Container vulnerability scan with Syft and Grype

Happy devSecOps

Container Security

Containers(e.g Docker) use layered architecture. Most containers are built from third-party base images that are available on Docker Hub. These base images may contains vulnerable packages. Further the third party software libraries which install in the containers(e.g apt packages etc) may also contains vulnerable packages. So it’s important to scan the containers, identify the vulnerable components and fix them before deploying to production. Otherwise even if our code is secure and robust, we might end up deploying vulnerable services in production that shouldn’t have deployed. DevSecOps focuses on bringing security to the build and release automation level, and there are various tools available to scan for vulnerability early in the development and build cycle. [Syft](https://github.com/anchore/syft) and [Grype](https://github.com/anchore/grype) are two such tool that can help. In this post I’m gonna discuss about Docker container vulnerability scan with Syft and Grype.

Syft

Syft is a CLI tool and library for generating a Software Bill of Materials(SBOM) from container images and filesystems. SOMB is a comprehensive record of operating system packages and language artifacts. If simply says, an SBOM is a full listing of every package and dependency that goes into making a software component(e.g Docker container image). Syft can pull Docker image and extract a full SBOM very quickly. Once we have that SBOM we can present it to those who need the list, so they can verify everything included in the image meets company requirements and/or security policies. Further these SBOM result can be used to scan the vulnerabilities in the corresponding software component(e.g Docker container image). More information about scanning vulnerabilities discussed in the next section. Following is the way to install Syft and generate SBOM result. Read more details about Syft scan options form here.

[embed]

Grype

Grype is a vulnerability scanner for container images and filesystems. It can scans container images/filesystems(e.g source directories) for vulnerability using a simple CLI. Grype can scan a variety of sources(e.g Docker images, Local source directories, SBOM scan results). For an example we can scan the SBOM scan result file which generated by Skyn and find the vulnerabilities. Following is the way to install Grype and do the vulnerability scanning on different sources.

[embed]

When Grype performs a scan for vulnerabilities, it does so using a vulnerability database that’s stored on the local filesystem, which is constructed by pulling data from a variety of publicly available vulnerability data sources. By default, Grype automatically manages this database for us. Grype checks for new updates to the vulnerability database to make sure that every scan uses up-to-date vulnerability information. This behavior is configurable. For more information, see the Managing Grype’s database section.

Grype’s vulnerability database is a SQLite file, named vulnerability.db. Updates to the database are atomic: the entire database is replaced and then treated as readonly by Grype. Grype’s first step in a database update is discovering databases that are available for retrieval. By default, the database is cached on the local filesystem in the directory $XDG_CACHE_HOME/grype/db/<SCHEMA-VERSION>/. For example, on macOS, the database would be stored in ~/Library/Caches/grype/db/3/. We can set the cache directory path using the environment variable GRYPE_DB_CACHE_DIR.

The best part of Grype is that we can use this tool in CI/CD pipelines and fail builds that cross a certain vulnerability threshold. For an example, if we’re using GitHub Actions, we can simply use Grype-based action to run vulnerability scans on the code or container images during the CI workflows. In next post I will discuss about integrating Grype vulnerability scan with Github Actions.

Reference

1. https://betterprogramming.pub/docker-container-security-with-anchore-grype-6913bc926499
2. https://thenewstack.io/generate-a-software-bill-of-materials-for-a-container-image-with-syft/
3. https://thenewstack.io/securing-the-software-supply-chain-with-a-software-bill-of-materials/
4. https://www.joyk.com/dig/detail/1639443598699827
5. https://www.howtogeek.com/devops/how-to-find-vulnerabilities-in-containers-and-files-with-grype/
6. https://www.synopsys.com/blogs/software-security/software-bill-of-materials-bom/
7. https://boxboat.com/2022/03/16/grype-admission-controller/
8. https://www.basaltaura.nl/2021/12/15/check-for-vulnerabilities-with-syft-and-grype/