abh1sek/container-image-scannere-api repository overview

⁠Container Image Scanner API

A minimalist Go API to scan Docker images for security vulnerabilities and weaknesses

⁠TL;DR

Requirements:

• Docker
• Docker Compose
• Go 1.12+

Clone this repository

git clone https://github.com/abhisek/container-image-scanner-api && \
  cd container-image-scanner-api

Build the API server

make

Start services

docker-compose up

Submit scan:

curl -d '{"image": "ubuntu"}' http://localhost:8000/scans

Get scan status

curl http://localhost:8000/scans/:scan_id/status

Get scan report

curl http://localhost:8000/scans/:scan_id

Note: Scan reports are stored in Redis server with expiration set to 15 minutes. To change time window or disable report expiration set the following environment variable

# Disable report expiration in Redis
export REPORT_EXPIRATION_WINDOW=0

# Set report expiration window to 30 minutes
export REPORT_EXPIRATION_WINDOW=1800

⁠Docker in Docker

The application uses docker:dind (Docker in Docker) for pulling image and scanning with external tools (currently only Trivy⁠ and Dockle⁠). This model is to ensure we can run this safely in Kubernetes⁠ and avoid any dependency or clutter in host system.

Three containers are used to deliver the service:

1. Docker in Docker (DIND) container
2. API Server (This app) container
3. Redis (For data structure persistence)

/var/run is shared between the two containers to allow API Server access to DIND through unix socket in /var/run/docker.sock

⁠Current Architecture

In memory data structure with go-routine⁠ based asynchronous tasks. Check service.go⁠ for more details.

⁠Proposed Architecture