30 lines
997 B
Bash
30 lines
997 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
TARGET_IMAGE="${1:?usage: scan-ci-image.sh <image>}"
|
|
TRIVY_IMAGE="aquasec/trivy@sha256:be1190afcb28352bfddc4ddeb71470835d16462af68d310f9f4bca710961a41e"
|
|
SAFE_NAME="$(printf '%s' "$TARGET_IMAGE" | tr -cs 'A-Za-z0-9._-' '-')"
|
|
ARCHIVE_RELATIVE="artifacts/.${SAFE_NAME}.tar"
|
|
ARCHIVE="$ROOT/$ARCHIVE_RELATIVE"
|
|
trap 'rm -f "$ARCHIVE"' EXIT
|
|
|
|
mkdir -p "$ROOT/artifacts"
|
|
docker image inspect "$TARGET_IMAGE" >/dev/null
|
|
docker save --output "$ARCHIVE" "$TARGET_IMAGE"
|
|
|
|
WORKSPACE_ARGS=(-v "$ROOT:/workspace:ro")
|
|
CONTAINER_ARCHIVE="/workspace/$ARCHIVE_RELATIVE"
|
|
if docker inspect "${HOSTNAME:-}" >/dev/null 2>&1; then
|
|
WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
|
|
CONTAINER_ARCHIVE="$ROOT/$ARCHIVE_RELATIVE"
|
|
fi
|
|
|
|
docker run --rm "${WORKSPACE_ARGS[@]}" "$TRIVY_IMAGE" image \
|
|
--input "$CONTAINER_ARCHIVE" \
|
|
--scanners vuln \
|
|
--severity HIGH,CRITICAL \
|
|
--ignore-unfixed \
|
|
--exit-code 1 \
|
|
--format table
|