Today Anchore announced a new open source project that allows users to install a local copy of the powerful container analysis and policy engine that powers the Anchore Navigator service.
The Anchore Engine is an open source project that provides a centralized service for inspection, analysis and certification of container images. The Anchore Engine is provided as a Docker container image that can be run standalone or on an orchestration platform such as Kubernetes, Docker Swarm, Rancher or Amazon ECS.
Using the Anchore Engine, container images can be downloaded from Docker V2 compatible container registries, analyzed and evaluated against user-defined policies. The Anchore Engine can integrate with Anchore’s Navigator service allowing you to define policies and whitelists using a graphical editor that is automatically synchronized to the Anchore Engine.
The Anchore Engine can be integrated into CI/CD pipelines such as Jenkins to secure your CI/CD pipeline by adding image scanning including not just CVE based security scans but policy-based scans that can include checks around security, compliance and operational best practices.
The Anchore Engine can be accessed directly through a RESTful API or via the Anchore CLI. Adding an image to be analyzed is a simple one-line command:
$ anchore-cli image add docker.io/library/nginx:latest
The Anchore Engine will now download the image from the registry and perform deep inspection collecting data on packages, files, software artifacts and image metadata.
Once analyzed we can retrieve information about the image. For example, retrieving a list of packages:
$ anchore-cli image content docker.io/library/nginx:latest os
Will return a list of operating system (os) packages found in the image. In addition to operating system packages, we can retrieve details about files, Ruby GEMs and Node.JS NPMs.
$ anchore-cli image content docker.io/library/rails:latest gem
Package Version Location actioncable 5.0.1 /usr/local/bundle/specifications/actioncable-5.0.1.gemspec actionmailer 5.0.1 /usr/local/bundle/specifications/actionmailer-5.0.1.gemspec actionpack 5.0.1 /usr/local/bundle/specifications/actionpack-5.0.1.gemspec actionview 5.0.1 /usr/local/bundle/specifications/actionview-5.0.1.gemspec activejob 5.0.1 /usr/local/bundle/specifications/activejob-5.0.1.gemspec activemodel 5.0.1 /usr/local/bundle/specifications/activemodel-5.0.1.gemspec activerecord 5.0.1 /usr/local/bundle/specifications/activerecord-5.0.1.gemspec activesupport 5.0.1 /usr/local/bundle/specifications/activesupport-5.0.1.gemspec arel 7.1.4 /usr/local/bundle/specifications/arel-7.1.4.gemspec
And if we wanted to see how many security vulnerabilities in an image you can run the following command:
$ anchore-cli image vuln docker.io/library/ubuntu:latest os
Vulnerability ID Package Severity Fix Vulnerability URL CVE-2013-4235 login-1:4.2-3.1ubuntu5.3 Low None http://people.ubuntu.com/~ubuntu-security/cve/CVE-2013-4235 CVE-2013-4235 passwd-1:4.2-3.1ubuntu5.3 Low None http://people.ubuntu.com/~ubuntu-security/cve/CVE-2013-4235 CVE-2015-5180 libc-bin-2.23-0ubuntu9 Low None http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-5180 CVE-2015-5180 libc6-2.23-0ubuntu9 Low None http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-5180 CVE-2015-5180 multiarch-support-2.23-0ubuntu9 Low None http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-5180
As with the content sub-command we pass a parameter for the type of content we want to analyze – in this case, OS for operating system packages. Future releases will add support for non-package vulnerability data.
Next, we can evaluate the image against a policy that was defined either manually on the command line or using the Anchore Navigator
$ anchore-cli evaluate check registry.example.com/webapps/frontend:latest
Image Digest: sha256:86774cefad82967f97f3eeeef88c1b6262f9b42bc96f2ad61d6f3fdf54475ac3 Full Tag: registry.example.com/webapps/frontend:latest Status: pass Last Eval: 2017-09-09T18:30:22 Policy ID: 715a6056-87ab-49fb-abef-f4b4198c67bf
Here we can see that the image passed. To see the details of the evaluation you can add the –detail parameter. For example:
$ anchore-cli evaluate check registry.example.com/webapps/broker:latest --detail
Image Digest: sha256:7f97f3eeeef88c1b6262f9b42bc96f2ad61d6f3fdf54475ac354475ac Full Tag: registry.example.com/webapps/broker:latest Status: fail Last Eval: 2017-09-09T17:30:22 Policy ID: 715a6056-87ab-49fb-abef-f4b4198c67bf Gate Trigger Detail Status DOCKERFILECHECK NOHEALTHCHECK Dockerfile does not contain any HEALTHCHECK instructions warn ANCHORESEC VULNHIGH HIGH Vulnerability found in package - libmount1 (CVE-2016-2779 - https://security-tracker.debian.org/tracker/CVE-2016-2779) stop ANCHORESEC VULNHIGH HIGH Vulnerability found in package - libncurses5 (CVE-2017-10684 - https://security-tracker.debian.org/tracker/CVE-2017-10684) stop ANCHORESEC VULNHIGH HIGH Vulnerability found in package - libncurses5 (CVE-2017-10685 - https://security-tracker.debian.org/tracker/CVE-2017-10685) stop
Here you can see that the broker image failed the policy evaluation due to 3 high severity vulnerabilities.
We can subscribe to an image to receive webhook notifications when an image is updated when new security vulnerabilities are found or if the image’s policy status is updated – for example going from Fail to Pass.
$ anchore-cli subscription activate image tag_update registry.example.com/webapps/broker:latest