基于trivy获取基础镜像

guoguangwu

已于 2022-10-12 20:48:11 修改

阅读量582

点赞数

分类专栏： golang docker 安全文章标签： golang docker 后端

于 2022-07-31 11:33:14 首次发布

本文链接：https://blog.csdn.net/guoguangwu/article/details/126083594

版权

安全同时被 3 个专栏收录

51 篇文章 0 订阅

订阅专栏

golang

44 篇文章 0 订阅

订阅专栏

docker

26 篇文章 1 订阅

订阅专栏

该博客展示了如何使用Trivy工具扫描Docker镜像nginx:latest的安全漏洞。通过运行命令，获取了镜像的详细信息，包括其基于的Debian Bullseye操作系统版本、构建历史等，并输出了扫描后的安全报告。

摘要由CSDN通过智能技术生成

package main

import (
	"context"
	"encoding/json"
	"flag"
	"fmt"
	"github.com/aquasecurity/trivy/pkg/commands/artifact"
	flag2 "github.com/aquasecurity/trivy/pkg/flag"
)

func main() {
	var (
		srcName string
	)
	flag.StringVar(&srcName, "src", "", "镜像名")
	flag.Parse()
	fmt.Println(srcName)
	ctx := context.Background()
	cliOpt := flag2.Options{}
	cliOpt.Target = srcName
	r, err := artifact.NewRunner(ctx, cliOpt)
	if err != nil {
		fmt.Println("artifact.NewRunner err:", err.Error())
		return
	}

	defer r.Close(ctx)
	report, err := r.ScanImage(ctx, cliOpt)
	if err != nil {
		fmt.Println("ScanImage err:", err.Error())
		return
	}
	data, _ := json.Marshal(report)
	fmt.Println(string(data))
}

运行：

./base_image -src nginx:latest

nginx:latest
{"SchemaVersion":2,"ArtifactName":"nginx:latest","ArtifactType":"container_image","Metadata":{"OS":{"Family":"debian","Name":"11.4"},"ImageID":"sha256:41b0e86104ba681811bf60b4d6970ed24dd59e282b36c352b8a55823bbb5e14a","DiffIDs":["sha256:43b3c4e3001c662d1c264ffb132f4e52950893452b15508df810214f1d3f124b","sha256:1c99a7efe9d92fa6e492787de8a3278bc7fbedf371fae96029fda8bb0910f873","sha256:305b0db3a2102757e5eddaf791cdc5e8f6d21dd9fff931230e51a3dc724bb19d","sha256:c03189a5ef7018a691b7ef5970737127f07cce7df283ca3d9b32a00838058990","sha256:1d561d93862806928bb7c99fea4035804ab7e86aa66ae8b547e5cde6856fb5db","sha256:de100bd247e00374c0614bcd52615b847ffb36eebf07d87a3158a41703385867"],"RepoTags":["nginx:latest"],"RepoDigests":["nginx@sha256:db345982a2f2a4257c6f699a499feb1d79451a1305e8022f16456ddc3ad6b94c"],"ImageConfig":{"architecture":"amd64","container":"6fdddc3714ed390e2273b770258aef03b173b6f1be7221ab94f7ab673b7224c8","created":"2022-07-12T05:00:50.081423817Z","docker_version":"20.10.12","history":[{"created":"2022-07-12T01:20:10Z","created_by":"/bin/sh -c #(nop) ADD file:d978f6d3025a06f5142a0c13c98bf12fbd47cdf9162ed31fbc05c86983b0a679 in / "},{"created":"2022-07-12T01:20:10Z","created_by":"/bin/sh -c #(nop)  CMD [\"bash\"]","empty_layer":true},{"created":"2022-07-12T05:00:30Z","created_by":"/bin/sh -c #(nop)  LABEL maintainer=NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e","empty_layer":true},{"created":"2022-07-12T05:00:30Z","created_by":"/bin/sh -c #(nop)  ENV NGINX_VERSION=1.23.0","empty_layer":true},{"created":"2022-07-12T05:00:30Z","created_by":"/bin/sh -c #(nop)  ENV NJS_VERSION=0.7.5","empty_layer":true},{"created":"2022-07-12T05:00:30Z","created_by":"/bin/sh -c #(nop)  ENV PKG_RELEASE=1~bullseye","empty_layer":true},{"created":"2022-07-12T05:00:49Z","created_by":"/bin/sh -c set -x     \u0026\u0026 addgroup --system --gid 101 nginx     \u0026\u0026 adduser --system --disabled-login --ingroup nginx --no-create-home --home /nonexistent --gecos \"nginx user\" --shell /bin/false --uid 101 nginx     \u0026\u0026 apt-get update     \u0026\u0026 apt-get install --no-install-recommends --no-install-suggests -y gnupg1 ca-certificates     \u0026\u0026     NGINX_GPGKEY=573BFD6B3D8FBC641079A6ABABF5BD827BD9BF62;     found='';     for server in         hkp://keyserver.ubuntu.com:80         pgp.mit.edu     ; do         echo \"Fetching GPG key $NGINX_GPGKEY from $server\";         apt-key adv --keyserver \"$server\" --keyserver-options timeout=10 --recv-keys \"$NGINX_GPGKEY\" \u0026\u0026 found=yes \u0026\u0026 break;     done;     test -z \"$found\" \u0026\u0026 echo \u003e\u00262 \"error: failed to fetch GPG key $NGINX_GPGKEY\" \u0026\u0026 exit 1;     apt-get remove --purge --auto-remove -y gnupg1 \u0026\u0026 rm -rf /var/lib/apt/lists/*     \u0026\u0026 dpkgArch=\"$(dpkg --print-architecture)\"     \u0026\u0026 nginxPackages=\"         nginx=${NGINX_VERSION}-${PKG_RELEASE}         nginx-module-xslt=${NGINX_VERSION}-${PKG_RELEASE}         nginx-module-geoip=${NGINX_VERSION}-${PKG_RELEASE}         nginx-module-image-filter=${NGINX_VERSION}-${PKG_RELEASE}         nginx-module-njs=${NGINX_VERSION}+${NJS_VERSION}-${PKG_RELEASE}     \"     \u0026\u0026 case \"$dpkgArch\" in         amd64|arm64)             echo \"deb https://nginx.org/packages/mainline/debian/ bullseye nginx\" \u003e\u003e /etc/apt/sources.list.d/nginx.list             \u0026\u0026 apt-get update             ;;         *)             echo \"deb-src https://nginx.org/packages/mainline/debian/ bullseye nginx\" \u003e\u003e /etc/apt/sources.list.d/nginx.list                         \u0026\u0026 tempDir=\"$(mktemp -d)\"             \u0026\u0026 chmod 777 \"$tempDir\"                         \u0026\u0026 savedAptMark=\"$(apt-mark showmanual)\"                         \u0026\u0026 apt-get update             \u0026\u0026 apt-get build-dep -y $nginxPackages             \u0026\u0026 (                 cd \"$tempDir\"                 \u0026\u0026 DEB_BUILD_OPTIONS=\"nocheck parallel=$(nproc)\"                     apt-get source --compile $nginxPackages             )                         \u0026\u0026 apt-mark showmanual | xargs apt-mark auto \u003e /dev/null             \u0026\u0026 { [ -z \"$savedAptMark\" ] || apt-mark manual $savedAptMark; }                         \u0026\u0026 ls -lAFh \"$tempDir\"             \u0026\u0026 ( cd \"$tempDir\" \u0026\u0026 dpkg-scanpackages . \u003e Packages )             \u0026\u0026 grep '^Package: ' \"$tempDir/Packages\"             \u0026\u0026 echo \"deb [ trusted=yes ] file://$tempDir ./\" \u003e /etc/apt/sources.list.d/temp.list             \u0026\u0026 apt-get -o Acquire::GzipIndexes=false update             ;;     esac         \u0026\u0026 apt-get install --no-install-recommends --no-install-suggests -y                         $nginxPackages                         gettext-base                         curl     \u0026\u0026 apt-get remove --purge --auto-remove -y \u0026\u0026 rm -rf /var/lib/apt/lists/* /etc/apt/sources.list.d/nginx.list         \u0026\u0026 if [ -n \"$tempDir\" ]; then         apt-get purge -y --auto-remove         \u0026\u0026 rm -rf \"$tempDir\" /etc/apt/sources.list.d/temp.list;     fi     \u0026\u0026 ln -sf /dev/stdout /var/log/nginx/access.log     \u0026\u0026 ln -sf /dev/stderr /var/log/nginx/error.log     \u0026\u0026 mkdir /docker-entrypoint.d"},{"created":"2022-07-12T05:00:49Z","created_by":"/bin/sh -c #(nop) COPY file:65504f71f5855ca017fb64d502ce873a31b2e0decd75297a8fb0a287f97acf92 in / "},{"created":"2022-07-12T05:00:49Z","created_by":"/bin/sh -c #(nop) COPY file:0b866ff3fc1ef5b03c4e6c8c513ae014f691fb05d530257dfffd07035c1b75da in /docker-entrypoint.d "},{"created":"2022-07-12T05:00:49Z","created_by":"/bin/sh -c #(nop) COPY file:0fd5fca330dcd6a7de297435e32af634f29f7132ed0550d342cad9fd20158258 in /docker-entrypoint.d "},{"created":"2022-07-12T05:00:49Z","created_by":"/bin/sh -c #(nop) COPY file:09a214a3e07c919af2fb2d7c749ccbc446b8c10eb217366e5a65640ee9edcc25 in /docker-entrypoint.d "},{"created":"2022-07-12T05:00:49Z","created_by":"/bin/sh -c #(nop)  ENTRYPOINT [\"/docker-entrypoint.sh\"]","empty_layer":true},{"created":"2022-07-12T05:00:49Z","created_by":"/bin/sh -c #(nop)  EXPOSE 80","empty_layer":true},{"created":"2022-07-12T05:00:49Z","created_by":"/bin/sh -c #(nop)  STOPSIGNAL SIGQUIT","empty_layer":true},{"created":"2022-07-12T05:00:50Z","created_by":"/bin/sh -c #(nop)  CMD [\"nginx\" \"-g\" \"daemon off;\"]","empty_layer":true}],"os":"linux","rootfs":{"type":"layers","diff_ids":["sha256:43b3c4e3001c662d1c264ffb132f4e52950893452b15508df810214f1d3f124b","sha256:1c99a7efe9d92fa6e492787de8a3278bc7fbedf371fae96029fda8bb0910f873","sha256:305b0db3a2102757e5eddaf791cdc5e8f6d21dd9fff931230e51a3dc724bb19d","sha256:c03189a5ef7018a691b7ef5970737127f07cce7df283ca3d9b32a00838058990","sha256:1d561d93862806928bb7c99fea4035804ab7e86aa66ae8b547e5cde6856fb5db","sha256:de100bd247e00374c0614bcd52615b847ffb36eebf07d87a3158a41703385867"]},"config":{"Cmd":["nginx","-g","daemon off;"],"Entrypoint":["/docker-entrypoint.sh"],"Env":["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","NGINX_VERSION=1.23.0","NJS_VERSION=0.7.5","PKG_RELEASE=1~bullseye"],"Image":"sha256:bcdd0667cf621a29e893be9968d0bad14ccaae14a0b3f91d9c07371bf6f64cd2","Labels":{"maintainer":"NGINX Docker Maintainers \u003cdocker-maint@nginx.com\u003e"},"StopSignal":"SIGQUIT"}}}}

结果为debian

我们运行docker命令来看：

docker run --rm --entrypoint /bin/sh nginx:latest -c 'cat /etc/*-release'

输出如下：

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

也是debian