12.Detecting_Vulnerabilities_in_Docker_Images.md

Detecting Vulnerabilities in Docker Images

Scanning Docker Images vs. Linting Dockerfiles

Scanning Docker Images with Trivy

# Configure the version you want to install
VERSION=v0.60.0
# Install Trivy
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | \
    sudo sh -s -- -b \
    /usr/local/bin \
    $VERSION

# Scan a Docker image
trivy image <IMAGE_NAME>

trivy image --scanners vuln <IMAGE_NAME>

trivy image --severity HIGH,CRITICAL <IMAGE_NAME>

# .trivyignore
CVE-2022-40897

# Scan for OS vulnerabilities
trivy image --vuln-type os <IMAGE_NAME>
# Scan for library vulnerabilities
trivy image --vuln-type library <IMAGE_NAME>

# Scan and output the results in JSON format
trivy image --format json <IMAGE_NAME>
# Scan and output the results in template format
trivy image --format template --template "{{ range . }} {{ .Target }} {{ end }}" <IMAGE_NAME>
# A second example of template format that counts the number of critical and high vulnerabilities
trivy image --format template --template '{{- $critical := 0 }}{{- $high := 0 }}{{- range . }}{{- range .Vulnerabilities }}{{- if  eq .Severity "CRITICAL" }}{{- $critical = add $critical 1 }}{{- end }}{{- if  eq .Severity "HIGH" }}{{- $high = add $high 1 }}{{- end }}{{- end }}{{- end }}Critical: {{ $critical }}, High: {{ $high }}' <IMAGE_NAME>

# Fail the build if vulnerabilities are found
trivy image --exit-code 1 <IMAGE_NAME>

# Scan the menu service image
trivy image \
    --severity HIGH,CRITICAL \
    --vuln-type os,library \
    $GITLAB_REGISTRY_URL/menu-service:v0.1.0 \
    --exit-code 1 \
    -f json

# Scan the qr service image
trivy image \
    --severity HIGH,CRITICAL \
    --vuln-type os,library \    
    $GITLAB_REGISTRY_URL/qr-service:v0.1.0 \
    --exit-code 1 \
    -f json

# Scan the menu-postgresql image
trivy image \
    --severity HIGH,CRITICAL \
    --vuln-type os,library \    
    $GITLAB_REGISTRY_URL/menu-postgresql:v0.1.0 \
    --exit-code 1 \
    -f json

Understanding Trivy Reports

[
  {
    "Target": "registry.gitlab.com/restqr/restqr/menu-service:v0.1.0 (debian 12.9)",
    "Class": "os-pkgs",
    "Type": "debian",
    "Vulnerabilities": [
        // truncated
    ]
  },
  {
    "Target": "Python",
    "Class": "lang-pkgs",
    "Type": "python-pkg",
    "Vulnerabilities": [
        // truncated
    ]
  }
]

# OS-packages vulnerabilities
trivy image \
    --severity HIGH,CRITICAL \
    --vuln-type os,library \
    $GITLAB_REGISTRY_URL/menu-service:v0.1.0 \
    --exit-code 1 \
    --quiet \
    -f json | jq '.Results[] | select(.Class == "os-pkgs") | {Target, Vulnerabilities}'

# Language-specific packages vulnerabilities
trivy image \
    --severity HIGH,CRITICAL \
    --vuln-type os,library \
    $GITLAB_REGISTRY_URL/menu-service:v0.1.0 \
    --exit-code 1 \
    --quiet \
    -f json | jq '.Results[] | select(.Class == "lang-pkgs") | {Target, Vulnerabilities}'

# Create a template file
curl -sSL \
    -o /tmp/html.tpl \
    https://github.com/aquasecurity/trivy/raw/refs/heads/release/v0.60/contrib/html.tpl

# Create a folder to store the report
mkdir -p $HOME/reports

# Generate an HTML report
trivy image \
    --format template \
    --template "@/tmp/html.tpl" \
    --output $HOME/reports/menu-service-vulnerabilities.html \
    $GITLAB_REGISTRY_URL/menu-service:v0.1.0

# Launch a web server to view the report
python3 -m http.server --directory $HOME/reports > /dev/null 2>&1 &

# Open the report in your browser
echo "http://$(curl -s ifconfig.me):8000/menu-service-vulnerabilities.html"

Understanding the Vulnerabilities Array in Trivy Reports

Docker Image Scanning Alternatives