search

anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache License 2.0
5.82k stars 533 forks source link

Add support for `containers-storage` backend for container images #2107

Closed hkadakia closed 7 months ago

hkadakia commented 10 months ago

What would you like to be added: Support for source path containers-storage when looking for container images.

Why is this needed: We build some of our container images using buildah. Buildah by default puts these locally built container images in containers-storage location. Syft currently does not look for images in that location & hence miss scanning of those images built locally.

A current workaround we are using for syft to locate those images is skopeo copy containers-storage:localhost/test-image:latest docker-archive:/tmp/test-image.tar:test-image:latest. This still has a problem of being lossy and we might land up not having the correct layer info.

Additional context:

tgerla commented 7 months ago

Related to anchore/stereoscope#197

tgerla commented 7 months ago

The work here will be done in Stereoscope and no work will be needed in Syft, so we'll close this one as a duplicate and all work here will be tracked in the Stereoscope issue.