass criteria
Profile source in the repository
Version history — every previously published pin, with the full profile as validated against it

Raw profile YAML

# memcached — minimum Linux capabilities, derived by drop-test against the
# default invocation. cap_drop:[ALL] with NO cap_add — zero-cap, prometheus's
# sibling: the image runs as USER memcache (uid 11211) from the first
# instruction (no root phase, no drop to perform), binds only the unprivileged
# :11211, and persists nothing. All 14 Docker defaults derived removable with
# the full set/get round-trip passing. See
# criteria/docker.io/library/memcached.md.
# filesystem: read_only:true, tmpfs:[]. memcached is an in-memory store and
# writes nothing to disk — it runs correctly under a read-only rootfs with no
# tmpfs. /tmp was drop-tested and is NOT required. Derived by drop-test.
#
schema_version: "1.5"
image: docker.io/library/memcached
reference_url: https://tmatens.github.io/container-security-profiles/profiles/docker.io/library/memcached.html
applies_to:
  tags: ["1.6"]
status: validated
dimensions:
  capabilities:
    cap_drop: [ALL]
    cap_add: []
    derivation:
      tool: container-sec-derive
      tool_version: "0.7.0"
      sidecar_schema_version: "1.5"
      observer: drop-test
      validated_image: docker.io/library/memcached@sha256:dc561d52bb8ad3c038867123ed2dc8357c4c128f047cdbd526cd65cf39408cbd
      validated_date: "2026-07-16"
      duration_seconds: 120
      confidence: high
      workload: profiles/workloads/memcached.sh
      workload_sha256: "eb6de722616516fe8a863186e2ffca194309fb65412f12fefc7f5938aa12ef19"
      validated_via: [drop-test, ci-smoke]
      observation_backend:
        ig_version: v0.51.0
        gadgets: []
      run_config:
        user: ""
        command: []
        entrypoint: ""
        network: ""
        pid: ""
        devices: []
        security_opt: ["no-new-privileges:true"]
        mounts: []
        env: []
      drop_test:
        checks:
          - {removed: CHOWN, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: DAC_OVERRIDE, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: FSETID, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: FOWNER, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: MKNOD, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: NET_RAW, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: SETGID, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: SETUID, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: SETFCAP, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: SETPCAP, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: NET_BIND_SERVICE, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: SYS_CHROOT, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: KILL, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
          - {removed: AUDIT_WRITE, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}
  filesystem:
    read_only: true
    tmpfs: []
    derivation:
      tool: container-sec-derive
      tool_version: "0.7.0"
      sidecar_schema_version: "1.5"
      observer: drop-test
      validated_image: docker.io/library/memcached@sha256:dc561d52bb8ad3c038867123ed2dc8357c4c128f047cdbd526cd65cf39408cbd
      validated_date: "2026-07-16"
      duration_seconds: 2
      confidence: high
      workload: profiles/workloads/memcached.sh
      workload_sha256: "eb6de722616516fe8a863186e2ffca194309fb65412f12fefc7f5938aa12ef19"
      validated_via: [drop-test, ci-smoke]
      observation_backend:
        ig_version: v0.51.0
        gadgets: []
      run_config:
        user: ""
        command: []
        entrypoint: ""
        network: ""
        pid: ""
        devices: []
        security_opt: []
        mounts: []
        env: []
      drop_test:
        checks:
          - {removed: /tmp, required: false, observed: "correct: set/get round-trip ok, memcached uid=11211 (non-root)"}