Systems and methods for scanning images for vulnerabilities

1. A vulnerability scanning tool, comprising:

one or more processors; and

one or more computer-readable non-transitory storage media coupled to the one or more processors and comprising instructions that, when executed by the one or more processors, cause the vulnerability scanning tool to perform operations comprising:

extracting a plurality of images from one or more pods running within a cluster;

determining a plurality of unique, unduplicated images from the plurality of images;

after determining the plurality of unique, unduplicated images from the plurality of images, scanning the plurality of unique, unduplicated images in parallel;

detecting one or more vulnerabilities within the plurality of unique, unduplicated images in response to scanning the plurality of unique, unduplicated images in parallel;

determining a vulnerability level associated with a pod of the one or more pods; and

assigning the vulnerability level to the pod.

2. The vulnerability scanning tool of claim 1 , the operations further comprising determining whether to apply a policy to the pod based at least in part on the vulnerability level of the pod, wherein the policy comprises one of the following:

blocking the pod from running at a future point in time;

killing the pod; and

preventing communication by the pod to specific destinations within the cluster.

3. The vulnerability scanning tool of claim 1 , wherein the vulnerability level is selected from one of the following vulnerability levels:

critical;

high;

medium; and

low.

4. The vulnerability scanning tool of claim 1 , the operations further comprising:

detecting a first vulnerability within a first unique, unduplicated image of the pod;

classifying the first vulnerability within the first unique, unduplicated image of the pod as a high vulnerability level;

detecting a second vulnerability within a second unique, unduplicated image of the pod;

classifying the second vulnerability within the second unique, unduplicated image of the pod as a low vulnerability level; and

assigning the high vulnerability level to the pod.

5. The vulnerability scanning tool of claim 1 , the operations further comprising:

determining a location of the pod;

identifying one or more images within the pod that contains the one or more vulnerabilities; and

identifying one or more components within each of the one or more images within the pod that contains the one or more vulnerabilities.

6. The vulnerability scanning tool of claim 1 , wherein scanning the plurality of unique, unduplicated images in parallel is performed in runtime.

7. The vulnerability scanning tool of claim 1 , the operations further comprising generating a scan report indicating the vulnerability level of the pod.

8. A method, comprising:

extracting, by a vulnerability scanning tool, a plurality of images from one or more pods running within a cluster;

determining, by the vulnerability scanning tool, a plurality of unique, unduplicated images from the plurality of images;

after determining the plurality of unique, unduplicated images from the plurality of images, scanning, by the vulnerability scanning tool, the plurality of unique, unduplicated images in parallel;

detecting, by the vulnerability scanning tool, one or more vulnerabilities within the plurality of unique, unduplicated images in response to scanning the plurality of unique, unduplicated images in parallel;

determining, by the vulnerability scanning tool, a vulnerability level associated with a pod of the one or more pods; and

assigning, by the vulnerability scanning tool, the vulnerability level to the pod.

9. The method of claim 8 , further comprising determining, by the vulnerability scanning tool, whether to apply a policy to the pod based at least in part on the vulnerability level of the pod, wherein the policy comprises one of the following:

blocking the pod from running at a future point in time;

killing the pod; and

preventing communication by the pod to specific destinations within the cluster.

10. The method of claim 8 , wherein the vulnerability level is selected from one of the following vulnerability levels:

critical;

high;

medium; and

low.

11. The method of claim 8 , further comprising:

detecting, by the vulnerability scanning tool, a first vulnerability within a first unique, unduplicated image of the pod;

classifying, by the vulnerability scanning tool, the first vulnerability within the first unique, unduplicated image of the pod as a high vulnerability level;

detecting, by the vulnerability scanning tool, a second vulnerability within a second unique, unduplicated image of the pod;

classifying, by the vulnerability scanning tool, the second vulnerability within the second unique, unduplicated image of the pod as a low vulnerability level; and

assigning, by the vulnerability scanning tool, the high vulnerability level to the pod.

12. The method of claim 8 , further comprising:

determining, by the vulnerability scanning tool, a location of the pod;

identifying, by the vulnerability scanning tool, one or more images within the pod that contains the one or more vulnerabilities; and

identifying, by the vulnerability scanning tool, one or more components within each of the one or more images within the pod that contains the one or more vulnerabilities.

13. The method of claim 8 , wherein scanning the plurality of unique, unduplicated images in parallel is performed in runtime.

14. The method of claim 8 , further comprising generating, by the vulnerability scanning tool, a scan report indicating the vulnerability level of the pod.

15. One or more computer-readable non-transitory storage media embodying instructions that, when executed by a processor, cause the processor to perform operations comprising:

extracting a plurality of images from one or more pods running within a cluster;

determining, by the vulnerability scanning tool, a plurality of unique, unduplicated images from the plurality of images;

after determining the plurality of unique, unduplicated images from the plurality of images, scanning, by the vulnerability scanning tool, the plurality of unique, unduplicated images in parallel;

detecting one or more vulnerabilities within the plurality of unique, unduplicated images in response to scanning the plurality of unique, unduplicated images in parallel;

determining a vulnerability level associated with a pod of the one or more pods; and

assigning the vulnerability level to the pod.

16. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising determining whether to apply a policy to the pod based at least in part on the vulnerability level of the pod, wherein the policy comprises one of the following:

blocking the pod from running at a future point in time;

killing the pod; and

preventing communication by the pod to specific destinations within the cluster.

17. The one or more computer-readable non-transitory storage media of claim 15 , wherein the vulnerability level is selected from one of the following vulnerability levels:

critical;

high;

medium; and

low.

18. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising:

detecting a first vulnerability within a first unique, unduplicated image of the pod;

classifying the first vulnerability within the first unique, unduplicated image of the pod as a high vulnerability level;

detecting a second vulnerability within a second unique, unduplicated image of the pod;

classifying the second vulnerability within the second unique, unduplicated image of the pod as a low vulnerability level; and

assigning the high vulnerability level to the pod.

19. The one or more computer-readable non-transitory storage media of claim 15 , the operations further comprising:

determining a location of the pod;

identifying one or more images within the pod that contains the one or more vulnerabilities; and

identifying one or more components within each of the one or more images within the pod that contains the one or more vulnerabilities.

20. The one or more computer-readable non-transitory storage media of claim 15 , wherein scanning the plurality of unique, unduplicated images in parallel is performed in runtime.