Integrate the ECS Prisma/Twistlock scanner code into the Container Scanning image

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Close this issue

Proposal

The Vulnerability Management team needs to use the Prisma (aka twistlock) container scanner for certain internal purposes, and has written a CI/CD component sufficient for those purposes. This was originally planned to be released separately to the built-in container scanner but after some discussion we instead plan to add this functionality to the existing built-in container scanner code-base.

I discussed this with @tkopel the other day and there were a few areas that needed further discussion and investigation so I'm documenting them here so we can work on them.

• How will Prisma licensing work?
  • All previous work assumed the customer would supply their own
• How long would it take?
  • I'm not familiar enough with the existing code base to know for sure, but I'll dive in and do some reading
• Does this need to be supported or is it OK to just be an experiment?
  • Experiment is fine
• How will the dind docker dependency work?
  • I did some research on this and it looks like more recent versions of Prisma support a --tarball option and a local tarball. If existing reusable code exists to fetch an image tarball then this should be a simple enough change.