File tree Expand file tree Collapse file tree 1 file changed +6
-10
lines changed
Expand file tree Collapse file tree 1 file changed +6
-10
lines changed Original file line number Diff line number Diff line change @@ -1401,7 +1401,10 @@ jobs:
14011401 sudo apt-get install -y jq curl wget python3-pip clamav clamdscan
14021402
14031403 # Install security testing tools
1404- pip3 install bandit safety docker-bench-security
1404+ pip3 install bandit safety
1405+
1406+ # Clone docker-bench-security instead of installing via pip
1407+ git clone https://github.com/docker/docker-bench-security.git
14051408
14061409 # Install Trivy
14071410 wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
@@ -1424,15 +1427,8 @@ jobs:
14241427 # Create a temporary script to run docker-bench-security
14251428 cat > run-docker-bench.sh << 'EOF'
14261429 #!/bin/bash
1427- docker run --rm --net host --pid host --userns host --cap-add audit_control \
1428- -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
1429- -v /etc:/etc:ro \
1430- -v /usr/bin/containerd:/usr/bin/containerd:ro \
1431- -v /usr/bin/runc:/usr/bin/runc:ro \
1432- -v /usr/lib/systemd:/usr/lib/systemd:ro \
1433- -v /var/lib:/var/lib:ro \
1434- -v /var/run/docker.sock:/var/run/docker.sock:ro \
1435- docker/docker-bench-security > docker-bench-results.txt || echo "Docker bench failed but continuing"
1430+ cd docker-bench-security
1431+ sudo sh docker-bench-security.sh -c container_images > ../docker-bench-results.txt || echo "Docker bench failed but continuing"
14361432 EOF
14371433
14381434 chmod +x run-docker-bench.sh
You can’t perform that action at this time.
0 commit comments