Skip to content

Commit 4202346

Browse files
e-mingueze-minguez
authored
Added a container for sysdig-cli-scanner (#41)
1 parent ec8214a commit 4202346

File tree

4 files changed

+166
-0
lines changed

4 files changed

+166
-0
lines changed

‎.github/workflows/sysdig-cli-scanner.yaml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
env:
2+
SYSDIG_SECURE_ENDPOINT: "https://secure.sysdig.com"
3+
REGISTRY_HOST: "ghcr.io"
4+
IMAGE_NAME: "sysdig-cli-scanner"
5+
DOCKERFILE_CONTEXT: "container-image/"
6+
7+
name: Build, scan and push the sysdig-cli-scanner container
8+
9+
on:
10+
workflow_dispatch:
11+
schedule:
12+
- cron: "0 5 * * *"
13+
14+
jobs:
15+
build-scan-and-push:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
packages: write
19+
contents: read
20+
steps:
21+
- name: Check the latest version
22+
env:
23+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
24+
run: |
25+
LATEST_VERSION=$(curl -sL https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt)
26+
IMAGE_TAG=$(gh api -H "Accept: application/vnd.github+json" /orgs/sysdiglabs/packages/container/sysdig-cli-scanner/versions | jq -r 'sort_by(.created_at) | last | .metadata.container.tags[0]')
27+
if [ ! -f ${GITHUB_WORKSPACE}/cache/latest_version.txt ] || [ ${LATEST_VERSION} != ${IMAGE_TAG} ]; then
28+
echo "Container versions differ, building ${LATEST_VERSION}"
29+
echo "IMAGE_TAG=${LATEST_VERSION}" >> ${GITHUB_ENV}
30+
else
31+
echo "Container already using latest version"
32+
exit 1
33+
fi
34+
35+
- name: Checkout
36+
uses: actions/checkout@v2
37+
38+
- name: Set up Docker Buildx
39+
uses: docker/setup-buildx-action@v2
40+
41+
- name: Build and save
42+
uses: docker/build-push-action@v3
43+
with:
44+
context: ${{ env.DOCKERFILE_CONTEXT }}
45+
file: "${{ env.DOCKERFILE_CONTEXT }}Containerfile"
46+
tags: ${{ env.REGISTRY_HOST }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}
47+
load: true
48+
build-args: |
49+
VERSION=${{ env.IMAGE_TAG }}
50+
51+
- name: Setup cache
52+
uses: actions/cache@v3
53+
with:
54+
path: cache
55+
key: ${{ runner.os }}-cache-${{ hashFiles('**/sysdig-cli-scanner', '**/latest_version.txt', '**/db/main.db.meta.json', '**/scanner-cache/inlineScannerCache.db') }}
56+
restore-keys: ${{ runner.os }}-cache-
57+
58+
- name: Download sysdig-cli-scanner if needed
59+
run: |
60+
curl -sLO https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt
61+
mkdir -p ${GITHUB_WORKSPACE}/cache/db/
62+
if [ ! -f ${GITHUB_WORKSPACE}/cache/latest_version.txt ] || [ $(cat ./latest_version.txt) != $(cat ${GITHUB_WORKSPACE}/cache/latest_version.txt) ]; then
63+
cp ./latest_version.txt ${GITHUB_WORKSPACE}/cache/latest_version.txt
64+
curl -sL -o ${GITHUB_WORKSPACE}/cache/sysdig-cli-scanner "https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/$(cat ${GITHUB_WORKSPACE}/cache/latest_version.txt)/linux/amd64/sysdig-cli-scanner"
65+
chmod +x ${GITHUB_WORKSPACE}/cache/sysdig-cli-scanner
66+
else
67+
echo "sysdig-cli-scanner latest version already downloaded"
68+
fi
69+
70+
- name: Scan the image using sysdig-cli-scanner
71+
env:
72+
SECURE_API_TOKEN: ${{ secrets.SECURE_API_TOKEN }}
73+
run: |
74+
${GITHUB_WORKSPACE}/cache/sysdig-cli-scanner \
75+
--apiurl ${SYSDIG_SECURE_ENDPOINT} \
76+
docker://${REGISTRY_HOST}/${{github.repository_owner}}/${IMAGE_NAME}:${IMAGE_TAG} \
77+
--console-log \
78+
--dbpath=${GITHUB_WORKSPACE}/cache/db/ \
79+
--cachepath=${GITHUB_WORKSPACE}/cache/scanner-cache/
80+
81+
- name: Login to the registry
82+
uses: docker/login-action@v2
83+
with:
84+
registry: ${{ env.REGISTRY_HOST }}
85+
username: ${{ github.repository_owner }}
86+
password: ${{ secrets.GITHUB_TOKEN }}
87+
88+
- name: Push
89+
uses: docker/build-push-action@v3
90+
with:
91+
context: ${{ env.DOCKERFILE_CONTEXT }}
92+
push: true
93+
file: "${{ env.DOCKERFILE_CONTEXT }}Containerfile"
94+
build-args: |
95+
VERSION=${{ env.IMAGE_TAG }}
96+
tags: ${{ env.REGISTRY_HOST }}/${{ github.repository_owner }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }}

‎container-image/Containerfile‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
FROM alpine:latest as builder
2+
ARG VERSION
3+
ENV VERSION=${VERSION}
4+
ADD https://download.sysdig.com/scanning/bin/sysdig-cli-scanner/${VERSION}/linux/amd64/sysdig-cli-scanner /
5+
RUN chmod a+x /sysdig-cli-scanner
6+
7+
FROM gcr.io/distroless/static-debian11:nonroot
8+
COPY --from=builder /sysdig-cli-scanner /home/nonroot/
9+
USER 65532:65532
10+
ENTRYPOINT ["/home/nonroot/sysdig-cli-scanner"]

‎container-image/README.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Unsupported container for the `sysdig-cli-scanner`
2+
3+
A few notes:
4+
* It does a multistep build to get the binary and `chmod`-it from an alpine container, then it uses the debian distroless to save some disk space (the binary itself is 28MB and the image is 31MB)
5+
* The `sysdig-cli-scanner` version number is used also for the container label
6+
* The container image itself is scanned by the `sysdig-cli-scanner`!
7+
8+
## Run it
9+
10+
```
11+
$ docker run -e SECURE_API_TOKEN="X" ghcr.io/sysdiglabs/sysdig-cli-scanner:1.2.10 --apiurl https://eu1.app.sysdig.com pull://docker.io/sysdiglabs/dummy-vuln-app
12+
2022-10-28T10:23:05Z Starting analysis with Sysdig scanner version 1.2.10-rc
13+
2022-10-28T10:23:05Z Retrieving vulnerabilities DB...
14+
2022-10-28T10:23:07Z Done 116.3 MB
15+
2022-10-28T10:23:07Z Loading vulnerabilities DB...
16+
2022-10-28T10:23:07Z Done
17+
2022-10-28T10:23:07Z Retrieving image...
18+
2022-10-28T10:23:08Z Done
19+
2022-10-28T10:23:08Z Scan started...
20+
2022-10-28T10:23:16Z Uploading result to backend...
21+
2022-10-28T10:23:16Z Done
22+
2022-10-28T10:23:16Z Total execution time 11.019413828s
23+
24+
Type: dockerImage
25+
ImageID: sha256:b670c067178c876d17363baec279d483ae07384351d1a0be7646230442471ac6
26+
Digest: sysdiglabs/dummy-vuln-app@sha256:bc86e8ba5741ab71ce50f13fbf89a1f27dc4e1d3b0c3345cee8e3238bc30022b
27+
BaseOS: debian 9.13
28+
PullString: docker.io/sysdiglabs/dummy-vuln-app
29+
30+
13 vulnerabilities found
31+
2 Critical (0 fixable)
32+
5 High (2 fixable)
33+
6 Medium (5 fixable)
34+
0 Low (0 fixable)
35+
0 Negligible (0 fixable)
36+
37+
PACKAGE TYPE VERSION SUGGESTED FIX CRITICAL HIGH MEDIUM LOW NEGLIGIBLE EXPLOIT
38+
pip python 9.0.1 19.2 0 2 1 0 0 0
39+
numpy python 1.12.1 1.19.0 0 1 3 0 0 0
40+
pyxdg python 0.25 0.26 0 1 0 0 0 0
41+
Jinja2 python 2.11.2 2.11.3 0 0 1 0 0 0
42+
43+
POLICIES EVALUATION
44+
Policy: Sysdig Best Practices FAILED (8 failures)
45+
46+
Policies evaluation FAILED at 2022-10-28T10:23:16Z
47+
Full image results here: https://eu1.app.sysdig.com/secure/#/scanning/assets/results/1722348e04906294017718c0cd082970/overview (id 1722348e04906294017718c0cd082970)
48+
Execution logs written to: /home/nonroot/scan-logs
49+
```
50+
51+
## Build it
52+
53+
The container is built by the [GitHub workflow](../.github/workflows/sysdig-cli-scanner.yaml) but in order to do it manually you can use the [doit.sh](./doit.sh) script. It requires you to be logged in your container image repository (docker login) and modify the REPO variable in the doit.sh script.

‎container-image/doit.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
#!/bin/bash
2+
3+
REPO=quay.io/e_minguez/sysdig-cli-scanner
4+
export VERSION=$(curl -L -s https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt)
5+
6+
docker build --build-arg VERSION . -t ${REPO}:${VERSION}
7+
docker push ${REPO}:${VERSION}

0 commit comments

Comments
 (0)