Skip to content

Commit 8710e7e

Browse files
ashwiniagashwiniag
authored
Merge branch 'main' into ag-server-enhancement
2 parents d563be5 + 18bc5b3 commit 8710e7e

File tree

3 files changed

+387
-195
lines changed

3 files changed

+387
-195
lines changed

‎Dockerfile

Lines changed: 3 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,6 @@ SHELL ["/bin/ash", "-o", "pipefail", "-c"]
2020
# Install build dependencies
2121
RUN apk add --no-cache git bash gcc sqlite-dev musl-dev libc-dev
2222

23-
# Set CGO_ENABLED for sqlite3 compatibility
24-
# ENV CGO_ENABLED=1
2523
ENV CGO_CFLAGS="-D_LARGEFILE64_SOURCE"
2624

2725
# Set the working directory
@@ -38,48 +36,20 @@ COPY . .
3836

3937
COPY --from=frontend /webapp/dist /app/webapp/dist
4038

41-
# Run the tests
42-
RUN go test -v ./...
39+
# Run the tests.CGO is needed for using sqlite3 in tests
40+
RUN CGO_ENABLED=1 go test -v ./...
4341

4442
# Build the Go binary for amd64
45-
RUN GOARCH=amd64 go build -o gokakashi
43+
RUN CGO_ENABLED=0 GOARCH=amd64 go build -o gokakashi
4644

4745
FROM alpine:3.20
4846

49-
# Ensure the build fails on any command failure
50-
SHELL ["/bin/ash", "-o", "pipefail", "-c"]
51-
52-
# Install Docker CLI and other dependencies
53-
RUN apk add --no-cache docker-cli curl bash ca-certificates python3
54-
55-
# Install Trivy
56-
RUN curl -sfL https://github.com/aquasecurity/trivy/releases/download/v0.55.1/trivy_0.55.1_Linux-64bit.tar.gz | tar -xz -C /usr/local/bin
57-
58-
# Install minimal gcloud CLI
59-
RUN curl -sS -o /tmp/google-cloud-cli.tar.gz https://dl.google.com/dl/cloudsdk/channels/rapid/downloads/google-cloud-cli-494.0.0-linux-x86_64.tar.gz \
60-
&& tar -xvf /tmp/google-cloud-cli.tar.gz \
61-
&& ./google-cloud-sdk/install.sh --quiet
62-
63-
# Add gcloud to the PATH
64-
ENV PATH=$PATH:/google-cloud-sdk/bin
65-
6647
# Set working directory
6748
WORKDIR /app
6849

69-
RUN mkdir -p /app/website
70-
7150
# Copy the Go binary from the builder stage
7251
COPY --from=builder /app/gokakashi /app/gokakashi
7352

74-
# Expose ports
75-
EXPOSE 8080
76-
EXPOSE 9090
77-
78-
# Set environment variables
79-
ENV DOCKER_USERNAME="your-dockerhub-username"
80-
ENV DOCKER_PASSWORD="your-dockerhub-password"
81-
ENV LINEAR_API_KEY="your-linear-api-key"
82-
8353
# Make sure the binary is executable
8454
RUN chmod +x /app/gokakashi
8555

‎Readme.md

Lines changed: 61 additions & 159 deletions
Original file line numberDiff line numberDiff line change
@@ -1,170 +1,72 @@
1-
# gokakashi - The Centralized Image Vulnerability Platform 🔍🚀
2-
3-
[![Build](https://github.com/shinobistack/gokakashi/actions/workflows/build.yml/badge.svg)](https://github.com/shinobistack/gokakashi/actions/workflows/build.yml)
4-
5-
🚧 Heavy work in progress 🚧
6-
7-
Make vulnerability management effortless with **gokakashi**!
8-
This tool simplifies the process of pulling, scanning, reporting, and notifying across all your container images. Gone are the days of manually juggling multiple tools and managing disparate processes—**gokakashi** brings everything under one roof.
9-
10-
## Key Features
11-
1. **Multi-Platform Image Aggregation**
12-
Pull images from Dockerhub, ECR, GCR, ACR or private hosted repositories—all in one place!
13-
_Current Support:_ Dockerhub integration. \
14-
**Continuously developing** to support more platforms.
15-
16-
2. **Comprehensive Image Scanning**
17-
Use gokakashi’s multi-scanner support to detect vulnerabilities in your images.
18-
You have the flexibility to scan based on severity levels like CRITICAL or HIGH or both CRITICAL AND HIGH. By default, gokakashi scans all severities.\
19-
_Current Support:_ Trivy scanner for detailed vulnerability scans.\
20-
**Continuously developing** to support more scanners.
21-
22-
4. **Scheduled Scans with Cron Jobs**
23-
Automate your scans with cron jobs. Schedule scans as needed or run them on-demand, eliminating manual work and setting up schedules.
24-
25-
5. **Custom Notifications & Ticketing**
26-
Customize notifications to suit your needs, including where to get notified and control over priority, assignment, due dates etc.\
27-
Automatically create and assign issues based on the severity of detected vulnerabilities. gokakashi ensures that new issues are only created when relevant, helping you avoid unnecessary noise.\
28-
Meaningful tracking is maintained by creating new issues when key details change, such as Vulnerability (CVE), Severity, Installed Version, or Fixed Version\
29-
Here's an example of the information you'll receive in a notification:
30-
```
31-
Image: ashwiniag/xxx:v2.36.0
32-
33-
Library: libnghttp2-14
34-
Vulnerability: CVE-2023-44487
35-
Severity: HIGH
36-
Status: fixed
37-
Installed Version: 1.43.0-1build3
38-
Fixed Version: 1.43.0-1ubuntu0.1
39-
Title: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
40-
More details: https://avd.aquasec.com/nvd/cve-2023-44487
41-
```
42-
_Current Support:_ Linear.\
43-
Continuously developing to support more platforms like Jira, slack.
44-
5. **Reporting**
45-
You can define which severity levels to report on, ensuring you only receive the most relevant information. This makes tracking vulnerabilities streamlined and focused. By default, scans for all severity.\
46-
Enjoy the flexibility to host reports wherever you need, with full control over access—whether through Cloudflare tunnels, SSO login, or other methods.\
47-
Seamlessly share reports via hosted endpoints, enabling smooth collaboration and quick discussions with your team or clients.\
48-
Serves scan reports for both public and private access under a unified path `/reports`. Public and private servers run on different ports and can be accessed as follows:
49-
```
50-
51-
- Public reports: `http://localhost:Port/reports`
52-
- Private reports: `http://localhost:Port/reports`
53-
54-
To view an individual report:
55-
- `/view?file=<filename>`
56-
```
57-
58-
7. **API Integrations**
59-
Need to scan an image during development? Use our API endpoint to scan and get reports on the fly!\
60-
_Current Support:_ Under development.
61-
62-
## Why Use gokakashi?
63-
- **Reduce Engineering Overhead:** By centralizing the scanning process, gokakashi removes the need for multiple tools and need for managing and collaborating at multiple places.
64-
- **Streamline Release Management:** Automate the detection, reporting, and discussing resolution of vulnerabilities, reducing last-minute firefights.
65-
- **Increase Security Proactivity:** Catch vulnerabilities before your customers do and maintain their trust with proactive management.
66-
- **Scalability:** Designed to support long-term solutions for managing large-scale image vulnerability detection, gokakashi streamlines everything into a single, centralized platform.
67-
- **Unified Platform:** One tool to rule them all—be it for vulnerability scanning, reporting, or even access and communicating directly with your team!
68-
69-
70-
## Getting Started
71-
1. **Setup Credentials:** Provide your ECR, GCR, Dockerhub, or self-registry credentials. You have the flexibility on how you would like pass it to gokakashi.
72-
_Current Support:_ Dockerhub.
73-
2. **Schedule Scans:** Set up a cron job to scan your images periodically.
74-
3. **Choose Notification Integration:** Customize your notifications—integrate with Linear Jira or slack to get vulnerability alerts directly in your workflow.
75-
_Current Support:_ Linear.
76-
4. **Check Reports:** Access both public and private reports via the endpoints and where to store generated reports, defined by gokakashi. Go crazy and customize how you share them internally or with your clients.
77-
78-
**Configuration Example:**
79-
The gokakashi tool is highly configurable, giving you the flexibility to manage different scanning use cases.
80-
Below is an example of a typical config file:\
81-
```
82-
scan_targets:
83-
- registry: dockerhub # <current support dockerhub registry>
84-
auth:
85-
username: ${DOCKER_USERNAME}
86-
password: ${DOCKER_PASSWORD}
87-
images:
88-
- name: <registry>
89-
tags:
90-
- v2.08.0
91-
- v2.36.3
92-
scan_policy:
93-
severity:
94-
- CRITICAL
95-
- HIGH
96-
notify:
97-
Linear:
98-
api_key: ${LINEAR_API_KEY}
99-
project_id: UUID
100-
team_id: UUID
101-
issue_title: "Vulnerability Report"
102-
issue_priority: 2 # INT
103-
issue_assignee_id: UUID of Assignee
104-
issue_state_id: UUID of Backlog, Triage, In Progress, etc.
105-
issue_due_date: 2024-12-01 # YYYY-MM-DD
106-
- name: <registry>
107-
tags:
108-
- v2.36.4
109-
- v2.11.8
110-
scan_policy:
111-
severity:
112-
- CRITICAL
113-
notify:
114-
Linear:
115-
api_key: ${LINEAR_API_KEY}
116-
project_id: UUID
117-
team_id: UUID
118-
issue_title: "Vulnerability Report"
119-
issue_priority: 2 # INT
120-
issue_assignee_id: UUID of Assignee
121-
issue_state_id: UUID of Backlog, Triage, In Progress, etc.
122-
issue_due_date: 2024-12-01 # YYYY-MM-DD
123-
scanner:
124-
- tool: Trivy
125-
website:
126-
hostname: localhost
127-
files_path: /app/website # absolute
128-
public:
129-
port: 8080
130-
private:
131-
port: 9090
1+
<p align="center">
2+
<img src="https://github.com/user-attachments/assets/d5a52847-eeac-4cbc-a047-7991a003a523">
3+
<br><br>
4+
<span><b>gokakashi</b></span>
5+
<br><br>
6+
<i>The Centralized Security Platform 🔍 🚀</i>
7+
<br><br>
8+
<span>🚧 Heavy work in progress 🚧</span>
9+
<br><br>
10+
<a href="https://github.com/shinobistack/gokakashi/actions/workflows/build.yml"><image src="https://github.com/shinobistack/gokakashi/actions/workflows/build.yml/badge.svg" /></a>
11+
</p>
13212

133-
```
134-
**Current Support:** Continuously developing.
13+
&nbsp;
13514

136-
## Execution
137-
```
138-
#binary
139-
./gokakshi --config=/config/config.yaml
140-
# Or docker run with mount
141-
docker run -it -v /Users/ashwiniag/config:/app/config -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -p 8080:8080 -p 9090:9090 gokakashi:latest --config=/app/config/config.yaml
15+
gokakashi is a security platform to help ship secure software.
14216

143-
```
17+
## Motivation 🔥
14418

145-
## Roadmap
146-
- Jira Integration
147-
- Slack Notifications
148-
- API Endpoints for CI/CD to scan during development phase
149-
- GCR, ACR, and Self-hosted registry integration
150-
<more to be dumped from notes>
19+
- Be vendor-agnostic and open(-sourced).
20+
- Centralized: You need one place to understand your security posture.
21+
- Help teams adopt industry standards like [SLSA](https://slsa.dev/).
22+
- Educate: Security is not an afterthought.
23+
- Any team, any size.
15124

152-
## Current Phase
153-
gokakashi is currently in active development. Right now, we support:
25+
## Features 🎁
15426

155-
- Dockerhub Integration
156-
- Trivy for Vulnerability Scanning
157-
- Linear Notifications and Issue Management
158-
- Cron Functionality
159-
- avoids Deduplication of Issues
27+
### Container Image Scanning
16028

161-
More features are on the way! 🚀 Stay tuned as we continue to build and improve. Your feedback and pain points are highly appreciated! 🌻
29+
Find, analyze, and remediate vulnerabilities present in your container images.
16230

163-
## Transparency & Feedback ✨
164-
We’re excited to share gokakashi early with the community to gather feedback and improve quickly.\
165-
Whether you're curious, have suggestions, or if your team is looking for a fast and efficient way to streamline vulnerability scanning (and get back to enjoying that extra ice cream or your favorite anime), we’d love to hear from you. Feel free to open an issue or submit a pull request or request any features that would help on GitHub. Let’s build something awesome together!
31+
- Multiple registries support - scan images from various container image registries — all in one place!
32+
- Vulnerability scanner of your choice.
33+
- Custom notifications - Customize notifications to suit your needs, including where to get notified and control over priority, assignment, due dates etc.
34+
- Scheduled and on-demand scans - Automate your scans with in-built cron jobs or trigger them from your CI.
35+
36+
#### Image Registries
37+
38+
| Regisry | Status |
39+
|--------------|:-----------------:|
40+
| Docker Hub | [In progress ⏳](https://github.com/shinobistack/gokakashi/issues/81) |
41+
| Google Artifact Registry | [In progress ⏳](https://github.com/shinobistack/gokakashi/issues/82) |
42+
| GitHub Container Registry | [In progress ⏳](https://github.com/shinobistack/gokakashi/issues/83) |
43+
| Amazon Elastic Container Registry | [Open for contribution](https://github.com/shinobistack/gokakashi/issues/84) |
44+
| Azure Container Registry | [Open for contribution](https://github.com/shinobistack/gokakashi/issues/85) |
45+
46+
#### Image Scanners
47+
48+
| Scanner | Status |
49+
|---------|:------:|
50+
| Trivy | [In progress ⏳](https://github.com/shinobistack/gokakashi/issues/86) |
51+
| Snyk | [Open for contribution](https://github.com/shinobistack/gokakashi/issues/87) |
52+
| Clair | [Open for contribution](https://github.com/shinobistack/gokakashi/issues/88) |
16653

167-
## Reach Out 💭
168-
If you have any questions, ideas, or just want to connect, feel free to reach me on X (formerly Twitter) at [@AshwiniGaddagi](https://x.com/AshwiniGaddagi). I'd love to hear from you!
16954

55+
## Install 🛠️
17056

57+
### Server
58+
59+
```sh
60+
docker run -d ghcr.io/shinobistack/gokakashi server
61+
```
62+
63+
### Agent
64+
65+
```sh
66+
docker run --rm -it ghcr.io/shinobistack/gokakashi agent
67+
```
68+
69+
## Transparency & Feedback ✨
70+
We’re excited to share gokakashi early with the community to gather feedback and improve quickly.
71+
72+
Whether you're curious, have suggestions, or if your team is looking for a fast and efficient way to streamline vulnerability scanning (and get back to enjoying that extra ice cream or your favorite anime), we’d love to hear from you. Feel free to open an issue or submit a pull request or request any features that would help on GitHub. Let’s build something awesome together!

0 commit comments

Comments
 (0)