Skip to content

Commit 8b57a69

Browse files
author
Your Name
committed
Fix: Update docker-bench-security installation in CI workflow
1 parent dc41381 commit 8b57a69

File tree

1 file changed

+6
-10
lines changed

1 file changed

+6
-10
lines changed

.github/workflows/biogears-complete-pipeline.yml

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1401,7 +1401,10 @@ jobs:
14011401
sudo apt-get install -y jq curl wget python3-pip clamav clamdscan
14021402
14031403
# Install security testing tools
1404-
pip3 install bandit safety docker-bench-security
1404+
pip3 install bandit safety
1405+
1406+
# Clone docker-bench-security instead of installing via pip
1407+
git clone https://github.com/docker/docker-bench-security.git
14051408
14061409
# Install Trivy
14071410
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
@@ -1424,15 +1427,8 @@ jobs:
14241427
# Create a temporary script to run docker-bench-security
14251428
cat > run-docker-bench.sh << 'EOF'
14261429
#!/bin/bash
1427-
docker run --rm --net host --pid host --userns host --cap-add audit_control \
1428-
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
1429-
-v /etc:/etc:ro \
1430-
-v /usr/bin/containerd:/usr/bin/containerd:ro \
1431-
-v /usr/bin/runc:/usr/bin/runc:ro \
1432-
-v /usr/lib/systemd:/usr/lib/systemd:ro \
1433-
-v /var/lib:/var/lib:ro \
1434-
-v /var/run/docker.sock:/var/run/docker.sock:ro \
1435-
docker/docker-bench-security > docker-bench-results.txt || echo "Docker bench failed but continuing"
1430+
cd docker-bench-security
1431+
sudo sh docker-bench-security.sh -c container_images > ../docker-bench-results.txt || echo "Docker bench failed but continuing"
14361432
EOF
14371433
14381434
chmod +x run-docker-bench.sh

0 commit comments

Comments
 (0)