Mergify

[Hugoecft]

[Optional] How do you use Trivy?

Article Title: Level Up Your Docker Security: Uncover Mergify's Battle-Tested Workflow for Container Image Scanning.

Author : Charly Laurent (Mergify)

Any base Docker image you use today contains tens of (documented) vulnerabilities.

Consequently, anyone of your container images can contain hundreds of vulnerabilities. Each vulnerability can potentially be exploited, breaking your production environment and leaking data. Of course, feel free to imagine the worse here.

This is not new: managing vulnerabilities has already been an issue with non-container systems and deployment. What changes is the order of magnitude of complexity that the production team has to handle. With a computer able to run thousands of containers, a single computer might have millions of security issues.

After talking to many security vendors and spending hours testing software, we decided to develop our process and tooling. The goal was to make this cheap and easy to manage, as we have no bandwidth or resources to build and maintain a gigantic piece of software. Therefore we moved on to open-source security scanners in our research to be able to implement most of the missing parts ourselves.

We stumbled upon Trivy, which is yet another vulnerability scanner called. It isn't any better than other scanners. As I said, some public databases reference common vulnerabilities, so the value is not there. There are a lot of good scanners.

However, Trivy has helped us solve our vulnerability lifecycle problem.

We soon realized that managing a history of vulnerabilities would be easier using a DVCS like Git rather than building complicated tooling. We decided to leverage Trivy JSON output and commit the result in our Git repositories. That ensured we properly tracked the different scans we were doing over time. By leveraging a Git-based workflow, everything became easy for us engineers.

[...]

Full article ➡️ https://blog.mergify.com/level-up-your-docker-security-uncover-mergifys-battle-tested-workflow-for-container-image-scanning/

[Optional] Which targets are you scanning with Trivy?

• Container Image
• Filesystem
• Git Repository
• Virtual Machine Image
• Kubernetes
• AWS
• SBOM

[Optional] What kind of issues are scanning with Trivy?

• Software Bill of Materials (SBOM)
• Known vulnerabilities (CVEs)
• IaC issues and misconfigurations
• Sensitive information and secrets
• Software licenses

[AnaisUrlichs]

Amazing, thank you for sharing!