Docker Scan (Trivy)

Importing Trivy container image scan results to FutureVuls

aquasecurity/trivy is an OSS tool to detect vulnerabilities in Docker images. FutureVuls can import Trivy scan results, allowing you to manage container image vulnerabilities on FutureVuls.

For details on the supported languages and package ecosystems, refer to Trivy Supported OS.

You can use Trivy container image scanning in two ways:

• Install Trivy in your local environment and scan images
• Integrating with CI/CD pipelines

Installing Trivy in your local environment and scanning images

Install Trivy in your local environment and upload the results of scanning container images to FutureVuls. You can choose between two installation modes: normal and lightweight. The differences are as follows:

Scanning a new container image

To scan a new container image and register it with FutureVuls, follow these steps:

1. Open the dialog by selecting Add Server on the Server tab and selecting Scan Container Images.
2. Select the scan token and enter the image name of the target container image.
   • Specify in the <image name>:<tag> format.
   • If you always want to scan the latest version of the image, specify <image name>:<latest>.
3. If you are in a proxy environment, enter the proxy server to be used.
4. If you want to use the lightweight version, check the switch bar.
5. Copy and paste the command displayed at the bottom of the screen, and execute it in the local environment that manages the target image.
   • For the normal version, execute with root privileges.
6. Check that the scanned image has been added to the server tab of the target group in FutureVuls.
   • For the normal version, it takes about 5-10 minutes for the changes to be reflected in FutureVuls.
     • If you want to scan immediately after installation, execute the following command:
       • /opt/vuls-trivy-saas/vuls-trivy-saas.sh &> /opt/vuls-trivy-saas/vuls-trivy.log

Registration is complete. For the normal version, the scanner will automatically start once a day to scan the target container images and reflect them in FutureVuls.

For the normal version, you can also use several scan options.

If the scan results are not reflected, refer to here.

Update registered container image information

Update vulnerability information based on the registered configuration information

If you want to update vulnerability information based on the registered configuration information of a container image that is already registered in FutureVuls, manually run the scan from FutureVuls.

Reflect changes in container image configuration information in FutureVuls

If there are any changes to the container image configuration information registered in FutureVuls, follow these steps to reflect them in FutureVuls.

• For the normal version:
  • Since the scanner starts once a day to scan the image, there is no need for any additional operation.
  • If you want to start the scanner immediately, execute the following command with root or vuls-trivy-saas user:
    • /opt/vuls-trivy-saas/vuls-trivy-saas.sh &> /opt/vuls-trivy-saas/vuls-trivy.log
• For the lightweight version:
  1. Click the target container image in the server tab to open the server details page.
  2. Click the Update Configuration Information button to open the dialog.
  3. Select the scanner token and enter the image name of the target container image.
  4. If you are in a proxy environment, enter the proxy server to be passed through.
  5. Copy the command displayed at the bottom of the screen and paste it into the local environment managing the target image to execute.

Integration with CI/CD pipeline

Integrate Trivy into your CI/CD pipeline and upload the scan results of container images to FutureVuls. This document provides an example using GitHub Actions. The sample YAML file for GitHub Actions is as follows.

• Environment variables used in the sample

• If you want to update the configuration information of an image that is already managed on FutureVuls, specify the UUID of the target image as VULS_SAAS_UUID.

Download the scan script

In this example, a script file for scanning is used to perform the scan.

name: FutureVuls Docker Image Scan
on:
  push
defaults:
  run:
      shell: bash
jobs:
  docker-test:
    name: FutureVuls Docker Image Scan
    env:
      VULS_SAAS_GROUPID: ${{ secrets.VULS_SAAS_GROUPID }}
      VULS_SAAS_TOKEN: ${{ secrets.VULS_SAAS_TOKEN }}
      DOCKERFILE_PATH: "docker/anything/Dockerfile"
      TARGET_IMAGE: "imageName:tag"
      VULS_SAAS_UUID: "xxxxxxxx"
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: cached scan db
      uses: actions/cache@v3
      with:
        path: vulndb/
        key: trivy-vulndb
    - name: scan and upload
      env: 
      run: |
        docker build . -f ${env.DOCKERFILE_PATH} -t ${env.TARGET_IMAGE}
        curl -s https://installer.vuls.biz/vuls-trivy-light.sh | \
        VULS_SAAS_GROUPID="${env.VULS_SAAS_GROUPID}" \
        VULS_SAAS_TOKEN="${env.VULS_SAAS_TOKEN}" \
        TARGET_IMAGE="${env.TARGET_IMAGE}" \
        VULS_SAAS_UUID="${env.VULS_SAAS_UUID}" \
        bash -s inst        

Using Docker image

In this example, scanning is performed using a Docker image for scanning.

name: FutureVuls Docker Image Scan
on:
  push
defaults:
  run:
      shell: bash
jobs:
  container-scan:
    name: FutureVuls Docker Image Scan
    env:
      VULS_SAAS_GROUPID: xxx
      VULS_SAAS_TOKEN: xxxxxxxxx
      FVULS_AUTH_URL: "https://auth.vuls.biz/one-time-auth"
      DOCKERFILE_PATH: "path/to/dockerfile"
      TARGET_IMAGE: "image-name"
      VULS_SAAS_UUID: xxxxxxxxx
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4
    - name: cached scan db
      uses: actions/cache@v3
      with:
        path: vulndb/
        key: trivy-vulndb
    - name: Build dockerfile
      run: docker build . -f ${{ env.DOCKERFILE_PATH }} -t ${{ env.TARGET_IMAGE }}
    - name: Scan the image and upload to FutureVuls
      uses: docker://vuls/fvuls
      with:
        entrypoint: '/bin/sh'
        args: |-
          -c "\
          set -eo pipefail
          trivy -q --cache-dir vulndb/ image -f json --list-all-pkgs ${{ env.TARGET_IMAGE }} | \
          trivy-to-vuls parse --stdin | \
          future-vuls upload --stdin --group-id ${{ env.VULS_SAAS_GROUPID }} --token ${{ env.VULS_SAAS_TOKEN }} --uuid ${{ env.VULS_SAAS_UUID }} \
          "          

When Scanning Fails

Refer to the FAQ