Docker Image Vulnerabilities & Trivy Image Scanning Demo | K21Academy

hey guys welcome to this session by k21 academy in this session we are going to discuss about docker image vulnerabilities and drive image scanning now let us take a quick glance at the agenda firstly we will be getting introduced to trivi also we will be seeing how to install trivi and then we will see how to scan images using drivey and then finally we will be seeing how to run trivia as a container it would be helpful especially when you are preparing for kubernetes certifications so there are three certifications in kubernetes first one is certified kubernetes administrator which is cka and then second one is certified kubernetes application developer which is ckad and then third one is certified kubernetes security specialist which is cks for clearing the certification exams you should have an understanding of docker image vulnerabilities and driver image scanning hello and welcome to this session today we will see how to scan images for vulnerability using trivi trivi is an open source software we will see in this demonstration how to install and run trivia and scan images and also see how to run trivia as a docker container to scan our images introduction to trivi trivia is a simple and comprehensive vulnerability scanner for containers and other artifacts like file systems a software vulnerability is a glitch flaw or weakness present in the software or in an operating system trivi detects these vulnerabilities of os packages and application dependencies 3 is easy to use we just need to install the binary and we are ready to scan the images let us see how we can install trivi and scan our images so we want to know more about trivia the software we have the link here it will take you to the github of aqua security which owns trivia it has all the details of how to install on different operating systems how to use it and the documentation so feel free to use this link and see details about trivia so installing trivia i have a red hat server here with me i have added that eight server so installation it can be done in three different ways one is you install the repository like you copy the content see from the documentation on the left hand side into your slash edc slash m.report.t and create a repository and install the package right and if you're using debian or ubuntu you can also do that by apt-get instead of yum install the another option what you have is using the scripts you can just download the binary let me just do that for you so we just download the install script and the script gets gets copied over to user local pin now if i do which preview i will be able to see tv is installed to get additional options and help i can just do tv hyphen hedge it gives me the details about tv it says tv is a simple and comprehensive vulnerability scanner for containers and what options we can use with trivia like we can use to scan an image scan a local file system or a remote repository or run it in client or server mode let us see how we can scan how easy it is can now the tv is installed all i need to do is 3v image and name of the image i want to scan say for example i want to scan nginx so i say nginx and colon 1.18 it takes around 15 to 20 seconds based on the internet speed it downloads a database of 20 mb and it scans your images all right let me maximize my screen and rerun this command one more time so it is visible clearly you see it gives you a list of cves common vulnerabilities and exposures and it it gives you let me scroll up a little bit it gives you the summary nginx 1.18 image has 156 vulnerabilities of which low are 114 9 medium 31 high and two of them are critical so if you do not want to go through all of them and you're only worried about critical so what we can do is we can add the filter and i can do severity as critical and it shows me only the critical vulnerability right it gives me the additional details i can take the cv number and go back to google and search for this cve and get additional details about it say i do not want to know all of the additional information i just need the cve numbers so we can also pass in the option hyphen hyphen light so it it updates a smaller database of 13 mb in size and it just gives you the list of vulnerabilities you can see just the vulnerability ids and using this you can identify the vulnerability let me go back to the lab guide so this is how easy it is to scan your images using trivia right let me i also have a kubernetes cluster running on this let me do cube adm config images list right so these are the images which were used uh to create my api server right so let me scan this for one ability right so if i do trivia image and pass this name we see there are zero vulnerabilities so so using this trivia it is so simple to scan your images and then it will help you choose images with no or lesser vulnerabilities and then use that image in your application maybe use it as a base image or you know to build your application on top of it or when you're using the same image you it will give you what vulnerabilities it has and how you can manage with those and run your application let me go back to the lab guide it says also we can run trivia as a docker container right so we saw how to install and run tv we installed using a script now we do not want to install we can just run tv as a container as well so all we need to do is have docker installed i already have docker installed on my computer so what i do is i run trivia as a container so i say docker run and i pass the image name and it's pulling the image which is needed and there you go so your this is your 3b container it gives you the options what you can do with that right so if you want to scan any image so you pass your image name to this command so we wanted to scan 1.17 this time and there you go so it gives you the vulnerability details when you do not want to run it as a package installed you can also run it as a container right so this brings us to the end of the demonstration on trivia so we've discussed how to install and run tv how to use different options and scan different images we've also seen how to run trivia as a docker container as well thank you so much that was our expert in kubernetes now if you want to learn more and get certified then sign up for the free class of kubernetes certification of your choice for certified cuban it is administrator free class please visit k21academy.com kubernetes zero2 for certified kubernetes security specialist free class please visit k21academy.com kubernetes sec02

Channel: K21Academy

Views: 10,363

Keywords: docker image vulnerabilities, docker image vulnerability, docker image security scanning, image vulnerability scanning, image scanning, docker security scanning, trivy, trivy container image scanning, trivy vulnerability scanning, trivy vulnerability scanner, trivy container scanner, trivy open source scanner for container images, container vulnerability scanning with trivy, vulnerability scanner, container security, docker container security, docker security vulnerabilities

Id: gHz10UsEdys

Length: 9min 53sec (593 seconds)

Published: Sat Oct 09 2021