Grype step configuration
Scan container images with Grype.
You can scan your container images and ingest results from Grype.
For information about setting up Grype in an air-gapped environment, go to Set up Grype in air-gapped environments.
Important notes for running Grype scans in STO
You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.
STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.
Grype step settings for STO
The recommended workflow is to add a Grype step to a Security or Build stage and then configure it as described below.
Scan
Scan Mode
Scan Configuration
Target
Type
Target and Variant Detection
Name
Variant
Ingestion File
Container image
Type
Domain
Name
Tag/Digest
Access Id
Access Token
Log Level
Additional CLI flags
Use this field to run the grype binary with CLI arguments such as:
--only-fixed
With this flag, grype reports only vulnerabilities that have known fixes.
Fail on Severity
Settings
Additional Configuration
Advanced settings
Configure Anchore Grype as a Built-in Scanner
The Anchore Grype scanner is available as a built-in scanner in STO. Configuring it as a built-in scanner enables the step to automatically perform scans using the free version without requiring any licenses. Follow these steps to set it up:
Search for Container in the step palette or navigate to the Built-in Scanners section and select the Container step.
Select Anchore Grype from the list of scanners.
Expand the Additional CLI Flags section if you want to configure optional CLI flags.
Click Add Scanner to save the configuration.
The scanner will automatically use the free version, detect scan targets, and can be further configured by clicking on the step whenever needed.
Proxy settings
Troubleshoot "vulnerability database build date exceeds max allowed age" exception
The full exception is: db could not be loaded: the vulnerability database was built n weeks ago (max allowed age is 5 days)
This exception indicates that the Grype step in the STO process is unable to load the vulnerability database due to its age exceeding the maximum allowed age of 5 days. If the environment where you're running these scans has restricted internet connectivity (firewalled), you must set up a local database for Grype to update itself. For comprehensive documentation for the initial setup, configuring the local database, and final configuration, go to Set up Grype in air-gapped environments.
While Harness updates the database every time it rebuilds the Grype image, this is primarily done for performance reasons. A fresher database requires less time and effort to update at runtime. However, this update is not sufficient to bypass the database access requirement, as the maximum allowed age is 5 days. You can temporarily disable the age check and run Grype with the database it ships with, but this is not recommended from a security standpoint. It's advisable to follow the provided instructions to resolve the database access issue in a more secure manner.
Last updated
Was this helpful?