Skip to content

Commit 28f9c07

Browse files
airadierairadier
authored
Update repo and new example (#3)
* Update repo and new example * Update repo to use quay.io/sysdig/secure-inline-scan:2 * Add a simpler Jenkins example to scan from repo, instead of build, push and scan (keep that as a different example) * Add example to index.md and fix typos
1 parent 361c3e2 commit 28f9c07

File tree

6 files changed

+92
-54
lines changed

6 files changed

+92
-54
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ It is not a comprehensive catalog of _examples_ for all integrations available,
1010

1111
## Issues and pull requests
1212

13-
If you find a related topic lacks enough information, or some problem with any of the existing examples, please file a issue in this repository. Pull requests to ammend any existing information or examples are also welcomed.
13+
If you find a related topic lacks enough information, or some problem with any of the existing examples, please file a issue in this repository. Pull requests to amend any existing information or examples are also welcomed.
1414

1515
## More information
1616

‎docs/index.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: Sysdig Secure Inline Scan Examples
33
summary: >
44
This is not a comprehensive catalog of examples for all integrations available, but a live document where we continually publish more information as we see users need it.
5-
We do try to keep a list of links to all integrations and toher related websites that you may find useful.
5+
We do try to keep a list of links to all integrations and other related websites that you may find useful.
66
---
77

88
# Examples
@@ -11,8 +11,9 @@ In this [repository](https://github.com/sysdiglabs/secure-inline-scan-examples/)
1111

1212
* [Google Cloud Build](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/google-cloud-build)
1313
* Jenkins
14-
* [Build and scan](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/jenkins/jenkins-build-and-scan)
1514
* [Scan from repository](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/jenkins/jenkins-scan-from-repo)
15+
* [Build and scan](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/jenkins/jenkins-build-push-scan-from-repo)
16+
* [Build, push and scan from repository](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/jenkins/jenkins-build-and-scan)
1617
* [Tekton](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/tekton)
1718
* [Tekton alpha API](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/tekton/alpha)
1819
* [Tekton beta API](https://github.com/sysdiglabs/secure-inline-scan-examples/tree/main/tekton/beta)

‎jenkins/jenkins-build-push-scan-from-repo/Jenkinsfile‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
pipeline {
2+
agent {
3+
kubernetes {
4+
yaml """
5+
apiVersion: v1
6+
kind: Pod
7+
metadata:
8+
name: inline-scan-worker
9+
spec:
10+
containers:
11+
- name: jnlp
12+
- name: maven
13+
image: maven:3.6-jdk-11
14+
command: ['cat']
15+
tty: true
16+
- name: builder
17+
image: gcr.io/kaniko-project/executor:debug
18+
command: ['cat']
19+
tty: true
20+
- name: inline-scan
21+
image: quay.io/sysdig/secure-inline-scan:2
22+
command: ['cat']
23+
tty: true
24+
"""
25+
}
26+
}
27+
28+
parameters {
29+
string(name: 'IMAGE_NAME', defaultValue: 'docker.io/sysdiglabs/test-maven-app', description: 'Name of the image to be built andscanned (e.g.: myrepo/dummy-app)')
30+
}
31+
32+
environment {
33+
DOCKER = credentials('docker-repository-credentials')
34+
SECURE_API_KEY = credentials('sysdig-secure-api-credentials')
35+
}
36+
37+
stages {
38+
stage('Checkout') {
39+
steps {
40+
git 'https://github.com/openshift/test-maven-app'
41+
}
42+
}
43+
stage('Build app') {
44+
steps {
45+
container("maven") {
46+
sh "mvn package"
47+
}
48+
}
49+
}
50+
stage('Build image and push') {
51+
steps {
52+
container("builder") {
53+
sh """cat > config.json <<EOF
54+
{
55+
"auths": {
56+
"https://index.docker.io/v1/": {
57+
"auth": "\$(echo -n \${DOCKER} | base64)"
58+
}
59+
}
60+
}
61+
EOF
62+
"""
63+
sh "cat config.json"
64+
sh """cat > Dockerfile <<EOF
65+
FROM gcr.io/distroless/java:11
66+
COPY target/hello.jar /hello.jar
67+
CMD /hello.jar
68+
EOF
69+
"""
70+
sh "/kaniko/executor --context . --verbosity debug --destination ${IMAGE_NAME}"
71+
72+
}
73+
}
74+
}
75+
stage('Scanning Image pulled from repository') {
76+
steps {
77+
container("inline-scan") {
78+
sh "/sysdig-inline-scan.sh -k ${SECURE_API_KEY_PSW} ${IMAGE_NAME}"
79+
}
80+
}
81+
}
82+
}
83+
}

‎jenkins/jenkins-scan-from-repo/Jenkinsfile‎

Lines changed: 1 addition & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,6 @@ metadata:
99
spec:
1010
containers:
1111
- name: jnlp
12-
- name: maven
13-
image: maven:3.6-jdk-11
14-
command: ['cat']
15-
tty: true
16-
- name: builder
17-
image: gcr.io/kaniko-project/executor:debug
18-
command: ['cat']
19-
tty: true
2012
- name: inline-scan
2113
image: sysdiglabs/secure-inline-scan:2
2214
command: ['cat']
@@ -26,52 +18,14 @@ spec:
2618
}
2719

2820
parameters {
29-
string(name: 'IMAGE_NAME', defaultValue: 'docker.io/sysdiglabs/test-maven-app', description: 'Name of the image to be built andscanned (e.g.: myrepo/dummy-app)')
21+
string(name: 'IMAGE_NAME', defaultValue: 'sysdiglabs/dummy-vuln-app', description: 'Name of the image to be built andscanned (e.g.: myrepo/dummy-app)')
3022
}
3123

3224
environment {
33-
DOCKER = credentials('docker-repository-credentials')
3425
SECURE_API_KEY = credentials('sysdig-secure-api-credentials')
3526
}
3627

3728
stages {
38-
stage('Checkout') {
39-
steps {
40-
git 'https://github.com/openshift/test-maven-app'
41-
}
42-
}
43-
stage('Build app') {
44-
steps {
45-
container("maven") {
46-
sh "mvn package"
47-
}
48-
}
49-
}
50-
stage('Build image and push') {
51-
steps {
52-
container("builder") {
53-
sh """cat > config.json <<EOF
54-
{
55-
"auths": {
56-
"https://index.docker.io/v1/": {
57-
"auth": "\$(echo -n \${DOCKER} | base64)"
58-
}
59-
}
60-
}
61-
EOF
62-
"""
63-
sh "cat config.json"
64-
sh """cat > Dockerfile <<EOF
65-
FROM gcr.io/distroless/java:11
66-
COPY target/hello.jar /hello.jar
67-
CMD /hello.jar
68-
EOF
69-
"""
70-
sh "/kaniko/executor --context . --verbosity debug --destination ${IMAGE_NAME}"
71-
72-
}
73-
}
74-
}
7529
stage('Scanning Image pulled from repository') {
7630
steps {
7731
container("inline-scan") {

‎unprivileged-docker/localbuild_scan.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22

3-
# v2: Updated to use sysdiglabs/secure-inline-scan:2
3+
# v2: Updated to use quay.io/sysdig/secure-inline-scan:2
44

55
# This is an example pipeline execution as a Bash script of how to
66
# execute an inline scan with Sysdig without requiring priviledges.
@@ -52,7 +52,7 @@ function scan {
5252
echo
5353
echo "> Scan"
5454

55-
docker run -v $PWD:/workspace sysdiglabs/secure-inline-scan:2 \
55+
docker run -v $PWD:/workspace quay.io/sysdig/secure-inline-scan:2 \
5656
-s https://secure.sysdig.com \
5757
--storage-type oci-dir \
5858
--storage-path /workspace/oci \

‎unprivileged-docker/registry_scan.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22

3-
# Uses sysdiglabs/secure-inline-scan:2
3+
# Uses quay.io/sysdig/secure-inline-scan:2
44

55
# This is an example script that scans from a private registry
66
# with Sysdig without requiring priviledges.
@@ -50,7 +50,7 @@ function scan {
5050

5151
docker run \
5252
-v $PWD:/workspace \
53-
sysdiglabs/secure-inline-scan:2 \
53+
quay.io/sysdig/secure-inline-scan:2 \
5454
--registry-auth-file /workspace/docker-config.json \
5555
-k $SYSDIG_SECURE_API_TOKEN \
5656
-s https://secure.sysdig.com \

0 commit comments

Comments
 (0)