From 5865fed31f56eab5a776422d6a5719229d5005b4 Mon Sep 17 00:00:00 2001 From: "eloy.moreno" Date: Wed, 8 Mar 2023 15:58:37 +0100 Subject: [PATCH 1/4] docker build if is a Dockerfile --- pkg/cmd/main.go | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/pkg/cmd/main.go b/pkg/cmd/main.go index fc216dd..dce878d 100644 --- a/pkg/cmd/main.go +++ b/pkg/cmd/main.go @@ -10,6 +10,7 @@ import ( "net" "os" "os/exec" + "path/filepath" "regexp" "runtime" "strconv" @@ -347,6 +348,39 @@ func beforeCheckRun(params backend.RunParams, rc *docker.RunConfig, // and the check can access it. if params.AssetType == "DockerImage" { rc.HostConfig.Binds = append(rc.HostConfig.Binds, "/var/run/docker.sock:/var/run/docker.sock") + // check if the target is a file and build if it is + _, err := os.Stat(params.Target) + if err == nil { + currentDirectory, err := os.Getwd() + if err != nil { + currentDirectory = "" + } + targetName := filepath.Base(currentDirectory) + "_" + strings.ReplaceAll(params.Target, "/", "_") + ":latest" + targetName = strings.ToLower(targetName) + log.Debugf("Building docker image from file=" + params.Target) + cmd := exec.Command("docker", "build", "-t", targetName, "-f", params.Target, ".") + var cmdOut bytes.Buffer + var stdErr bytes.Buffer + cmd.Stdout = &cmdOut + cmd.Stderr = &stdErr + err = cmd.Run() + if err != nil { + log.Errorf("Error building docker %v %v", err, cmdOut.String()) + log.Debugf("Error:%v", stdErr.String()) + log.Debugf("Docker image build with tag " + targetName) + } else { + log.Debugf("%v", stdErr.String()) + check := getCheckByID(checks, params.CheckID) + if check == nil { + log.Errorf("check not found id=%s", params.CheckID) + return nil + } + newTarget = targetName + log.Debugf("swaping target=%s new=%s check=%s", params.Target, newTarget, params.CheckID) + check.NewTarget = newTarget + rc.ContainerConfig.Env = upsertEnv(rc.ContainerConfig.Env, backend.CheckTargetVar, newTarget) + } + } // Some checks will fail because the reachability check as they // expect remote urls. This will bypass the check From 16fbe39b2be2246d28c5329226234c7510c5960e Mon Sep 17 00:00:00 2001 From: "eloy.moreno" Date: Wed, 8 Mar 2023 16:06:31 +0100 Subject: [PATCH 2/4] added exec test with docker build --- resources/Dockerfile_2 | 9 +++++++++ script/test.sh | 4 ++++ vulcan_bis.yaml | 31 +++++++++++++++++++++++++++++++ 3 files changed, 44 insertions(+) create mode 100644 resources/Dockerfile_2 create mode 100644 vulcan_bis.yaml diff --git a/resources/Dockerfile_2 b/resources/Dockerfile_2 new file mode 100644 index 0000000..2e25508 --- /dev/null +++ b/resources/Dockerfile_2 @@ -0,0 +1,9 @@ +# Copyright 2021 Adevinta + +FROM docker:20.10-git + +WORKDIR /app + +COPY vulcan-local . + +ENTRYPOINT [ "/app/vulcan-local" ] diff --git a/script/test.sh b/script/test.sh index c133da8..7d90c99 100755 --- a/script/test.sh +++ b/script/test.sh @@ -24,6 +24,10 @@ echo "Test local docker image" ./vulcan-local -t path/vulcan-local:xxx -a DockerImage -i trivy echo "exit=$?" +echo "Test build docker image from Dockerfile" +./vulcan-local -t Dockerfile -a DockerImage -i trivy +echo "exit=$?" + echo "Docker test based on yaml config" docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ -v "$PWD":/target -e TRAVIS_BUILD_DIR=/target \ diff --git a/vulcan_bis.yaml b/vulcan_bis.yaml new file mode 100644 index 0000000..bb4007d --- /dev/null +++ b/vulcan_bis.yaml @@ -0,0 +1,31 @@ +conf: + # Variables needed by some checks. + vars: + # Credentials for cloning private repositories + GITHUB_ENTERPRISE_ENDPOINT: ${GITHUB_ENTERPRISE_ENDPOINT} + GITHUB_ENTERPRISE_TOKEN: ${GITHUB_ENTERPRISE_TOKEN} + + # Credentials to pass to the checks to pull private images + REGISTRY_DOMAIN: ${REGISTRY_SERVER} + REGISTRY_USERNAME: ${REGISTRY_USERNAME} + REGISTRY_PASSWORD: ${REGISTRY_PASSWORD} + + # Registry credentials to pull checks from private registries + registries: + - server: ${REGISTRY_SERVER} + username: ${REGISTRY_USERNAME} + password: ${REGISTRY_PASSWORD} + + # *Always*, Never, IfNotPresent + pullPolicy: IfNotPresent + + # Number of checks to run concurrently + concurrency: 5 + +targets: + + - target: ${DOCKER_IMAGE:-Dockerfile} + assetType: DockerImage + + - target: ${DOCKER_IMAGE:-resources/Dockerfile_2} + assetType: DockerImage \ No newline at end of file From 03ae2afa3613b62446e6add653b3b3b563842787 Mon Sep 17 00:00:00 2001 From: eloymg Date: Tue, 14 Mar 2023 17:10:28 +0100 Subject: [PATCH 3/4] Delete vulcan_bis.yaml --- vulcan_bis.yaml | 31 ------------------------------- 1 file changed, 31 deletions(-) delete mode 100644 vulcan_bis.yaml diff --git a/vulcan_bis.yaml b/vulcan_bis.yaml deleted file mode 100644 index bb4007d..0000000 --- a/vulcan_bis.yaml +++ /dev/null @@ -1,31 +0,0 @@ -conf: - # Variables needed by some checks. - vars: - # Credentials for cloning private repositories - GITHUB_ENTERPRISE_ENDPOINT: ${GITHUB_ENTERPRISE_ENDPOINT} - GITHUB_ENTERPRISE_TOKEN: ${GITHUB_ENTERPRISE_TOKEN} - - # Credentials to pass to the checks to pull private images - REGISTRY_DOMAIN: ${REGISTRY_SERVER} - REGISTRY_USERNAME: ${REGISTRY_USERNAME} - REGISTRY_PASSWORD: ${REGISTRY_PASSWORD} - - # Registry credentials to pull checks from private registries - registries: - - server: ${REGISTRY_SERVER} - username: ${REGISTRY_USERNAME} - password: ${REGISTRY_PASSWORD} - - # *Always*, Never, IfNotPresent - pullPolicy: IfNotPresent - - # Number of checks to run concurrently - concurrency: 5 - -targets: - - - target: ${DOCKER_IMAGE:-Dockerfile} - assetType: DockerImage - - - target: ${DOCKER_IMAGE:-resources/Dockerfile_2} - assetType: DockerImage \ No newline at end of file From 6d4fed9318ebafadef7a787b19d0287fc011cbf2 Mon Sep 17 00:00:00 2001 From: eloymg Date: Tue, 14 Mar 2023 17:10:43 +0100 Subject: [PATCH 4/4] Delete Dockerfile_2 --- resources/Dockerfile_2 | 9 --------- 1 file changed, 9 deletions(-) delete mode 100644 resources/Dockerfile_2 diff --git a/resources/Dockerfile_2 b/resources/Dockerfile_2 deleted file mode 100644 index 2e25508..0000000 --- a/resources/Dockerfile_2 +++ /dev/null @@ -1,9 +0,0 @@ -# Copyright 2021 Adevinta - -FROM docker:20.10-git - -WORKDIR /app - -COPY vulcan-local . - -ENTRYPOINT [ "/app/vulcan-local" ]