computablefacts/cve-search repository overview

⁠Docker for CVE Search

We create this repository⁠ to build a stand-alone Docker image that contains CVE Search⁠. We want to start a container and access to the CVE Search API as quick as possible.

So our Docker images contain the MongoDB server and database and the Redis server and database.

⁠Usage

⁠From Docker Hub

The simpliest way to start CVE Search on a Docker container is to use the images we generate and publish on Docker Hub⁠.

You can use the Docker Compose file to test them. You will need to install docker-compose⁠ in order to perform this option.

Simply clone the repo, move into the root of the cloned repo and run the command:

docker-compose -f docker-compose.fromDockerHub.yml up

This will download the latest image and start it. The latest image contains CVE Search from the master branch and an initiated database. Each time the container starts it will update the database. It tooks a couple of minutes (10 minutes maximum).

The CVE Search instance should be available under https://localhost:8443⁠

The container contains a cron that update the CVE Search database every 2 hours.

After testing you could remove the container and the volume that contains the database with the command:

docker-compose -f docker-compose.fromDockerHub.yml down -v

⁠Locally

In the root of this repo there is a docker-compose.yml file that can be used to build and run the required container for CVE Search.

You will need to install docker-compose⁠ in order to perform this option.

Simply clone the repo, move into the root of the cloned repo and run the command:

docker-compose up 

Be patient: first start will initialise the database and it takes about 1 hour (at the time of writing, 2022, with a 9th generation core i7).

The cve_search instance should be available under https://localhost:8443⁠

Your can change the build arguments into the docker-compose.yml file to tune the image you produce. See below for a description of the different arguments.

After testing you could remove the container and the volume that contains the database with the command:

docker-compose down -v

⁠Different images

⁠Images we produce

We produce several images, push them to Docker Hub and tag them as describe below:

Images that contains only CVE Search and no database cost about 300MB. Adding the suffix -withdb add about 1400MB, they contain a database with CVE from 2002. Adding the suffix -withdb-startyear2020 add only about 700MB because the database contains CVE from 2020.

If you choose the tag 4.2.1, the image is lighter (about 270MB) but the container will initialise the database at the first start and it takes about 1 hour.

If you choose the tag 4.2.1-withdb, the image is heavier (about 1.66GB) but the container will just update the database at the first start and it takes less than 10 minutes.

Between this 2 options, if you need only the most recent CVE, you can choose the tag 4.2.1-withdb-startyear2020, the image is about 925MB and the container will just update the database at the first start and it takes less than 10 minutes.

⁠Produce your own image

The Dockerfile accept several build arguments to tune the produced image to feed your needs.

For example, an image without the database and that will contains CVE starting 2015:

docker build -t cve-search:my-settings --build-arg WITH_DB=false --build-arg CVE_START_YEAR=2015 .

Or, an image from a fork of the CVE Search repo:

docker build -t cve-search:my-settings --build-arg REPO=my-name/cve-search .

You can then push your custom image to Docker Hub or to your private repository.

docker push cve-search:my-settings

⁠Development

This repo is mainly inspire by the docker-cve-search GitHub repo from ttimasdf⁠ from which we took the idea of having a single docker-entrypoint script that permit to launch various operations and the idea of having images that contains or not the database.

We've been also inspired by the official CVE Search Docker repository⁠ from which we took the idea of copying CVE Search from its repository by cloning a specific branch or tag.

And, finally, we use the CVE Search repository⁠ of course.

Thanks for all these good works.