Skip to content

Commit 0fac090

Browse files
manuelbcdmanuelbcd
authored
GitLab example for the new scan engine (#23)
* Add new scan pipeline for GitLab and reorganize folders * Documentation * Fix documentation (last) * Update index.md
1 parent 38b0297 commit 0fac090

File tree

9 files changed

+105
-3
lines changed

9 files changed

+105
-3
lines changed

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,3 @@
11
docs/_site/**
2+
3+
.DS_Store

‎docs/index.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ In this [repository](https://github.com/sysdiglabs/secure-inline-scan-examples/)
136136
* [Build and scan](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/jenkins/jenkins-build-and-scan)
137137
* [Build, push and scan from repository](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/jenkins/jenkins-build-push-scan-from-repo)
138138
* [Build, push and scan using Openshift internal registry](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/jenkins/jenkins-openshift-internal-registry)
139-
* [Gitlab](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/gitlab)
139+
* GitLab with the [new scan engine](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/gitlab/new-scan-engine), or using the [legacy engine](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/gitlab/old-scan-engine)
140140
* [GitHub](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/github)
141141
* [Tekton](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/tekton)
142142
* [Tekton alpha API](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/tekton/alpha)

‎gitlab/new-scan-engine/.gitlab-ci.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
variables:
2+
SYSDIG_SECURE_ENDPOINT: "https://us2.app.sysdig.com"
3+
CI_REGISTRY_HOST: "docker.io"
4+
CI_REGISTRY_NAME: "my-registry"
5+
CI_IMAGE_NAME: "my-image"
6+
CI_IMAGE_TAG: "my-tag"
7+
8+
stages:
9+
- build
10+
- scan
11+
- push
12+
13+
image:build:
14+
stage: build
15+
image:
16+
name: gcr.io/kaniko-project/executor:debug
17+
entrypoint: [""]
18+
script:
19+
- /kaniko/executor --dockerfile Dockerfile --destination $CI_REGISTRY_HOST/$CI_REGISTRY_NAME/$CI_IMAGE_NAME:$CI_IMAGE_TAG --no-push --oci-layout-path $(pwd)/build/ --tarPath $(pwd)/build/$CI_IMAGE_TAG.tar
20+
artifacts:
21+
paths:
22+
- build/
23+
expire_in: 1 days
24+
25+
image:scan:
26+
stage: scan
27+
before_script:
28+
- export SECURE_API_TOKEN=$SYSDIG_SECURE_TOKEN
29+
script:
30+
- mkdir reports
31+
- curl -LO https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/$(curl -L -s https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt)/linux/amd64/sysdig-cli-scanner
32+
- chmod +x ./sysdig-cli-scanner
33+
- ./sysdig-cli-scanner --console-log --apiurl $SYSDIG_SECURE_ENDPOINT file://$(pwd)/build/$CI_IMAGE_TAG.tar
34+
artifacts:
35+
paths:
36+
- reports
37+
- build/
38+
expire_in: 1 days
39+
when: always
40+
needs:
41+
- image:build
42+
43+
image:push:
44+
stage: push
45+
image:
46+
name: gcr.io/go-containerregistry/crane:debug
47+
entrypoint: [""]
48+
script:
49+
- crane auth login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY_HOST
50+
- crane push build/$CI_IMAGE_TAG.tar $CI_REGISTRY_HOST/$CI_REGISTRY_NAME/$CI_IMAGE_NAME:$CI_IMAGE_TAG
51+
needs:
52+
- image:scan
53+

gitlab/Dockerfile renamed to gitlab/new-scan-engine/Dockerfile

File renamed without changes.

‎gitlab/new-scan-engine/README.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# GitLab CI Demo
2+
3+
In this demo we will use GitLab pipelines. We will need to split this pipeline into three different jobs
4+
1. Kaniko: Tool used to build docker image
5+
2. Sysdig-cli-scanner: Scan docker images for vulnerabilities using the new scan engine developed by Sysding in 2022
6+
3. Crane: Push container image to a remote registry
7+
8+
## Setup
9+
In GitLab repo settings add variables
10+
`CI_REGISTRY_USER`: Docker username
11+
`CI_REGISTRY_PASSWORD`: Docker user password
12+
`SYSDIG_SECURE_TOKEN`: Sysdig Token
13+
14+
Modify the gitlab-ci.yml file to build the image
15+
```
16+
CI_REGISTRY_HOST: "docker.io"
17+
CI_REGISTRY_NAME: my-registry
18+
CI_IMAGE_NAME: "my-image"
19+
CI_IMAGE_TAG: "latest"
20+
```
21+
22+
The variables are to build the full image url
23+
`$CI_REGISTRY_HOST/$CI_REGISTRY_NAME/$CI_IMAGE_NAME:$CI_IMAGE_TAG`
24+
We would expect
25+
`docker.io/my-registry/my-image:latest`
26+
27+
## Understanding the stages
28+
In order to get around using Docker in docker, these additional stages are necessary
29+
30+
There are three pipeline stages
31+
1. Build
32+
2. Scan
33+
3. Push
34+
35+
### Build
36+
The build stage is using Kaniko. We use a method to build the container to an oci format tarball, saved to the current working directory in `build/` directory. It is not pushed to a remote registry.
37+
We then save the `build/` directory as an artifact.
38+
39+
### Scan
40+
The scan stage is using `sysdig-cli-scanner`. This stage uses a the latest Sysdig scanning method documented here [Sysdig Secure - Vulnerabilities](https://docs.sysdig.com/en/docs/sysdig-secure/vulnerabilities/pipeline/)
41+
We then save the `build/` directory as an artifact for the next step as well as the `report/` directory to review the PDF scan results later.
42+
43+
### Push
44+
The push stage is using `crane`. It simply authenticates to your docker registry and pushes the conatiner from the Build stage to the remote registry

gitlab/.gitlab-ci.yml renamed to gitlab/old-scan-engine/.gitlab-ci.yml

File renamed without changes.

‎gitlab/old-scan-engine/Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
FROM alpine

gitlab/README.md renamed to gitlab/old-scan-engine/README.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
# GitLab CI Demo - No DinD
22

3+
> :warning: **Outdated example**: This example is using the legacy scan engine. Please use the [latest example for the new scan engine](../new-scan-engine/README.md) instead.
4+
35
![Gitlab job](gitlab.png)
46

57
In this demo we will use GitLab pipelines without requiring privileged containers, or docker in docker.
68
We will need to split this pipeline into three different jobs
79
1. Kaniko: Tool used to build docker image
8-
2. Sysdig-inline-scan: Scan docker images for vulnerabilities
10+
2. Sysdig-inline-scan (deprecated): Scan docker images for vulnerabilities
911
3. Crane: Push container image to a remote registry
1012

1113
## Setup
@@ -40,7 +42,7 @@ The build stage is using Kaniko. We use a method to build the container to an oc
4042
We then save the `build/` directory as an artifact.
4143

4244
### Scan
43-
The scan stage is using `sysdig-inline-scan:2`. This stage uses a newer Sysdig scanning method without the docker daemon dependencies.
45+
The scan stage is using `sysdig-inline-scan:2` (deprecated). This stage uses a scanning method without the docker daemon dependencies ([Documentation](https://docs.sysdig.com/en/docs/sysdig-secure/scanning/integrate-with-cicd-tools/)).
4446
We then save the `build/` directory as an artifact for the next step as well as the `report/` directory to review the PDF scan results later.
4547

4648
### Push

gitlab/gitlab.png renamed to gitlab/old-scan-engine/gitlab.png

File renamed without changes.

0 commit comments

Comments
 (0)