Scan for vulnerabilities with Codefresh pipelines
Codefresh can integrate with any security scanning platform that scans source code or Docker images for vulnerabilities.
The integration can happen via a freestyle step as long as the scanning solution offers any of the following:
- A Docker image with the scanner
- A CLI that can be packaged in a Docker image
- An API
Since all security solutions offer an API, Codefresh can essentially use any scanning solution via that interface.
Existing security integrations
Codefresh already offers Docker images for the following security platforms:
You can find more integrations as they are added in the plugin directory.
Security scanning strategies
Because you can insert a scanning step anywhere in your pipeline, you have great flexibility on when to start a security scan.
Common strategies are:
- Scanning the source code before being packaged in a container
- Scanning a container before being stored in a registry
- Scanning a container before being deployed to production
- A combination of the above
Here is an example pipeline that scans a Docker image:
- With Aqua after being pushed to the default Docker registry.
- Before it is promoted to the external Azure Registry.
Here’s the full pipeline definition:
The security scanning step is inserted after building the Docker image, but before promoting the image to the Azure Docker registry.
Viewing security reports
The easiest way to view security reports is to visit the portal/dashboard of the security platform that you are using.
You can also attach Analysis Reports to Codefresh builds using the test reporting feature.
In this example, we attach the Clair Scan report to the build created:
To view the full report, click Test Report:
Security scan results are also a perfect candidate for extra metadata to add to your Docker images.
You can add any metadata such as the number of issues for each category or even the URL the full report. This allows you to easily correlate docker images in Codefresh and security results of your scanning platform.