container

Documentation

Overview

Package container scans container images for OS and language package vulnerabilities.

Index

• Constants
• func FindContainerSpecs(dir string) []string
• func ImagesFromFile(rel, content string) []string
• func IsComposePath(rel string) bool
• func IsContainerSpecPath(rel string) bool
• func IsDockerfilePath(rel string) bool
• func ParseComposeImages(content string) []string
• func ParseImages(content string) []string
• func ReadDockerfile(dir, rel string) (string, bool)
• type ContainerScanner
  • func NewContainerScanner() *ContainerScanner
  • func (s *ContainerScanner) Close() error
  • func (s *ContainerScanner) Init(cfg *core.Config) error
  • func (s *ContainerScanner) Name() string
  • func (s *ContainerScanner) Scan(ctx context.Context, paths []string, findings chan<- core.Finding) error
  • func (s *ContainerScanner) Type() core.ScanType

Constants

const MaxDockerfileBytes = 1 << 20

Prevents an attacker-controlled file from forcing a huge allocation.

Functions

func FindContainerSpecs

func FindContainerSpecs(dir string) []string

FindContainerSpecs walks dir and returns relative paths of Dockerfiles, Containerfiles, and Compose files (skipping vendored / ignored directories).

func ImagesFromFile

func ImagesFromFile(rel, content string) []string

ImagesFromFile dispatches to the right parser based on the file's name.

func IsComposePath

func IsComposePath(rel string) bool

func IsContainerSpecPath

func IsContainerSpecPath(rel string) bool

IsContainerSpecPath returns true for any file we can extract base images from.

func IsDockerfilePath

func IsDockerfilePath(rel string) bool

func ParseComposeImages

func ParseComposeImages(content string) []string

ParseComposeImages returns the images referenced from each service in a Docker Compose file. Skips services that use `build:` (their Dockerfile is scanned separately) and templated values containing ${…}.

func ParseImages

func ParseImages(content string) []string

ParseImages returns FROM image refs, skipping local stages, scratch, and ARG-templated values that can't be resolved without build context.

func ReadDockerfile

func ReadDockerfile(dir, rel string) (string, bool)

ReadDockerfile rejects paths that escape dir and caps the read at MaxDockerfileBytes.

Types

type ContainerScanner

type ContainerScanner struct {
	// contains filtered or unexported fields
}

func NewContainerScanner

func NewContainerScanner() *ContainerScanner

func (*ContainerScanner) Close

func (s *ContainerScanner) Close() error

func (*ContainerScanner) Init

func (s *ContainerScanner) Init(cfg *core.Config) error

func (*ContainerScanner) Name

func (s *ContainerScanner) Name() string

func (*ContainerScanner) Scan

func (s *ContainerScanner) Scan(ctx context.Context, paths []string, findings chan<- core.Finding) error

func (*ContainerScanner) Type

func (s *ContainerScanner) Type() core.ScanType