JupiterOne / starbase

Graph-based security analysis for everyone
Mozilla Public License 2.0
337 stars 32 forks source link

Make customizable base container image available on GitHub Container Registry #71

Closed andrewnicolalde closed 2 years ago

andrewnicolalde commented 2 years ago

This pull request makes a customizable base container image for Starbase available to users via GitHub Container Registry.

Making these images available in a container registry is useful because, among other reasons, Starbase users will always have a reference environment in which to run Starbase, i.e. with the same OS version and OS package versions.

This differs from the current setup where each user simply clones the Starbase repo and builds a container image, installing whatever OS package versions happen to be current at the time they build the image, which obviously could vary between users of the same release of Starbase.

Since user configuration will obviously differ between users, this image does not include a config.yaml, since it wouldn't be meaningful in this context. Instead, a section has been added to the README explaining how users should supply configuration to a container based on this image.

Similar PR made for Lyft's Cartography project: https://github.com/lyft/cartography/pull/851

andrewnicolalde commented 2 years ago

These checks should now pass after the gitleaks action was removed in https://github.com/JupiterOne/starbase/pull/72, but I can't seem to figure out how to actually re-run these checks in this PR :/

andrewnicolalde commented 2 years ago

Thanks for the approval! Looks like I don't have permissions to merge this, so could you merge it for me @adam-in-ict ?

andrewnicolalde commented 2 years ago

Looks like while the image did get built and pushed to GHCR, JupiterOne has configured starbase's packages to be private by default. Looks like you can change the starbase package visibility this way, which should make the starbase container image public.

austinkelleher commented 2 years ago

@andrewnicolalde Thanks for the follow-up. We are currently waiting for our security team to approve this change. We'll update when the image is public.

austinkelleher commented 2 years ago

@andrewnicolalde The image is now public. Let us know how it goes! Thanks again.