Skip to content

Container Scanning report common output: Execute clair server as a subprocess within the analyzer

Sub-issue of #32934 (closed)

Implementation plan

Implement all the functionality of start.sh in the golang version of the klar analyzer which was implemented here:

  1. Configure/export all the same environment variables
  2. Allow overriding the postgres vulnerabilities database url used by clair
  3. Start the clair server as a background process and ensure that it's responsive before attempting to scan the image
  4. Handle errors from the clair server
  5. Output deprecation warning if the CLAIR_DB_IMAGE_TAG environment variable does not equal latest (see here for details)
  6. Execute the klar binary to initiate a container scan and save the results in memory
  7. Handle errors from klar
  8. Run the golang klar analyzer against the output created in step 6. to produce a gl-container-scanning-report.json file
  9. Ensure the new rails parser can handle the file produced by step 8.
  10. Add unit tests for the above behaviour
  11. Test the new docker image using the container scanning test project
  12. Update the CI configuration to to use the shared CI config
  13. Remove the reference to /container-scanner/start.sh in the Container-Scanning template
    • /container-scanner/start.sh is still needed in order to maintain backward compatibility with the previous container scanning tool
Edited by Adam Cohen