meterian/cli repository overview

⁠The Meterian Client, dockerized

Scan for vulnerabilities in your project using the Meterian Client packaged as a Docker container. You can do this without having to install any dependencies needed for the Meterian Scanner client to run, and the scan happens in an isolated environment, inside the Docker container. This docker image contains the java runtime plus all the required tools for the full range of platforms supported by the Meterian platform.

⁠Basic usage

Firstly, install Docker⁠ on the host machine, and please ensure that you can use it as non-root user.

The easiest way to use the dockerized Meterian Client is via the script meterian-docker⁠ (download⁠). It accepts all the standard parameters mentioned in the Meterian PDF manual⁠ exactly in the same way, but it cannot be used in interactive mode, therefore you will need to provide it with a valid token⁠ using the environment variable METERIAN_API_TOKEN. We suggest you populate such variable in your startup script.

Assuming you put the script in your path, just move in the folder of your project and type:

    meterian-docker

Alternatively you can set the environment variable METERIAN_WORKDIR with the path to your project folder and run the convenience script:

    export METERIAN_WORKDIR=/project-folder
    meterian-docker

Everything will work exactly like a normal invocation of the client. Please note that, by default, the script binds into the container the standard library cache folders used by the package managers (see the table below for the ones that we bind), so that the execution is as fast as it was running on your machine. If you really want you can avoid this by adding --unbound to your command line arguments.

The meterian-docker script also binds the ~/.netrc⁠ file in order to allow Go to authenticate and properly resolve eventual private repositories hosting modules you may be using in your project. If you do not have one on your machine already preparing one is fairly easy.

Depending on what code hosting site your private modules are hosted the file contents could look as the the following

machine github.com login <you-username> password <you-github-access-token>
machine bitbucket.org login <you-username> password <your-bitbucket-application-password>
machine api.bitbucket.org login <you-username> password <your-bitbucket-application-password>
machine gitlab.com login <you-username> password <your-gitlab-access-token>
...

As far as Go private modules the above setup is only one part of the pre-required steps. Starting from version 1.13 you also need to set the GOPRIVATE environment variable⁠ for private repositories to be properly resolved.

export GOPRIVATE="github.com/YourOrganisation,bitbucket.org/YourOrgName"

The above GOPRIVATE environment variable causes the Go command to treat as private any module with a path prefix matching the provided pattern (e.g. github.com/YourOrgName/xyzzy or bitbucket.org/YourOrgName/xyzzy) therefore to use the proxy or checksum database.

In alternative to the .netrc file approach, you can use SSH keys to allow Go to download private modules. Read more about it in the Advanced Usage section below.

⁠Supported languages

At the moment this containerized version supports these platforms:

• Java/Maven
• Java/Gradle
• .NET
• PHP
• Ruby
• NodeJs
• Python
• Golang
• Swift / Objective-C
• Rust
• Elixir
• Perl
• C/C++
• R

Please note that we also provide platform-specific images⁠ should you not wish to use the full version.

⁠Advanced usage

If you want to run docker explicitly you can, of course, do that as well. The basic way to run the container is this one:

    PWD=your-project-folder
    docker run -it --rm \
              --volume ${PWD}:/workspace \
              --env METERIAN_API_TOKEN=your-token-here \
              meterian/cli 

Please note that in this situation the local caches used by the tools will not be bound. We suggest you bind those folders, and the easiest way to do that is to use the provided meterian-docker⁠ script.

However, if you feel adventurous, you can of course do it yourself. For example, to bind the java caches in a maven build:

    PWD=your-project-folder
    docker run -it --rm \
              --volume ${PWD}:/workspace \
              --env METERIAN_API_TOKEN=your-token-here \
              --mount type=bind,source=${HOME}/.m2,target=/home/meterian/.m2 \
              meterian/cli 

In some cases (i.e dotnet) you will need to specify the UID and the GID in order for the system to work, reaching something like this:

    PWD=your-project-folder
    HOST_UID=`id -u`
    HOST_GID=`id -g`
    docker run -it --rm \
              --volume ${PWD}:/workspace \
              --env METERIAN_API_TOKEN=your-token-here \
              --mount type=bind,source=${HOME}/.dotnet,target=/home/meterian/.dotnet \
              --mount type=bind,source=${HOME}/.nuget,target=/home/meterian/.nuget \
              --env HOST_UID=${HOST_UID} \
              --env HOST_UID=${HOST_GID} \
              meterian/cli 

The script is run by the meterian user in the container, with their home at /home/meterian. You can see how this works in the source of the meterian-docker⁠ script. Please get in touch if you have any issue using the support channels⁠.

⁠Disable the client auto-update

The dockerized client is built with the latest version of the client available at build time which then remains unchanged within the relative image. To ensure that users are always using the most up to date version of the Meterian client, this is auto-updated by default when a more recent version is detected. To disable this behaviour you can use the CLIENT_AUTO_UPDATE environment variable

    export CLIENT_AUTO_UPDATE=false

⁠Binding .ssh and .gitconfig to allow Go to download private modules

You can allow Go to download non-public code by binding ~/.ssh and your Git configuration into the Dockerized client container. Here follows an example snippet, read further on this practice here⁠.

    git config --global url.ssh://[email protected]/.insteadOf https://github.com/
    docker run --rm \ 
               --volume ${PWD}:/workspace \
               -e METERIAN_API_TOKEN=$METERIAN_API_TOKEN \
               -e GOPRIVATE=$GOPRIVATE \
               --volume ${HOME}/.ssh:/home/meterian/.ssh \
               --volume ${HOME}/.gitconfig:/home/meterian/.gitconfig \
               meterian/cli

Note: as mentioned above, starting from Go version 1.13 you need to set the GOPRIVATE environment variable⁠ for this to work, hence why it is also being exposed to the container.

⁠Linux users

You can ensure that you can use Docker as non-root user by running this command:

    sudo setfacl --modify user:<user name or ID>:rw /var/run/docker.sock

⁠Documentation:

https://github.com/MeterianHQ/meterian-scanner-docker#meterian-scanner-docker-container⁠
https://www.meterian.io/the_client.html⁠