Open patrickschur opened 2 years ago
I can confirm the same issue.
JFrog CLI version: jf version 2.14.0 Artifactory version: 7.37.15 Xray version: 3.47.3
Hi @patrickschur and @kamilsimek-ecb,
First of all, we recently introduced the jf docker scan
, which creates a tar file and runs a specific scan for docker images.
Currently, OCI image (kaniko / podman) scanning is not supported, but adding them is one of our goals for the near future.
Hi @sverdlov93,
we build our images with Kaniko therefore jf docker scan
is not an option for us because it requires Docker.
The result between both commands is also the same. The only difference is that jf docker scan
creates a tar file via docker save
while jf scan
scans arbitrary files and doesn't require Docker at all.
After some digging I came up with a workaround and I'm now using skopeo copy
to change the image format.
You can find the workaround here: https://gist.github.com/patrickschur/6bf5e43f7f1ded22530b646a51ace65a
With the workaround I get the same number of vulnerabilities back as with the image build by Docker. But sometimes I still get strange results back. Here is the result I got with an internal test image:
jf s kaniko.tar # 1 critical, 6 high, 4 medium
jf s skopeo.tar # 1 critical, 6 high, 39 medium, 43 low
jf s docker.tar # 1 critical, 6 high, 39 medium, 43 low
But if I upload the image to Artifactory, Xray finds only 54 vulnerabilities (1 critical, 6 high, 20 medium, 26 low and 1 unknown) while the indexer-app finds much more vulnerabilities in the image. Why are the results so different? I would expect that the indexer-app finds the same number of vulnerabilities as Xray.
Thanks so much for sharing this information @patrickschur! As we're building the new OCI scanning capabilities, we may use the information you provided here. As @sverdlov93 mentioned, this is something we plan to introduce.
@sverdlov93 @eyalbe4 - Do we have timelines when will support for OCI image (kaniko) scanning be available ? Is there documented workaround in the meanwhile ?
Hi @patrickschur @kamilsimek-ecb @Pradebban ,
Since JFrog Xray 3.61.5 jf scan
commands support OCI images (kaniko, podman and etc)
To use the functionality you should use the OCI's save command to create the image tar and then run the jf scan
.
For example:
podman save -o alpine.tar alpine:2.6
jf scan alpine.tar
One of our following goals is to create a direct command for each tech that runs the save command behind the scenes and scans the image's tar. ( like the jf docker scan
command)
Describe the bug The indexer-app detects no vulnerabilities on images build with Kaniko.
To Reproduce
Create a Dockerfile:
Build the image with Kaniko:
Scan the image:
Expected behavior The indexer-app should detect vulnerabilities and support the image format used by Kaniko.
Versions
Additional context At the moment only the image format used by Docker is supported: