QA » openQA Project » openQA Tests » Containers

i investigated two security scanners which both are open source,fast and easy to be used straight away.

dockerbenchdockerbench

trivytrivy

[0] https://github.com/docker/docker-bench-security
[1] https://github.com/aquasecurity/trivy

Some registries have security scanners for Docker images. Quay.io uses Clair and GitHub Actions allows to use any scanner.

Another tool is Dockle which also runs a CIS benchmark, much better than the dockerbench shell script:
https://github.com/goodwithtech/dockle

The deprecated https://github.com/Azure/container-scan used both Trivy and Dockle.

pdostal wrote:

That's why I would simple add those tests to our openQA.

Fair point, but those tests are security checks and openQA is not the best tool for this, IMHO. I think this kind of security checks should be done by the Security team on every image, not just base images. It's also the BuildOps team's responsibility to finally integrate NeuVector in IBS/OBS.

Let's escalate this so a decision is made at a higher level. As the priority for this issue is low, I'd wait for BuildOps to see if they finally integrate NeuVector. Otherwise we'll have to decide which images to scan and which tool to use (and what to do with the false positives & false negatives inherent with these tools). Ideally, it should've been SUSE's NeuVector but I asked in #discuss-neuvector about their QE processes and repositories and didn't get an answer.

If NeuVector gets integrated into IBS/OBS then duplicating this in openQA doesn't make sense. But if they didn't integrate it then this would be my first choice.

The security team doesn't scan every image. We mostly work on lower layers to ensure that the input for the images is proper. Having this scanning ability in openQA would be great from our POV

We would waste time doing it in openQA if IBS/OBS eventually implements it.