Child pages
  • Anchore Container Image Scanner Plugin

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Reformatting content

...

In the typical workflow this container image is then run through automated testing. If an image does not meet your organization’s requirements for security or compliance then it makes little sense to invest the time required to perform automated tests on the image, it would be better to “learn fast” by failing the build and returning the appropriate reports back to the developer to allow the issue to be addressed.

 

Image Modified 

 

 

 

 

 

 

 

Plugin Modes

Before getting started, one of two plugin operating 'modes' must be selected. Selecting a mode will configure the plugin to either use a direct anchore scanner (which must be installed on each Jenkins worker node), or a second mode which configures the plugin to interact with the Anchore Engine service API (where the Anchore engine has been installed with its service API accessible from the worker nodes). Depending on which mode you select, the initial configuration/usage will differ.

...

Once installed, one of two 'modes' must be selected (Manage Jenkins -> Configure System -> Anchore Plugin Mode), which will configure the plugin to either use a direct anchore scanner (which must be installed on each Jenkins worker node), or a second mode which configures the plugin to interact with the anchore engine service API (where the anchore engine has been installed with its service API accessible from the worker nodes). Depending on which mode you select, the initial configuration/usage will differ.

 

Installation

The Anchore plugin has been published in the Jenkins plugin registry and is available for installation on any Jenkins server.

From the main Jenkins menu select Manage Jenkins

...

Adding Anchore Scanning to Jenkins Build

The Anchore plugin can be added a build step for a Freestyle or Pipeline build. Typically the flow is as follows.

A Jenkins job will:

  1. Build a container image
  2. Push the image to a Docker Registry, typically a staging registry for QA
  3. Use Anchore Plugin in a Pipeline job or add Anchore Container Image Scanner build step to a Freestyle job to instruct the Anchore Engine to analyze the image
    1. The Anchore Engine downloads (pulls) the image layers from the staging registry
    2. The Anchore Engine performs analysis on the image
    3. The Anchore Engine performs a policy evaluation on the image.
  4. The Anchore Plugin polls the Anchore Engine for a user defined period until the analysis and policy evaluation is complete
  5. Based on user configuration, the Anchore Plugin may fail the build in the case of a Policy violation or allow the built to continue with warnings.

When run, the Anchore Plugin will look for a file named anchore_images in the project workspace. This file should contain the name(s) of containers to be scanned and optionally include the Dockerfile. 

Freestyle 

In the example below an Execute Shell build step is used to build and push a container image to a local registry.

 

Code Block
languagebash
themeEmacs
TAG=$(date "+%H%M%S%d%m%Y")
IMAGENAME=build.example.com/myapp
docker build -t $IMAGENAME:$TAG .
docker push $IMAGENAME:$TAG

 

We will add a single line to create the anchore_images file that is read by the Anchore Plugin

Note: Multiple lines can be added if the build produces more than a single container image.

 

Code Block
languagebash
themeEmacs
TAG=$(date "+%H%M%S%d%m%Y")
IMAGENAME=build.example.com/myapp
docker build -t $IMAGENAME:$TAG .
docker push $IMAGENAME:$TAG

# Line added to create anchore_images file
echo "$IMAGENAME:$TAG ${WORKSPACE}/Dockerfile " > anchore_images

 

After the image has been built and pushed to the staging registry the Anchore Scanner should be called. 

Dropdown Add build step and select the Anchore Container Image Scanner

A new build step labeled Anchore Build Options will appear in your job.

<Insert image here>

OptionDescription
Image list fileName of the file, present in workspace that contains the image name and optionally Dockerfile location
Fail build on policy check STOP resultIf the Anchore Engine policy evaluate returns a fail (STOP) then the Jenkins job should be failed. If this is not selected then a failed policy evaluation will allow the build to continue.
Fail build on critical plugin errorIf selected and the Anchore Plugin experiences a critical error the the build will be failed. This is typically used to ensure that a fault with the Anchore Engine (eg. service not available) does not permit a failing image to be promoted to production.
AnchoreEngine operation retriesHow long in seconds the Anchore Plugin waits until timing out image analysis.
The Plugin will continue operation once the image has been analyzed but will time out if this period is exceeded.

 

The Anchore Plugin creates an Anchore Report directory that includes a JSON file including the results of the policy evaluation.

The Plugin renders this in the Jenkins UI showing the status of the build (GO = Pass, STOP = Fail, WARN=Warning)

Clicking on the Anchore Report link will display a graphical policy reporting showing the summary information and a detailed list of policy checks and results.

Pipeline

Following is a sample code snippet for using Anchore Plugin in a pipeline script. For more options refer to Pipeline Syntax and try the Snippet Generator

Code Block
languagebash
themeEmacs
node {
  def imageLine = 'debian:latest'
  writeFile file: 'anchore_images', text: imageLine
  anchore name: 'anchore_images'
}