In this demo, we're going to go over some basic usage of Dockle.
First, we're going to scan a hosted container image where we pull the
container from a Docker registry server.
Then, we're going to scan a local container image, and we output the
test results into JSON format. First, let's take a look at the source,
which can be found on GitHub. On the site,
github.com/goodwithtech/dockle, you can find more information about
Dockle itself. And if we scroll down on this page, we can see more
information about actually installing it and using it.
I'm going to the section Installation, and here you can see that there are
packages available for various operating systems. Since a common use case for
Dockle is using it in continuous integration environments, it makes sense to
run it as a Docker container itself.
That method is also specified on this page.
I'm now going to the top of the page, and there you can see that the latest
version, as of the moment of recording, is version 0.4.3.
So that's the version of the Docker image we're going to use.
Let's now go to the console. As this course is about the
technology to be used with Docker, I assume you're more or
less familiar with Docker itself.
I'm running here a vanilla Debian installation, but these commands should
work on any operating system where Docker is installed. First, I'm going
to check whether Docker is working as it should, and I'm doing it by
running the default hello‑world image.
If everything is installed correctly, then I should see
the infamous Hello World message.
Perfect! Docker is running.
I'm going to clear my screen. As you might remember from what we
saw on the website, the latest version was 0.4.3.
So let's run the container by itself.
I'm passing the ‑‑rm flag to make sure that the container is
discarded after use. And if everything goes successfully,
you should see the default help screen for Dockle.
Perfect! We're able to run Dockle as a Docker container, which makes it
easier to use in a continuous integration environment.
I'm going to clear the screen using Ctrl+L. So let's scan a
remote image, which is hosted on Docker Hub. We can do that by
repeating the last command, and then passing in the name of the
container that we'd like to scan.
And the container I'd like to scan is the official OWASP juice‑shop container.
This is a fictitious web shop, which can be used for training purposes. So the
only thing I'm doing right now is passing the name of the container to Dockle.
It will now retrieve the container from Docker Hub and automatically scan the
resulting container. And after a while,
depending on how fast or slow your internet connection is, we should
see the results. By the way, it is always good practice to specify
exactly which version you're using, in this specific instance,
0.4.3, to make sure you perform deterministic scans with a given
input and a given output.
And as you can see, here we see the results of the scan. On
Dockle's README page, you can find more information about what
exactly the different levels mean,
what the difference is between FATAL, for example, and INFO.
Later in this course, we'll dive deeper into exactly what the
different findings mean. Back to the console.
So next up is scanning a local container. And in order to do
that, well, let's first create a container. For this specific
demonstration, I'm going to use a container image containing
several security testing tools.
First, let's clone the repository, and the repository that I'm going to use can
be found on GitHub as well under PeterMosmans/tools‑image.
Now let's go to the directory, and here I'm going
to check out a specific version.
Why?
So, should you want to follow along, you can follow along and see the exact
same results that you will see here during the course.
I'm going to check out version 1.2.0. Perfect! So I cloned the
repository, and I checked out version 1.2.0. I'm going to clear
the screen. And if you look in this repository, you can see that
it contains a Dockerfile.
So next up, in order to test the local image, we're
going to build a local image.
So I'm going to execute the docker build command, and I'm going to build
the current directory, and I'm going to give it a tag,
let's say localimage.
So this will build the Docker container, and it will tag it with
localimage, and it builds the container. So far, so good.
And after Docker has finished building my container image,
I'd like to use Dockle to lint that container image.
Ultimately,
the goal of using Dockle is not only to build the best practice Docker images,
but also to build more secure Docker images.
That's why we're using Dockle here.
Docker has finished building our container image. In order to scan
it using Dockle, could we just pass in the tag?
I'm going to clear the screen, and I'm going to execute the same
command as we did before, running the Docker container, and then
passing in the tag name that we just created. And the full name of
the image was localimage:latest.
Let's see what happens.
Huh, apparently it cannot find the image.
This is something you should know when using Dockle. In order for Dockle,
when running it as a container to scan local images, you should give Dockle
a bit more permissions, quite a bit more permissions. Specific, you need to
map the /var/run/docker.sock volume, and this can introduce security risks.
Still for demonstration purposes, let's try out whether we can actually scan
the local image.
So I'm going to repeat the previous command, but then specify
the volume that I'm going to map for Dockle.
So the difference between the one failing and the successful one is that we
mapped /var/run/docker.sock file to the Dockle container.
And if you do that, then Dockle, to be more specific the Dockle
container, can scan locally‑built images.
And here you can see the results of scanning this
specific image. There is, however,
an alternative method on scanning local images.
This we shall see in a later demo. And in the final step of this demo,
let's format the output to the JSON file format.
I'm going to do that by running the previous command
and then specifying the format flag.
I can execute the previous command by pressing the arrow up.
Let's remove the image name first, and then I'm going to add the ‑‑format
parameter and then the specific format, which will be JSON. So now we're
running the same scans we did over the local image, but now the results
will be formatted into JSON. We haven't taken a look at the results, but
hopefully, this will show you how easy it is to run Dockle, especially to
run Dockle from a Docker container. In the next demo, we're going to
integrate Dockle into a continuous integration environment and look a
little more at the results, what they are and how you can fine tune them.