This repo will contain docker images with Blackduck

Current versions available:

.
├── 6
│   ├── golang
│   ├── java
│   ├── node
│   ├── python
│   ├── dotnetcore-2.2.110
│   ├── dotnetcore-3.0.101
│   ├── dotnetcore-3.1.102
│   └── dotnetcore-3.1.302
│   └── docker

Images can be found on https://hub.docker.com/r/philipssoftware/blackduck/.

docker run philipssoftware/blackduck:6 /app/detect.sh --help
docker run philipssoftware/blackduck:6 /app/detect.sh -hv 

In order to analyse a project use the following structure.

Replace all variables with your own variables

docker run -v $(pwd):/code philipssoftware/blackduck:6 /app/detect.sh --blackduck.url=<your-blackduck-url> --blackduck.api.token=<your-token> --blackduck.trust.cert=true --detect.policy.check=true --detect.source.path=/code --detect.project.name=<your-project-name> --detect.project.version.name=<your-version>

# If you can share docker mount with blackduck imageinspector
docker run -v /var/run/docker.sock:/var/run/docker.sock --network="host" philipssoftware/blackduck:6-docker /app/detect.sh --blackduck.url=<your-blackduck-url> --blackduck.api.token=<your-token> --blackduck.trust.cert=true --detect.policy.check=true --detect.project.name=<your-project-name> --detect.project.version.name=<your-version> --detect.docker.image=<your-image>

# If you want to mount and provide blackduck imageinspector working directory
mkdir $(pwd)/shared
docker run -v /var/run/docker.sock:/var/run/docker.sock -v $(pwd):$(pwd) --network="host" -w $(pwd) philipssoftware/blackduck:6-docker /airgap/packaged-inspectors/docker/blackduck-docker-inspector.sh --blackduck.url=<your-blackduck-url> --blackduck.api.token=<your-token> --blackduck.trust.cert=true --detect.policy.check=true --detect.project.name=<your-project-name> --detect.project.version.name=<your-version> --detect.docker.image=<your-image> --shared.dir.path.local=$(pwd)/shared

By setting setting the environment variable DETECT_AIR_GAP to true you can enable Air Gap. This eliminate the need for internet access that Detect requires to download those dependencies. Currently only the gradle inspector is supported. This mode is particularly useful when you are behind a corporate firewall which blocks connections to JFrog Artifactory.

Example:

docker run -e DETECT_AIR_GAP=true -v $(pwd):/code philipssoftware/blackduck:6 /app/detect.sh --blackduck.url=<your-blackduck-url> --blackduck.api.token=<your-token> --blackduck.trust.cert=true --detect.policy.check=true --detect.source.path=/code --detect.project.name=<your-project-name> --detect.project.version.name=<your-version>

The images obviously contain blackduck and java8, but also two other files:

• REPO
• TAGS

This file has a url to the REPO with specific commit-sha of the build. Example:

$ docker run philipssoftware/blackduck:6 cat REPO
https://github.com/philips-software/docker-blackduck/tree/facb2271e5a563e5d6f65ca3f475cefac37b8b6c

This contains all the similar tags at the point of creation.

$ docker run philipssoftware/blackduck:6 cat TAGS

blackduck blackduck:6 blackduck:6.9 blackduck:6.9.0

You can use this to pin down a version of the container from an existing development build for production. When using blackduck:6 for development. This ensures that you've got all security updates in your build. If you want to pin the version of your image down for production, you can use this file inside of the container to look for the most specific tag, the last one.

• blackduck, blackduck:6, blackduck:6.9, blackduck:6.9.0 6/java/Dockerfile

• blackduck:node, blackduck:6-node, blackduck:6.9-node, blackduck:6.9.0-node 6/node/Dockerfile

• blackduck:python, blackduck:6-python, blackduck:6.9-python, blackduck:6.9.0-python 6/python/Dockerfile

• blackduck:golang, blackduck:6-golang, blackduck:6.9-golang, blackduck:6.9.0-golang 6/golang/Dockerfile

• blackduck:dotnetcore-2.2.110, blackduck:6-dotnetcore-2.2, blackduck:6.9-dotnetcore-2.2.110, blackduck:6.9.0-dotnetcore-2.2.110 6/dotnetcore-2.2.110/Dockerfile

• blackduck:6.9-dotnetcore-3.0, blackduck:6.9.0-dotnetcore-3.0.101 6/dotnetcore-3.0.101/Dockerfile

• blackduck:6.9.0-dotnetcore-3.1.102 6/dotnetcore-3.1.102/Dockerfile

• blackduck:dotnetcore, blackduck:6-dotnetcore, blackduck:6-dotnetcore-3, blackduck:6-dotnetcore-3.1, blackduck:6.9-dotnetcore, blackduck:6.9-dotnetcore-3.1, blackduck:6.9.0-dotnetcore, blackduck:6.9.0-dotnetcore-3.1.302 6/dotnetcore-3.1.302/Dockerfile

• blackduck:docker, blackduck:6-docker, blackduck:6.9-docker, blackduck:6.9.0-docker 6/docker/Dockerfile

Why do we have our own docker image definitions?

We often need some tools in a container for checking some things. F.e. jq, aws-cli and curl. We can install this every time we need a container, but having this baked into a container seems a better approach.

That's why we want our own docker file definitions.

Currently this image only has java. Running a project with yarn or npm will not work yet.

• If you have an issue: report it on the issue tracker

License is MIT. See LICENSE file

This module is part of the Philips Forest.

                                                     ___                   _
                                                    / __\__  _ __ ___  ___| |_
                                                   / _\/ _ \| '__/ _ \/ __| __|
                                                  / / | (_) | | |  __/\__ \ |_
                                                  \/   \___/|_|  \___||___/\__|  

                                                                 Infrastructure

Talk to the forestkeepers in the docker-images-channel on Slack.