Amazon ECR support

[srstevenson]

Is it possible to use yair to scan images hosted on Amazon ECR? Adapting the instructions from the README, I hit the following problem where yair still queries Docker Hub:

$ docker run -v $PWD/config.yaml:/opt/yair/config/config.yaml:ro yfoelling/yair xxxxxxxxxx.dkr.ecr.eu-west-1.amazonaws.com/yyyyyyyyyy:z.z.z
401 Client Error: Unauthorized for url: https://registry.hub.docker.com/v2/xxxxxxxxxx.dkr.ecr.eu-west-1.amazonaws.com/yyyyyyyyyy/manifests/z.z.z

[yfoelling]

@srstevenson it seems that your image name is missing an namsapace:

xxxxxxxxxx.dkr.ecr.eu-west-1.amazonaws.com/yyyyyyyyyy:z.z.z

Normaly you will have something like xxxxxxxxxx.dkr.ecr.eu-west-1.amazonaws.com/image_namespace/image_name:image_version or image_namespace/image_name:image_version (if in public docker hub) or kibana:6.2.3 (if in library namespace on public docker hub)

If you leave away the version tag in any of the cases we will assume latest

[srstevenson]

Thanks for the quick reply @yfoelling! I double checked the documentation, and the namespace is optional for ECR: I'm happy to work on a PR to add support for ECR repositories without a namespace, if you foresee that being something you'd merge.

[yfoelling]

@srstevenson if i understand the dokumentation of docker registry right, every image has an namspace (might in this case be some default namespace).

Did you try if you can download your image at this url: xxxxxxxxxx.dkr.ecr.eu-west-1.amazonaws.com/yyyyyyyyyy:z.z.z ?

If you dont find any default namespace or something else, feel free to provide a PR with an fix that works for every image. Until now i do some dirty hack with splitting on "/", that wont work for this case.

[srstevenson]

Indeed, I've exclusively used the xxxxxxxxxx.dkr.ecr.eu-west-1.amazonaws.com/yyyyyyyyyy:z.z.z form when pulling.

I read the the registry documentation, and found V1 of the registry API required a namespace, but V2 no longer does:

Classically, repository names have always been two path components where each path component is less than 30 characters. The V2 registry API does not enforce this.

[yfoelling]

Ok, then we need to adjust the way we split this full qualified image path, to support both api versions.

Feeld free to provide another PR or i will try to fix it in the next few days.

[yfoelling]

@srstevenson I refactored the way args are parsed now, so i could fix your issue now. But the problem is i have no idea how to fix your issue without destroying the possibility to scan images public images in the default namespace ("library/")

If someone provides an image without a namespace, i need to assume that the namespace is "library" . I could make an special case for aws-registries, but that doesnt feel right. Any (better) Ideas?

[yfoelling]

I have released an newer Version with an --no-namspace option. Its not perfect, but now you should be able to use it without namspaces.

[srstevenson]

Thanks @yfoelling!