🕵️ About Java Bytecode, native binaries & security (short Grype benchmark)

🖕 Controlling Docker images releases

More and more we release and rely on an ever growing set of Docker images.
To make short, as Software Developers and DEVOPS engineers, the ones that interest us currently are :

The images we rely on

The image we build ourselves (on top of previous ones)

👉 What we ~~want~~ need to be able to do is : to be able to control the security level of the images we are building...

⚠️ And not release them if they do not reach the expected level of security, depending of the target service.

As all services do not have the same criticity, vulnerabilities level may have different impacts on runtime security governance.

👐 Experimentation and solutions

Fortunately anchore provides a set of ready to use tools that helps... a lot :

grype (vulnerability scanner for container images and filesystems)

syft (CLI tool and library for generating a Software Bill of Materials from container images and filesystems)

grype as a Anchore GitHub Action :

👉 So you can easily protect your Continuous Delivery pipeline thanks to the severity-cutoff :

🔖 Resources

anchore / grype

A vulnerability scanner for container images and filesystems

A vulnerability scanner for container images and filesystems. Easily install the binary to try it out. Works with Syft, the powerful SBOM (software bill of materials) tool for container images and filesystems.

Join our community meetings!

Calendar: https://calendar.google.com/calendar/u/0/r?cid=Y182OTM4dGt0MjRtajI0NnNzOThiaGtnM29qNEBncm91cC5jYWxlbmRhci5nb29nbGUuY29t
Agenda: https://docs.google.com/document/d/1ZtSAa6fj2a6KRWviTn3WoJm09edvrNUp4Iz_dOjjyY8/edit?usp=sharing (join this group for write access)
All are welcome!

For commercial support options with Syft or Grype, please contact Anchore

Features

Scan the contents of a container image or filesystem to find known vulnerabilities.
Find vulnerabilities for major operating system packages
- Alpine
- Amazon Linux
- BusyBox
- CentOS
- Debian
- Distroless
- Oracle Linux
- Red Hat (RHEL)
- Ubuntu
Find vulnerabilities for language-specific packages
- Ruby (Gems)
- Java (JAR, WAR, EAR, JPI, HPI)
- JavaScript (NPM, Yarn)
- Python (Egg, Wheel, Poetry, requirements.txt/setup.py files)
- Dotnet (deps.json)
- Golang (go.mod)
- PHP (Composer)
- Rust (Cargo)
Supports Docker, OCI and Singularity image formats.