Bug 1329056

Summary: [RFE] Support scanning a remote container image
Product: Red Hat Enterprise Linux 7 Reporter: Alex Jia <ajia>
Component: atomicAssignee: Brent Baude <bbaude>
Status: ASSIGNED --- QA Contact: atomic-bugs <atomic-bugs>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.4CC: amurdaca, dwalsh, miabbott
Target Milestone: rcKeywords: Extras, FutureFeature, Security
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Release Note
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Description Alex Jia 2016-04-21 04:07:28 UTC
Description of problem:
At present, we only scan local container images by atomic scan, it means user must pull container images to the local then scan them, it's not very convenient for users, who perhaps only want to see if it exists a CVE in the container/container image, we have a similar application instance for atomic info --remote.

Version-Release number of selected component (if applicable):
# rpm -q atomic docker
atomic-1.9-4.gitff44c6a.el7.x86_64
docker-1.9.1-28.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. make sure oscapd is running firstly
2. atomic scan <remote_image>


Actual results:

Unable to associate '<remote_image>' with an image or container

Expected results:


Additional info:

Comment 2 Daniel Walsh 2016-06-03 19:52:35 UTC
Since this is scanning a rootfs, we can not scan remotely currently.  But once we explode content onto a registry then you would be able to mount and scan the image.  We could also pull the image without installing it via atomic command.

Comment 3 William Temple 2016-06-06 14:25:38 UTC
(In reply to Alex Jia from comment #0)
> we have a similar application instance for atomic info --remote

The `info` command only needs to get a metadata file from the registry. A scan requires that the entire contents of the image are available to the machine running the scan. Whether that's by pulling it or by making it available on a shared storage medium, the only way to scan a remote resource is by first making it a local one.

(In reply to Daniel Walsh from comment #2)
> Since this is scanning a rootfs, we can not scan remotely currently.  But
> once we explode content onto a registry then you would be able to mount and
> scan the image.  We could also pull the image without installing it via
> atomic command.

Even if we just download the tar, we will have to explode it first to scan it. I'm not sure there's a meaningful difference between pulling the image and exploding it onto the Docker graphdriver vs. pulling the image and exploding it somewhere else. Somehow we have to be able to mount the rootfs into the scanning container.

Long-term, we'd like the atomic registry to be able to scan containers at configurable intervals (or whenever the registry admin prefers), so we could have tooling in the atomic command to query scan results, but we won't be able to do this for images hosted on Docker Hub, likely ever.

Comment 4 Antonio Murdaca 2016-06-06 14:30:57 UTC
Can we make this _remote_ scanning a feature of our RH registry (or Atomic Registry perhaps) so that we also have a nice UI with Cockpit to show scanning results? Then, probably provide an API directly so atomic tool can consume to provide scanning results. Does this make any sense?

Comment 5 William Temple 2016-06-06 18:11:44 UTC
(In reply to Antonio Murdaca from comment #4)
> Can we make this _remote_ scanning a feature of our RH registry (or Atomic
> Registry perhaps) so that we also have a nice UI with Cockpit to show
> scanning results? Then, probably provide an API directly so atomic tool can
> consume to provide scanning results. Does this make any sense?

I was just thinking about this. We could have an API extension for the atomic registry that would allow users with appropriate privileges to trigger scans. We could also scan images on docker.io by using the atomic registry as a proxy, pulling them to the atomic registry first and scanning them there.

Comment 6 Daniel Walsh 2016-06-07 18:34:14 UTC
Sure but it would be nice to some how which image was scanned by which version of the scanning container.  So I don't need to scan an image if it was already scanned at the registry by the same scanning container.