xolian/Anchore Container Scanning.md

Last active June 24, 2020 18:52

Star (0) You must be signed in to star a gist
Fork (0) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/xolian/276b864d8f84a2ca23055a3612d1a82b.js"></script>
Save xolian/276b864d8f84a2ca23055a3612d1a82b to your computer and use it in GitHub Desktop.

Download ZIP

Docker image scanning

Raw

Anchore Container Scanning.md

Anchore Quickstart

install

mkdir anchore-ce;cd anchore-ce
curl https://docs.anchore.com/current/docs/engine/quickstart/docker-compose.yaml > docker-compose.yaml
docker-compose up -d

initialize

Download vuln libs.

docker-compose exec api anchore-cli system status
docker-compose exec api anchore-cli system feeds list
docker-compose exec api anchore-cli system wait

create private registry

Not required for public registries.

docker run -d -p 5000:5000 --restart=always --name registry registry:2
cd <path/to/image targets/docker-compose.yaml
docker-compose up -d
docker tag docker.io/<something> localhost:5000/<something>
docker push localhost:5000/<something>

scanning

For any public docker hub images simply use docker.io/library/<image>:<tag> replacing the <something> tags below.

docker-compose exec api anchore-cli image add <something>
docker-compose exec api anchore-cli image wait <something>
docker-compose exec api anchore-cli image content <something> os
docker-compose exec api anchore-cli image vuln <something> all
docker-compose exec api anchore-cli evaluate check <something>

NOTE: If you are adding from a private registry use your external IP NOT `localhost` or `127.0.0.1` en lieu of `docker.io`

remove registry

docker container stop registry

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment