Anchore Open Source Project – Open Source Container Analysis and Certification
The Anchore open source project allows developers to perform a detailed analysis of their container images, run queries, produce reports, and define policies that can be used in CI/CD pipelines. Developers can extend the tool to add new plugins that add new queries, new image analysis, and new policies.
What You Can Do with Anchore
________
Submit an image to be analyzed
anchore-cli image add library/debian:latest
See if your images have any known CVE vulnerabilities
anchore-cli image vuln myrepo/app:latest os
List all of the files in a particular image
anchore-cli image content myrepo/app:latest files
Evaluate your image against your custom security policy
anchore-cli evaluate check myrepo/app:latest
Subscribe to receive notifications when an image is updated
anchore-cli subscription activate tag_update library/debian:latest
Get started with Anchore using our Wiki
How to Contribute
We encourage contributions to any part of the open-source Anchore command-line tool, whether they be to the tool framework itself or as individual analyzer/gate or query modules that can be dropped into existing Anchore installations. Anchore is using the Apache 2 license. For more contribution information, please see the LICENSE and CONTRIBUTING documents in the main GitHub anchore project page.
The easiest way to contribute to Anchore is to build a new Analyzer, Gate, or Query module. These are simple, self-contained modules that implement a certain kind of functionality within the broader Anchore framework. You can about how to build these modules on our wiki.
If you don’t want to contribute source code, there are lots of other ways to get involved with the project! Most of our documentation is hosted on the GitHub wiki and we would love to review and accept new contributions to our docs–the process is the same, using GitHub pull requests. We may also need help triaging and reproducing user-reported bugs, and if you’re a skilled Anchore user, we would love to have you in our IRC channel, perhaps helping other users. Drop in and say hi!
If you’ve found a bug in Anchore and you’d like to report it to us, please use the GitHub issue tracking system. We would appreciate as much detail as you can provide, including the version of Anchore you are using, your method of installation (OS packages, PIP, source?), what version of Docker you are using, as well as any troubleshooting steps you’ve already attempted. If you are using Anchore for production in a commercial environment, you may want to consider a full support contract so that we can provide a Service Level Agreement for your deployment.