The Carbonetes/broker client service is use to Analyze your image for Bill of Materials and even finding Secrets. Carbonetes/broker also able to scan your images for vulnerability without sending your image in our cloud It only requires the result of The Bill of Materials and send via secured websocket.
Carbonetes Broker can also Analyze your Software Composition Analysis and find malware threat in your images by sending your image in our server for analysis.
REGISTRY_URI - Your On-Premise registry server (ex. quay.carbonetes.com)REGISTRY_USERNAME - Your registry usernameREGISTRY_PASSWORD - Your registry passwordYou can run the Docker container by providing the relevant configuration:
docker run \
-p 8080:8080 \
-e REGISTRY_URI=private.repo.com \
-e REGISTRY_USERNAME=registry-username\
-e REGISTRY_PASSWORD=secret-password \
-v /var/run/docker.sock:/var/run/docker.sock \
carbonetes/broker
Another option is to use your own docker-compose.yml
docker-compose up -d
version: '2.2'
services:
carbo-agent:
image: carbonetes/broker
environment:
- REGISTRY_URI=quay.carbonetes.com
- REGISTRY_USERNAME=username
- REGISTRY_PASSWORD=password
ports:
- 8080:8080
volumes:
- /var/run/docker.sock:/var/run/docker.sock
This analysis endpoints required open port 443 for wss://ws-broker.carbonetes.com to send your image into our server for scanning.
Example: http://localhost:8080/api/v1/bom/analysis?image=openjdk:latest
Response body:
{
"artifacts": [],
"source": {
"type": "image",
"target": {
"userInput": "busybox",
"imageID": "sha256:018c9d7b792b4be80095d957533667279843acf9a46c973067c8d1dff31ea8b4",
"manifestDigest": "sha256:d2d41668193b0d71c73b0319204af8e951d952bc49528a55e09b301765ae7a9c",
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
"tags": [
"busybox:latest"
],
"imageSize": 1223534,
"scope": "Squashed",
"layers": [
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"digest": "sha256:514c3a3e64d4ebf15f482c9e8909d130bcd53bcc452f0225b0a04744de7b8c43",
"size": 1223534
}
],
"manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iL=",
"config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJIb3N0bmFtZSI6IiIsIkRvbWFpbm5hbWUiOiIiLCJVc2VyIjoiIiwiQXR0YWNoU3RkaW4iOmZhbHNlLCJBdHRhY2hTdGRvdXQiOmZhbHNlLCJBdHRhY"
}
},
"distro": {
"name": "busybox",
"version": "1.32.0",
"idLike": ""
}
}
Example: http://localhost:8080/api/v1/secrets/analysis?image=openjdk:latest
Required request body
fileNameRegex - Regex for filename containing a secretscontentRegexNames - Regex inside the file contentRequest body:
{
"fileNameRegex" : "AWS",
"contentRegexNames" : ["AWS_KEY"]
}
Response body:
{
"fileNameRegex": "AWS",
"totalFileMatch": 0,
"status": "analyzed",
"secrets": null
}
Example: http://localhost:8080/api/v1/vulnerability/analysis?image=openjdk:latest
Response body:
{
"matches": [{
"vulnerability": {
"id": "CVE-2005-2541",
"dataSource": "https://security-tracker.debian.org/tracker/CVE-2005-2541",
"namespace": "debian:10",
"severity": "Negligible",
"urls": [
"https://security-tracker.debian.org/tracker/CVE-2005-2541"
],
"cvss": [],
"fix": {
"versions": [],
"state": "not-fixed"
},
"advisories": []
},
"relatedVulnerabilities": [
{
"id": "CVE-2005-2541",
"dataSource": "https://nvd.nist.gov/vuln/detail/CVE-2005-2541",
"namespace": "nvd",
"severity": "High",
"urls": [
"http://marc.info/?l=bugtraq&m=112327628230258&2",
"https://lists.apache.org/thread.html/rc713534b10f9daeee2e099023"
],
"description": "Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.",
"cvss": [
{
"version": "2.0",
"vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"metrics": {
"baseScore": 10,
"exploitabilityScore": 10,
"impactScore": 10
},
"vendorMetadata": {}
}
]
}
],
"matchDetails": [
{
"matcher": "dpkg-matcher",
"searchedBy": {
"distro": {
"type": "debian",
"version": "10"
},
"namespace": "debian:10"
},
"found": {
"versionConstraint": "none (deb)"
}
}
],
"artifact": {
"name": "tar",
"version": "1.30+dfsg-6",
"type": "deb",
"locations": [
{
"path": "/var/lib/dpkg/status",
"layerID": "sha256:ea5fd90d1e58fbcd9b68a0cd7daccf8426ac7b0d6c941a877de20b4d234d5d5d"
},
{
"path": "/var/lib/dpkg/info/tar.md5sums",
"layerID": "sha256:02c055ef67f5904019f43a41ea5f099996d8e7633749b6e606c400526b2c4b33"
},
{
"path": "/usr/share/doc/tar/copyright",
"layerID": "sha256:02c055ef67f5904019f43a41ea5f099996d8e7633749b6e606c400526b2c4b33"
}
],
"language": "",
"licenses": [
"GPL-2",
"GPL-3"
],
"cpes": [
"cpe:2.3:a:tar:tar:1.30\\+dfsg-6:*:*:*:*:*:*:*",
"cpe:2.3:a:*:tar:1.30\\+dfsg-6:*:*:*:*:*:*:*"
],
"purl": "pkg:deb/debian/[email protected]+dfsg-6?arch=amd64",
"metadata": {
"Source": ""
}
}
},
{
"vulnerability": {
"id": "CVE-2007-5686",
"dataSource": "https://security-tracker.debian.org/tracker/CVE-2007-5686",
"namespace": "debian:10",
"severity": "Negligible",
"urls": [
"https://security-tracker.debian.org/tracker/CVE-2007-5686"
],
"cvss": [],
"fix": {
"versions": [],
"state": "not-fixed"
},
"advisories": []
},
"relatedVulnerabilities": [],
"matchDetails": [
{
"matcher": "dpkg-matcher",
"searchedBy": {
"distro": {
"type": "debian",
"version": "10"
},
"namespace": "debian:10"
},
"found": {
"versionConstraint": "none (deb)"
}
}
],
"artifact": {
"name": "login",
"version": "1:4.5-1.1",
"type": "deb",
"locations": [
{
"path": "/var/lib/dpkg/status",
"layerID": "sha256:ea5fd90d1e58fbcd9b68a0cd7daccf8426ac7b0d6c941a877de20b4d234d5d5d"
},
{
"path": "/var/lib/dpkg/info/login.md5sums",
"layerID": "sha256:02c055ef67f5904019f43a41ea5f099996d8e7633749b6e606c400526b2c4b33"
},
{
"path": "/var/lib/dpkg/info/login.conffiles",
"layerID": "sha256:02c055ef67f5904019f43a41ea5f099996d8e7633749b6e606c400526b2c4b33"
},
{
"path": "/usr/share/doc/login/copyright",
"layerID": "sha256:02c055ef67f5904019f43a41ea5f099996d8e7633749b6e606c400526b2c4b33"
}
],
"language": "",
"licenses": [
"GPL-2"
],
"cpes": [
"cpe:2.3:a:login:login:1:4.5-1.1:*:*:*:*:*:*",
"cpe:2.3:a:*:login:1:4.5-1.1:*:*:*:*:*:*"
],
"purl": "pkg:deb/debian/login@1:4.5-1.1?arch=amd64",
"metadata": {
"Source": "shadow"
}
}
}],
"source": {
"type": "image",
"target": {
"userInput": "quay.carbonetes.com/quayusername/busybox",
"imageID": "sha256:d3cd072556c21c1f1940bd536675b97d7d419a2287d6bb3bd5044ea7466db788",
"manifestDigest": "sha256:a2751aaa336c4856bfb960ae5397b7b3b547ce65ea52b1265d43b6e995b0826f",
"mediaType": "application/vnd.docker.distribution.manifest.v2+json",
"tags": [
"quay.carbonetes.com/quayusername/busybox:latest"
],
"imageSize": 1235829,
"layers": [
{
"mediaType": "application/vnd.docker.image.rootfs.diff.tar.gzip",
"digest": "sha256:d0d0905d7be4eff6a63efe4a38647a679de1e024101f67db4fe4b5736c1e7f48",
"size": 1235829
}
],
"manifest": "eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjpIm1lZ",
"config": "eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJIb3N0bmFtZSI6IiIsIkRvbWFpbm5hbWUiOiIiLCJVc2VyIjoiIiwiQXR0YWNoU3RkaW4iOmZhbHNlLCJBdHRhY2hT",
"repoDigests": [
"quay.carbonetes.com/quayusername/busybox@sha256:f3cfc9d0dbf931d3db4685ec659b7ac68e2a578219da4aae65427886e649b06b"
]
}
},
"distro": {
"name": "busybox",
"version": "1.33.1",
"idLike": ""
}
}
}
Example: http://localhost:8080/api/v1/malware/analysis?image=openjdk:latest
Response body:
{
"success": true,
"data": {
"result": [
{
"name": "admin_busybox_24168732880643.tar",
"is_infected": false,
"viruses": []
}
]
}
}
Example: http://localhost:8080/api/v1/sca/analysis?image=openjdk:latest
{
"totalDependency": 398,
"vulnerableDependency": 89,
"vulnerabilityFound": 912,
"vulnerabilitySuppress": null,
"critical": 52,
"high": 188,
"medium": 645,
"low": 27,
"unknown": 0,
"dependencies": [
{
"dependencyId": null,
"isVirtual": "false",
"fileName": "carbonetes_private_jenkins_56655443286743.tar: 17bb45ebda90540d3d9c9cc0585f4fa0f07049f3d4dac178cf28a7720f6d8f59.tar: jenkins.war",
"filePath": "carbonetes_private_jenkins_56655443286743.tar/17bb45ebda90540d3d9c9cc0585f4fa0f07049f3d4dac178cf28a7720f6d8f59.tar/usr/share/jenkins/jenkins.war",
"md5": "7718ebbf1d8e98f629a3d0f13287c5ca",
"sha1": "e62d9ed7eb3d29b08719e639c959cd328776ba50",
"sha256": "2d71b8f87c8417f9303a73d52901a59678ee6c0eefcf7325efed6035ff39372a",
"description": null,
"license": null,
"vulnCount": 0,
"evidenceCollected": [
{
"dependencyEvidenceCollectedId": null,
"evidenceType": "vendor",
"confidence": "HIGH",
"source": "file",
"name": "name",
"value": "jenkins"
},
{
"dependencyEvidenceCollectedId": null,
"evidenceType": "product",
"confidence": "HIGH",
"source": "file",
"name": "name",
"value": "jenkins"
},
{
"dependencyEvidenceCollectedId": null,
"evidenceType": "version",
"confidence": "MEDIUM",
"source": "Manifest",
"name": "hudson-version",
"value": "1.395"
},
{
"dependencyEvidenceCollectedId": null,
"evidenceType": "version",
"confidence": "MEDIUM",
"source": "Manifest",
"name": "jenkins-version",
"value": "2.60.3"
},
{
"dependencyEvidenceCollectedId": null,
"evidenceType": "version",
"confidence": "HIGH",
"source": "Manifest",
"name": "Implementation-Version",
"value": "2.60.3"
}
],
}
]
}
Content type
Image
Digest
Size
256.1 MB
Last updated
about 5 years ago
docker pull carbonetes/broker