Sweet, onto our first demo.
In this demo, we're going to review a reactive Trivy workflow.
We're going to explore Trivy's command line flags.
Then, we're going to use Trivy to scan a Docker image.
First off is the reactive workflow.
We'll get into why this is called reactive within a second.
Within the slide,
we're going to discuss how Trivy can be leveraged
within a typical Docker build process.
It all starts with the Dockerfile housed in the Git repo.
In this course, we're going to be leveraging GitHub.
The Dockerfile contains various Docker configurations,
such as what version of Apache is going to be installed.
In this case,
we can assume that there is an engineer on the updates branch who
is trying to make an update to the Dockerfile.
When they proceed, they're going to raise a pull request,
which is basically an area where people can collaborate on the changes.
Once everyone has come to a consensus on the pull request,
the updates are then placed into the main branch.
We can think of the main branch as what is released into production.
This process goes ahead and kicks off a build process,
in this case the Docker image creation process.
So let's dive a little bit more into this process.
The Dockerfile is used to build the Docker image,
and we can think of the Docker image as a lean virtual machine image.
And the Docker image creation process occurs on a build server.
In our demo,
this build server is going to be hosted by GitHub and is a part
of a GitHub feature called GitHub Actions. Our GitHub Actions
build server will be Ubuntu 2004.
Once everything is built, it is then uploaded to the Docker image registry.
In our course, we're going to be leveraging Docker Hub.
Then,
the server pulls down the new version of the Docker image and uses
that Docker image to instantiate a Docker container,
in other words a running application, similar to a running virtual machine.
Now Docker containers and virtual machines are somewhat different,
but for the purposes of this course, we can think they are roughly similar.
I just wanted to take a quick aside.
As a blue teamer, you might not be involved with building this workflow.
However,
it is vital to understand this process so you can
introduce security tooling and just be a general security
advocate within the build process.
And then we see Trivy, similar to a previous slide, that audits
directly the Docker images within the Docker registry.
In our first demo, we'll assume this workflow is in place,
and, in particular, we'll focus on Trivy's ability to scan
Docker images from the registry.