search

CrowdStrike / container-image-scan

Code to scan a container with CrowdStrike and return response codes indicating pass/fail status.
MIT License
35 stars 23 forks source link

Need Podman Support #92

Closed JtMotoX closed 5 months ago

JtMotoX commented 5 months ago

I understand your difficulty in making this work since the podman container won't have access to the host podman image store. Would it be possible to do podman save alpine:latest > alpine_latest.tar then mount the tar file with -v /path/to/alpine_latest.tar:/image.tar to my inner podmain container and have 'cs_imagescan.py' scan this saved image file?

We have been running the following Docker command within our CI/CD pipelines: docker run --rm -e FALCON_CLIENT_ID -e FALCON_CLIENT_SECRET -v /var/run/docker.sock:/var/run/docker.sock quay.io/crowdstrike/container-image-scan:latest --repo alpine --tag latest --log-level DEBUG

We are now in the process of switching from Docker to Podman for security purposes and have found that we are not able to run the scans using podman.

Running the following command fails: podman run --rm -e FALCON_CLIENT_ID -e FALCON_CLIENT_SECRET quay.io/crowdstrike/container-image-scan:latest --repo alpine --tag latest --log-level DEBUG

With this error:

DEBUG   Trying paths: ['/root/.docker/config.json', '/root/.dockercfg']
DEBUG   No config file found
DEBUG   Trying paths: ['/root/.docker/config.json', '/root/.dockercfg']
DEBUG   No config file found
ERROR   Unknown error
Traceback (most recent call last):
  File "/root/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 793, in urlopen
    response = self._make_request(
  File "/root/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 496, in _make_request
    conn.request(
  File "/root/.local/lib/python3.9/site-packages/urllib3/connection.py", line 400, in request
    self.endheaders()
  File "/usr/lib/python3.9/http/client.py", line 1250, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.9/http/client.py", line 1010, in _send_output
    self.send(msg)
  File "/usr/lib/python3.9/http/client.py", line 950, in send
    self.connect()
  File "/root/.local/lib/python3.9/site-packages/docker/transport/unixconn.py", line 26, in connect
    sock.connect(self.unix_socket)
FileNotFoundError: [Errno 2] No such file or directory

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/root/.local/lib/python3.9/site-packages/requests/adapters.py", line 589, in send
    resp = conn.urlopen(
  File "/root/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 847, in urlopen
    retries = retries.increment(
  File "/root/.local/lib/python3.9/site-packages/urllib3/util/retry.py", line 470, in increment
    raise reraise(type(error), error, _stacktrace)
  File "/root/.local/lib/python3.9/site-packages/urllib3/util/util.py", line 38, in reraise
    raise value.with_traceback(tb)
  File "/root/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 793, in urlopen
    response = self._make_request(
  File "/root/.local/lib/python3.9/site-packages/urllib3/connectionpool.py", line 496, in _make_request
    conn.request(
  File "/root/.local/lib/python3.9/site-packages/urllib3/connection.py", line 400, in request
    self.endheaders()
  File "/usr/lib/python3.9/http/client.py", line 1250, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.9/http/client.py", line 1010, in _send_output
    self.send(msg)
  File "/usr/lib/python3.9/http/client.py", line 950, in send
    self.connect()
  File "/root/.local/lib/python3.9/site-packages/docker/transport/unixconn.py", line 26, in connect
    sock.connect(self.unix_socket)
urllib3.exceptions.ProtocolError: ('Connection aborted.', FileNotFoundError(2, 'No such file or directory'))

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/root/.local/lib/python3.9/site-packages/docker/api/client.py", line 223, in _retrieve_server_version
    return self.version(api_version=False)["ApiVersion"]
  File "/root/.local/lib/python3.9/site-packages/docker/api/daemon.py", line 181, in version
    return self._result(self._get(url), json=True)
  File "/root/.local/lib/python3.9/site-packages/docker/utils/decorators.py", line 44, in inner
    return f(self, *args, **kwargs)
  File "/root/.local/lib/python3.9/site-packages/docker/api/client.py", line 246, in _get
    return self.get(url, **self._set_request_timeout(kwargs))
  File "/root/.local/lib/python3.9/site-packages/requests/sessions.py", line 602, in get
    return self.request("GET", url, **kwargs)
  File "/root/.local/lib/python3.9/site-packages/requests/sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
  File "/root/.local/lib/python3.9/site-packages/requests/sessions.py", line 703, in send
    r = adapter.send(request, **kwargs)
  File "/root/.local/lib/python3.9/site-packages/requests/adapters.py", line 604, in send
    raise ConnectionError(err, request=request)
requests.exceptions.ConnectionError: ('Connection aborted.', FileNotFoundError(2, 'No such file or directory'))

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/app/cs_imagescan.py", line 481, in main
    client = docker.from_env()
  File "/root/.local/lib/python3.9/site-packages/docker/client.py", line 94, in from_env
    return cls(
  File "/root/.local/lib/python3.9/site-packages/docker/client.py", line 45, in __init__
    self.api = APIClient(*args, **kwargs)
  File "/root/.local/lib/python3.9/site-packages/docker/api/client.py", line 207, in __init__
    self._version = self._retrieve_server_version()
  File "/root/.local/lib/python3.9/site-packages/docker/api/client.py", line 230, in _retrieve_server_version
    raise DockerException(
docker.errors.DockerException: Error while fetching server API version: ('Connection aborted.', FileNotFoundError(2, 'No such file or directory'))
JtMotoX commented 5 months ago

Found a workaround by pushing the image before running the scanner, then passing --skip-push to the scanner so it is only retrieving the results.

podman tag myimage:1.0 container-upload.us-1.crowdstrike.com/myimage:1.0
podman login container-upload.us-1.crowdstrike.com --username "${FALCON_CLIENT_ID}" --password-stdin <<< "${FALCON_CLIENT_SECRET}"
podman push container-upload.us-1.crowdstrike.com/myimage:1.0
podman run --rm -e FALCON_CLIENT_ID -e FALCON_CLIENT_SECRET quay.io/crowdstrike/container-image-scan:latest --repo myimage --tag 1.0 --log-level DEBUG --skip-push