sctechdev/docker-security-scanner

By sctechdev

•Updated almost 9 years ago

Self-Contained Scanning Utility currently only for TwistCLI but Nexus IQ + TwistCLI is planned

Image

3.8K

Overview Tags

sctechdev/docker-security-scanner repository overview

⁠Security Scanning Tools

Docker image which invokes security script using TwistCLI (Nexus coming soon)

⁠Prerequisites:

Codefresh Subscription (Dedicated Infrastructure) - https://codefresh.io/⁠

Twistlock Subscription - https://www.twistlock.com/⁠

⁠Documentation:

Twistlock CLI: https://twistlock.desk.com/customer/en/portal/articles/2875595-twistcli?b_id=16619⁠

Nexus IQ CLI: TBD

⁠Script Library

⁠twistlock.py

Executes TwistCLI to scan Docker image given.

⁠options

To use an ENVIRONMENT VARIABLE you need to add the variables to your Codefresh Pipeline and also to your codefresh.yaml.

Example codefresh.yml build is below with required ENVIRONMENT VARIABLES in place.

ENVIRONMENT VARIABLE	SCRIPT ARGUMENT	DEFAULT	TYPE	REQUIRED	DESCRIPTION
TL_CONSOLE_HOSTNAME	[ -C, --tl_console_hostname ]	null	string	Yes	hostname/ip
TL_CONSOLE_PORT	[ -P, --tl_console_port ]	null	string	Yes	port
TL_CONSOLE_USERNAME	[ -U, --tl_console_username ]	null	string	Yes	username
TL_CONSOLE_PASSWORD	[ -X, --tl_console_password ]	null	string	Yes	password
TL_ONLY	[ -Z, --tl_only ]	null	boolean	Yes	Twistlock Console Only (Required for now Nexus TBD)
TL_TLS_ENABLED	[ -T, --tl_tls_enabled ]	null	boolean	No	enable TLS
TL_HASH	[ -H, --tl_hash ]	[ sha1 ]	string	No	[ md5, sha1, sha256 ] hashing algorithm
TL_UPLOAD	[ -R, --tl_upload ]	null	boolean	No	( ignores all options below if set and only returns report url ) uploads report to Twistlock to be used later via Twistlock API
TL_DETAILS	[ -D, --tl_details ]	null	boolean	No	prints an itemized list of each vulnerability found by the scanner
TL_ONLY_FIXED	[ -O, --tl_only_fixed ]	null	boolean	No	reports just the vulnerabilites that have fixes available
TL_COMPLIANCE_THRESHOLD	[ -M, --tl_compliance_threshold ]	null	string	No	[ low, medium, high ] sets the the minimal severity compliance issue that returns a fail exit code
TL_VULNERABILITY_THRESHOLD	[ -V, --tl_vulnerability_threshold ]	null	string	No	[ low, medium, high, critical ] sets the minimal severity vulnerability that returns a fail exit code

⁠codefresh.yml

Codefresh Build Step to execute Twistlock scan. All ${{var}} variables must be put into Codefresh Build Parameters codefresh.yml

  buildimage:
    type: build
    title: Build Runtime Image
    dockerfile: Dockerfile
    image_name: # Image you're building/scanning [repository/image]
    tag: latest-cf-build-candidate

  nexus_iq_scan_build_stage:
    type: composition
    composition:
      version: '2'
      services:
        imagebuild:
          image: ${{buildimage}}
          command: sh -c "exit 0"
          labels:
            build.image.id: ${{CF_BUILD_ID}}
    composition_candidates:
      scan_service:
        image: sctechdev/docker-security-scanner
        environment:
          - TL_CONSOLE_HOSTNAME=${{TL_CONSOLE_HOSTNAME}}
          - TL_CONSOLE_PORT=${{TL_CONSOLE_PORT}}
          - TL_CONSOLE_USERNAME=${{TL_CONSOLE_USERNAME}}
          - TL_CONSOLE_PASSWORD=${{TL_CONSOLE_PASSWORD}}
          - TL_ONLY=${{TL_ONLY}}
        command: twistlock.py -i "$$(docker inspect $$(docker inspect $$(docker ps -aqf label=build.image.id=${{CF_BUILD_ID}}) -f {{.Config.Image}}) -f {{.Id}} | sed 's/sha256://g')"
        depends_on:
          - imagebuild
        volumes:
          - /var/run/docker.sock:/var/run/docker.sock
          - /var/lib/docker:/var/lib/docker

GitHub: https://github.com/SC-TechDev/docker-security-scanner⁠

Tag summary

Recent tags

Content type

Image

Digest

Size

211.7 MB

Last updated

almost 9 years ago

docker pull sctechdev/docker-security-scanner