Comments (5)
To try to clarify the ask here, the idea would be to try to integrate with the Registry and the Registry would do the scan. Or the idea is that imgpkg
should integrate directly with tools like trivy
and claire
, as Harbour does?
The following registries do vulnerability check already:
- Harbor does not export an API
- quay
- Google Cloud Registry
- Azure Container Registry, does the vulnerability check but doesn't look like it gives and API to get that information
- Amazon Container Registry
- Docker has a CLI plugin that uses Snyk to do the scan but doesn't look like it as an API
from imgpkg.
Registry would do the scan
some other service (like registry) would do the scan. imgpkg hopefully would be able to retrieve results for the scan since it knows which images are in the bundle.
from imgpkg.
This seems like a good idea, it's unfortunate that there isn't a universal API that we could try to target regardless of registry used. Though, we could always figure out the registry and have a mapping to their endpoints (if available).
What format should this output take? Would this be a part of some automation around e.g. failing a CI if an image has vulnerabilities? Or is there any automation component to this request?
from imgpkg.
@DennisDenuto and I were reviewing this further, and we will go ahead and add a story to our backlog to further discuss how to make this happen.
from imgpkg.
+1 this would be a great feature!
from imgpkg.
Related Issues (20)
- Having the log implementation all internal causes friction when consuming imgpkg as a library
- Case when the registry link for pull is a image but the flags are -I along with —image-is-bundle-check flag=true which results in the image being pulled. HOT 5
- Are you using imgpkg?
- add ability to specify the select directories/files to be pulled/outputted. HOT 6
- Relocating bundle to Google Artifact Registry using `--repo-based-tags` fails HOT 1
- Sign `imgpkg` binaries while releasing them HOT 1
- imgpkg should emit plain text to be used in pipelines by default
- Add a limiter for pushing images HOT 3
- imgpkg miscalculates apache/nifi copy, produces corrupt image layer when copying apache/nifi in a bundle HOT 1
- Consider using OCI compliant media-types HOT 2
- imgpkg with flag --json swallows error
- Command `describe` does not include `metadata`. HOT 1
- imgpkg v0.40.0 breaks with relocated image HOT 2
- Imgpkg describe fails to print the output for the larger images HOT 1
- Update copyright headers
- Imgpkg describe fails to describe a bundle pushed to the repo
- Upgrade cosign version to latest version in GitHub workflows
- Cannot build for `GOARCH=386`
- Is there any way to disable progress bar shown during pushing of images ? HOT 5
- Bring tests against harbor back
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from imgpkg.