Anchore Blog

If like me you’re subscribed to receive updates for popular base images such as CentOS, then this morning you may have received an email like this from Anchore. Here, you are receiving a warning that a new, HIGH severity CVE was just found in the CentOS image. You can read more about the vulnerability in Red Hat’s security advisory RHSA-2018:0102 which covers the impact of CVE-2017-3145 on the BIND DNS package.

There are no easy ways to perform a “diff” on Docker container images to see what has changed between versions. While there is a docker diff command this command shows what files have changed in a running container but will not show changes between container images. You could also look at the Dockerfile, however the same Dockerfile used at two different times will likely produce different images since the underlying operating system packages and application files may have been updated.

For most users analyzing or auditing container images usually means running a CVE scan and while that is certainly required, it should be just the first step. Anchore supports creating policies that can be used to assess the compliance of your...

Today Anchore announced the release of Anchore Cloud 2.0 which builds on top of Anchore’s open source engine to provide a suite of tools to allow organizations to perform detailed analysis of container images and apply user defined policies to ensure that containers meet the organization’s security requirements and operational best practices.

In our last blog we talked about how quickly different repos respond to updates to their base images. Any changes made by the base image will need to be implemented in the application images built on top of it, so updates to popular base images spread far and, as we saw from the last blog, quickly.

While that may sound like advice your mother gave you after you got into a fight at school we are actually talking about Docker Images.

Yesterday we started to notice a lot of activity on our worker nodes on anchore.io which were analyzing a large number of images that were updated on DockerHub.

While containers are thought of as “micro-services” or applications, if you open up the image you will see more than just an application – more often than not, you’ll see an an entire operating system image along with the application. If you dig into the image you will find that certain parts of the operating system are missing such as kernel and hardware specific modules and often, but sadly not always, the package list is reduced. If you are deploying a pre packaged container built by a 3rd party you may not even know what operating system has been used to build the container let alone what packages are inside.

Hi, I’m Max de Visser and I’ve recently joined the Anchore team as a Data Analytics Intern. I am working towards a BS in computer science and a minor in statistics at nearby UC Santa Barbara. The recent growth of big data - and data science in...

Ivan Akulov just published a rather worrying blog entitled Malicious Packages in NPM in which he documents a recent discovery of several malicious NPM packages that were copies of existing packages with similar names which while they contained the same functionality they also included malicious code that would collect and exfiltrate environmental variables from your system in the hope of finding sensitive information such as authentication tokens.

We extended one of the most popular features of the Anchore Navigator, tag notifications, in our latest beta. Previously users could subscribe to a tag and receive a notification when a new image was pushed with that tag. For example if you used...

In October 2016 Anchore announced the launch of the Anchore Navigator a free service to allow users to discover and analyze images on public container registries. Since then thousands of users have used the Navigator to search for container...

The majority of Docker users do not built their images from scratch, instead they are built on top of base images that have been created and published by others. Usually these are official images that have been created by an organization or...

In last week’s blog we covered how to create custom policies that can be used to evaluate your container images as part of your CI/CD pipeline or at any time during their lifetime. We explained that you should always perform a CVE scan of your...

Since we released Anchore’s open source project almost a year ago we’ve seen fast growing adoption by users who want to perform detailed inspection and analysis of their container images. By far the most common use case we see with our...

At the heart of Anchore’s solution is the concept of users certifying container images based on rules that they define. In the past certifications for applications typically came from operating systems vendors who defined their own standards and worked with independent software vendors (ISVs) on certification programs to give a level of assurance to end users that the application was compatible with the underlying operating system. Other organizations have created standards and certification tests to cover various forms of compliance validation, especially in the government sector or regulated industries.

At Anchore we spend a whole lot of time looking at container images to provide detailed analysis and certification. Most of the discussions we hear in the industry around image analysis focus on CVE scanning: how many CVEs are in an image,...

What’s going on in the world of Anchore’s open source platform? As you might know, Anchore has an online container image navigator that provides unique visibility into the contents of container images--our system is constantly watching...

Oracle just announced a new container image: Oracle Linux 7-Slim. Their goal was to create a more lean image and improve security in the process, since reducing the footprint of the container also reduces the attack surface. You can check out that...

Docker recently announced an exciting new release of Docker Datacenter that included Integrated Secrets Management from Docker 1.13. Many containers need access to sensitive information as part of their configuration, for example they may need the...

We started the week with an exciting announcement about the Anchore Navigator which received a significant update with many new features, the two new features that are proving to be the most popular are the ability submit an image for analysis and...