Systems and methods for vulnerability scanning of dependencies in containers
A method includes identifying, by a processing device, a set of parameters to generate a container image for a container. The parameters comprise one or more dependencies associated with running the container in a cloud-based environment. A manifest file referencing the one or more dependencies is obtained and the container image is generated based on the set of parameters, wherein the manifest file is stored in a predetermined location associated with the container.
1 . A method, comprising:
obtaining a manifest file from a container image, wherein the manifest file references one or more dependencies associated with running a container deployed from the container image in a cloud-based environment;
identifying one or more vulnerabilities associated with the one or more dependencies referenced in the manifest file;
generating a security scanning report referencing the one or more vulnerabilities; and
excluding, from the security scanning report, a vulnerability based on an indication in the manifest file that the vulnerability includes a patch.
2 . The method of claim 1 ,
wherein the manifest file is obtained from the container image by a security scanner tool.
3 . The method of claim 1 , further comprising:
generating the manifest file, wherein generating the manifest file comprises identifying which dependencies are selected for the container image and listing the identified dependencies in the manifest file.
4 . The method of claim 1 , further comprising:
generating the manifest file based on received user input referencing the one or more dependencies.
5 . The method of claim 1 , wherein the manifest file comprises a set of records indicating, for a dependency of the one or more dependencies, a version of the dependency, a distribution type of the dependency, a corresponding location in a directory structure, and patch data related to a vulnerability of the dependency.
6 . The method of claim 1 , wherein the manifest file is stored in a predetermined location associated with the container.
7 . A system comprising:
a memory device; and
a processing device coupled to the memory device, the processing device to perform operations comprising:
obtaining a manifest file from a container image, wherein the manifest file references one or more dependencies associated with running a container deployed from the container image in a cloud-based environment;
identifying one or more vulnerabilities associated with the one or more dependencies referenced in the manifest file;
generating a security scanning report referencing the one or more vulnerabilities; and
excluding, from the security scanning report, a vulnerability based on an indication in the manifest file that the vulnerability includes a patch.
8 . The system of claim 7 , wherein the operations further comprise:
identifying the one or more dependencies to generate the container image;
obtaining the manifest file referencing the one or more dependencies; and
generating the container image based on the one or more dependencies, wherein the manifest file is stored in a predetermined location associated with the container.
9 . The system of claim 7 , wherein the operations further comprise:
generating the manifest file, wherein generating the manifest file comprises identifying which dependencies are selected for the container image and listing the identified dependencies in the manifest file.
10 . The system of claim 7 , wherein the operations further comprise:
generating the manifest file based on received user input referencing the one or more dependencies.
11 . The system of claim 7 , wherein the manifest file comprises a set of records indicating, for a dependency of the one or more dependencies, a version of the dependency, a distribution type of the dependency, a corresponding location in a directory structure, and patch data related to a vulnerability of the dependency.
12 . The system of claim 8 , wherein the predetermined location comprises a location in a directory structure of the container image.
13 . A non-transitory computer-readable medium comprising instructions that, responsive to execution by a processing device, cause the processing device to perform operations comprising:
obtaining a manifest file from a container image, wherein the manifest file references one or more dependencies associated with running a container deployed from the container image in a cloud-based environment;
identifying one or more vulnerabilities associated with the one or more dependencies referenced in the manifest file;
generating a security scanning report referencing the one or more vulnerabilities; and
excluding, from the security scanning report, a vulnerability based on an indication in the manifest file that the vulnerability includes a patch.
14 . The non-transitory computer-readable medium of claim 13 , wherein
the manifest file is obtained from the container image by a security scanner tool.
15 . The non-transitory computer-readable medium of claim 13 , wherein the operations further comprise:
generating the manifest file, wherein generating the manifest file comprises identifying which dependencies are selected for the container image and listing the identified dependencies in the manifest file.
16 . The non-transitory computer-readable medium of claim 13 , wherein the operations further comprise:
generating the manifest file based on received user input referencing the one or more dependencies.
17 . The non-transitory computer-readable medium of claim 13 , wherein the manifest file comprises a set of records indicating, for a dependency of the one or more dependencies, a version of the dependency, a distribution type of the dependency, a corresponding location in a directory structure, and patch data related to a vulnerability of the dependency.