Ctrlk
Sign UpGet a DemoContact Us
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Tutorial: Container image scans with Aqua Trivy

Scan a container image using Aqua Trivy

This tutorial shows you how to scan your container images using Aqua Trivy, a popular open-source scanning tool.

In this tutorial, you'll set up a simple orchestration workflow with two steps:

  1. A Background step that runs Docker-in-Docker as a service. This is required for any orchestrated or dataload scan of a container image.

  2. An Aqua-Trivy step that runs the scan and ingests the results into STO.

PREREQUISITES

Set up your pipeline

Do the following:

  1. Select Security Testing Orchestration (left menu, top) > Pipelines > Create a Pipeline. Enter a name and click Start.

  2. In the new pipeline, select Add stage > Security.

  3. Set up your stage as follows:

    1. Enter a Stage Name.

    2. Disable Clone Codebase. You don't need a code repository for this tutorial.

  4. In the Pipeline Editor, go to Infrastructure and select Cloud, Linux, and AMD64 for the infrastructure, OS, and architecture.

    You can also use a Kubernetes or Docker build infrastructure, but these require additional work to set up. For more information, go to Supported Infrastructures documentation.

The following step is required only for Kubernetes or Docker infrastructures. If you're using Harness Cloud, go to Add the Aqua-Trivy scan step.

Add a Docker-in-Docker background step

Add the Aqua-Trivy scan step

Add an Aqua Trivy step to your pipeline after the DinD background step and configure it as follows:

  1. Scan Mode = Orchestration

  2. Target name — Click the Value Selector button on the right side of the input field and select Runtime Input.

  3. Target variant — Select Runtime Input.

  4. Container image Type = Docker v2

  5. Container image Domain = docker.io

  6. Container image name — Select Runtime Input.

  7. Container image tag — Select Runtime Input.

  8. Fail on Severity = Critical

Add an Aqua Trivy step to your pipeline after the DinD background step and configure it as follows:

  • type: AquaTrivy

  • name: A name for the step.

  • identifier: A unique step ID.

  • spec :

    • mode : orchestration In orchestrated mode, the step runs the scan and ingests the results in one step.

    • config: default

    • target :

      • name : <+input>

      • type : container

      • variant : <+input> You will specify the target name and variant when you run the pipeline. When scanning a repository, you will generally use the repository name and branch for these fields.

      • advanced :

      • privileged: true

      • image:

        • type : docker_v2

        • name: <+input>

        • domain : docker.io

        • tag: <+input>

Here's an example:

Run the pipeline and check your results

  1. In the Pipeline Studio, select Run (top right).

  2. When prompted, enter your runtime inputs.

    • Under Target, enter the target name and variant.

    • Under Image, enter the [image name] and [tag] you want to use. In most cases, you want to use the repository for the target and the branch for the variant.

    If you're scanning the codebase for the first time, enter the root branch of your repo. This is usually the main or master branch.

    If you're scanning the example image mentioned above, enter snyklabs/goof for the target and image name, and latest for the target variant and image tag.

  3. Run the pipeline and then wait for the execution to finish.

    If you used the example image, you'll see that the pipeline failed for an entirely expected reason: you configured the Trivy step to fail the pipeline if the scan detected any critical vulnerabilities. The final log entry for the Semgrep step reads: Exited with message: fail_on_severity is set to critical and that threshold was reached.

  4. Select Vulnerabilities tab and examine any issues detected by your scan.

Specify the baseline

It is good practice to specify a baseline for every target. Defining a baseline makes it easy for developers to drill down into "shift-left" issues in downstream variants and security personnel to drill down into "shift-right" issues in the baseline.

  1. Select Test Targets (left menu).

  2. Select the baseline you want for your target.

YAML pipeline example

Here's an example of the pipeline you created in this tutorial. If you copy this example, replace the placeholder values with appropriate values for your project, organization, and connectors.

PreviousAqua Trivy step configuration
NextAWS ECR step configuration

Last updated

Was this helpful?