github
/
k3s
mirror of https://github.com/k3s-io/k3s
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #2253 from briandowns/issue-2106 

Add Trivy Scans for Built Images
pull/2273/head
Brian Downs 2020-09-17 08:46:31 -07:00 committed by GitHub
parent b66760fccd 20a8327214
commit e0a9060d59
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 39 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
Dockerfile.dapper
View File

@ -9,6 +9,20 @@ ENV no_proxy=$no_proxy
RUN apk -U --no-cache add bash git gcc musl-dev docker vim less file curl wget ca-certificates jq linux-headers zlib-dev tar zip squashfs-tools npm coreutils \ RUN apk -U --no-cache add bash git gcc musl-dev docker vim less file curl wget ca-certificates jq linux-headers zlib-dev tar zip squashfs-tools npm coreutils \
python2 openssl-dev libffi-dev libseccomp libseccomp-dev make libuv-static sqlite-dev sqlite-static libselinux libselinux-dev zlib-dev zlib-static python2 openssl-dev libffi-dev libseccomp libseccomp-dev make libuv-static sqlite-dev sqlite-static libselinux libselinux-dev zlib-dev zlib-static
RUN if [ "$(go env GOARCH)" = "arm64" ]; then \
wget https://github.com/aquasecurity/trivy/releases/download/v0.11.0/trivy_0.11.0_Linux-ARM64.tar.gz && \
tar -zxvf trivy_0.11.0_Linux-ARM64.tar.gz && \
mv trivy /usr/local/bin; \
elif [ "$(go env GOARCH)" = "arm" ]; then \
wget https://github.com/aquasecurity/trivy/releases/download/v0.11.0/trivy_0.11.0_Linux-ARM.tar.gz && \
tar -zxvf trivy_0.11.0_Linux-ARM.tar.gz && \
mv trivy /usr/local/bin; \
else \
wget https://github.com/aquasecurity/trivy/releases/download/v0.11.0/trivy_0.11.0_Linux-64bit.tar.gz && \
tar -zxvf trivy_0.11.0_Linux-64bit.tar.gz && \
mv trivy /usr/local/bin; \
fi
RUN trivy --download-db-only
RUN mkdir -p /go/src/golang.org/x && \ RUN mkdir -p /go/src/golang.org/x && \
cd /go/src/golang.org/x && git clone https://github.com/golang/tools && cd tools && \ cd /go/src/golang.org/x && git clone https://github.com/golang/tools && cd tools && \
git checkout -b current aa82965741a9fecd12b026fbb3d3c6ed3231b8f8 && \ git checkout -b current aa82965741a9fecd12b026fbb3d3c6ed3231b8f8 && \

4
Makefile
View File

@ -33,3 +33,7 @@ build/data:
.PHONY: binary-size-check .PHONY: binary-size-check
binary-size-check: binary-size-check:
scripts/binary_size_check.sh scripts/binary_size_check.sh
.PHONY: image-scan
image-scan:
scripts/image_scan.sh $(IMAGE)

19
scripts/image_scan.sh Executable file
View File

@ -0,0 +1,19 @@
#/bin/sh
set -e
if [ -n ${DEBUG} ]; then
set -x
fi
if [ -z $1 ]; then
echo "error: image name required as argument. exiting..."
exit 1
fi
IMAGE=$1
SEVERITIES="HIGH,CRITICAL"
trivy --quiet image --severity ${SEVERITIES} --no-progress --ignore-unfixed ${IMAGE}
exit 0

1
scripts/package-image
View File

@ -15,4 +15,5 @@ PROXY_OPTS=
[ -z "$https_proxy" ] || PROXY_OPTS="$PROXY_OPTS --build-arg https_proxy=$https_proxy" [ -z "$https_proxy" ] || PROXY_OPTS="$PROXY_OPTS --build-arg https_proxy=$https_proxy"
[ -z "$no_proxy" ] || PROXY_OPTS="$PROXY_OPTS --build-arg no_proxy=$no_proxy" [ -z "$no_proxy" ] || PROXY_OPTS="$PROXY_OPTS --build-arg no_proxy=$no_proxy"
docker build ${PROXY_OPTS} -t ${IMAGE} -f package/Dockerfile . docker build ${PROXY_OPTS} -t ${IMAGE} -f package/Dockerfile .
./scripts/image_scan.sh ${IMAGE}
echo Built ${IMAGE} echo Built ${IMAGE}