Container vulnerability scanning in GCP - Commands & Configuration

Introduction

Containers can have security problems if their software is old or has bugs. Container vulnerability scanning checks container images for these problems before using them, helping keep applications safe.

When you want to check if your container images have security issues before deploying them.

When you need to ensure compliance with security rules in your company.

When you want to automatically scan new container images pushed to your registry.

When you want to get reports about vulnerabilities in your container images.

When you want to prevent running containers with known security problems.

Config File - cloudbuild.yaml

cloudbuild.yaml

steps:
- name: 'gcr.io/cloud-builders/gcloud'
  args: ['container', 'images', 'describe', 'gcr.io/my-project/my-app:latest']
- name: 'gcr.io/cloud-builders/gcloud'
  args: ['beta', 'container', 'images', 'scan', 'gcr.io/my-project/my-app:latest']

This Cloud Build configuration runs two steps: first it describes the container image to confirm it exists, then it runs the vulnerability scan on the image using Google Cloud's beta scanning feature.

The gcloud beta container images scan command checks the image for known security issues and reports them.

Commands

This command shows details about the container image to confirm it is available in the registry before scanning.

Terminal

gcloud container images describe gcr.io/my-project/my-app:latest

Expected Output

image_summary:

  digest: sha256:abc123def456...

  tags:

  - latest

  uploadTime: '2024-06-01T12:00:00Z'

  mediaType: application/vnd.docker.distribution.manifest.v2+json

This command runs the vulnerability scan on the specified container image and outputs the found security issues.

Terminal

gcloud beta container images scan gcr.io/my-project/my-app:latest

Expected Output

Scanning image gcr.io/my-project/my-app:latest...

Vulnerabilities found:

- CVE-2023-1234: High severity, fix available

- CVE-2022-5678: Medium severity, fix available

Scan completed with 2 vulnerabilities found.

→

--format=json - Outputs the scan results in JSON format for easier parsing.

This command lists all tags of the container image to see available versions and decide which to scan or deploy.

Terminal

gcloud container images list-tags gcr.io/my-project/my-app

Expected Output

DIGEST                                                                    TAGS     TIMESTAMP

sha256:abc123def4567890abcdef1234567890abcdef1234567890abcdef1234567890   latest   2024-06-01T12:00:00

sha256:def456abc1237890abcdef1234567890abcdef1234567890abcdef1234567890   v1.0     2024-05-20T08:30:00

Key Concept

If you remember nothing else from this pattern, remember: scanning container images before deployment helps catch security problems early and keeps your apps safe.

Common Mistakes

Trying to scan a container image that does not exist in the registry.

The scan command fails because there is no image to check, causing errors.

Always verify the image exists with 'gcloud container images describe' or 'list-tags' before scanning.

Ignoring scan results and deploying vulnerable images.

This leaves your application open to known security risks that could be exploited.

Review scan reports carefully and update or fix images before deployment.

Summary

Use 'gcloud container images describe' to confirm your container image is in the registry.

Run 'gcloud beta container images scan' to check the image for security vulnerabilities.

List image tags with 'gcloud container images list-tags' to manage different versions.

Practice

1. What is the main purpose of container vulnerability scanning in Google Cloud Platform?

easy

A. To find security issues in container images before deployment

B. To increase the speed of container startup

C. To reduce the size of container images

D. To monitor container CPU usage

Solution

1. Step 1: Understand container vulnerability scanning

   It is a process to detect security problems in container images.

2. Step 2: Identify the main goal in GCP context

   GCP uses scanning to find vulnerabilities before containers run, keeping apps safe.

3. Final Answer:

   To find security issues in container images before deployment -> Option A

4. Quick Check:

   Purpose = Find security issues [OK]

Hint: Focus on security purpose, not performance or size [OK]

Common Mistakes:

• Confusing scanning with performance monitoring
• Thinking scanning reduces image size
• Assuming scanning manages CPU usage

2. Which gcloud command correctly scans a container image named gcr.io/my-project/my-image:latest for vulnerabilities?

easy

A. gcloud container images describe gcr.io/my-project/my-image:latest --show-vulnerabilities

B. gcloud container images scan gcr.io/my-project/my-image:latest

C. gcloud container images list-tags gcr.io/my-project/my-image:latest --vulnerabilities

D. gcloud container images scan-vulnerabilities gcr.io/my-project/my-image:latest

Solution

1. Step 1: Recall correct gcloud syntax for vulnerability scanning

   The command to view vulnerabilities is gcloud container images describe with --show-vulnerabilities.

2. Step 2: Check each option's validity

   gcloud container images describe gcr.io/my-project/my-image:latest --show-vulnerabilities matches the correct syntax; others are invalid or do not exist.

3. Final Answer:

   gcloud container images describe gcr.io/my-project/my-image:latest --show-vulnerabilities -> Option A

4. Quick Check:

   Correct command = describe + --show-vulnerabilities [OK]

Hint: Use 'describe' with '--show-vulnerabilities' to scan images [OK]

Common Mistakes:

• Using non-existent 'scan' command
• Confusing 'list-tags' with scanning
• Omitting the '--show-vulnerabilities' flag

3. Given the command gcloud container images describe gcr.io/my-project/app:1.0 --show-vulnerabilities, what output should you expect if the image has no vulnerabilities?

medium

A. A list of vulnerabilities with severity levels

B. An error saying image not found

C. A summary of image size and tags only

D. An empty vulnerabilities section or message indicating no issues

Solution

1. Step 1: Understand the command's purpose

   The command shows vulnerability details for the specified image.

2. Step 2: Predict output when no vulnerabilities exist

   The output will show an empty vulnerabilities section or a message indicating no issues found.

3. Final Answer:

   An empty vulnerabilities section or message indicating no issues -> Option D

4. Quick Check:

   No vulnerabilities = empty or no issues message [OK]

Hint: No vulnerabilities means empty or no issues message [OK]

Common Mistakes:

• Expecting a list when none exist
• Confusing errors with no vulnerabilities
• Looking for unrelated image metadata

4. You run gcloud container images describe gcr.io/my-project/app:latest --show-vulnerabilities= but get an error: ERROR: (gcloud.container.images.describe) argument --show-vulnerabilities: Expected bool value. What is the likely cause?

medium

A. The image name is incorrect

B. You need to authenticate with gcloud first

C. You forgot to provide a value for --show-vulnerabilities flag

D. The command does not support vulnerability scanning

Solution

1. Step 1: Analyze the error message

   The error says the flag --show-vulnerabilities expects a boolean value (true or false).

2. Step 2: Identify the command mistake

   The flag was used without specifying true or false, causing the error.

3. Final Answer:

   You forgot to provide a value for --show-vulnerabilities flag -> Option C

4. Quick Check:

   Flag needs true/false value [OK]

Hint: Always provide true or false for boolean flags [OK]

Common Mistakes:

• Omitting the boolean value for flags
• Assuming image name causes this error
• Ignoring authentication errors

5. You want to automate vulnerability scanning for all container images pushed to your GCP project. Which approach best ensures every new image is scanned automatically?

hard

A. Manually run gcloud container images describe --show-vulnerabilities after each push

B. Set up Container Analysis API for automatic scanning of images on push

C. Use Stackdriver logs to detect image pushes and scan images manually

D. Schedule a daily cron job to scan all images regardless of push events

Solution

1. Step 1: Understand automation needs for scanning

   Automatic scanning requires integration with image push events.

2. Step 2: Evaluate options for automatic scanning

   Container Analysis API automatically scans images on push, ensuring no image is missed.

3. Step 3: Compare alternatives

   Manual commands or cron jobs are less efficient and risk missing images or delays.

4. Final Answer:

   Set up Container Analysis API for automatic scanning of images on push -> Option B

5. Quick Check:

   Automate scanning on push = Container Analysis API [OK]

Hint: Use triggers to scan images automatically on push [OK]

Common Mistakes:

• Relying on manual scanning after push
• Using logs instead of triggers for automation
• Scheduling scans without event triggers