Docker Image

Pulls Docker images from container registries for compile pipeline scanning of source code, binaries, and configuration.

Only downloads images when their SHA256 hash differs from previously scanned symbol files.

Docker CLI

Requires docker CLI for authentication and export. Install locally or use the compiler Docker image.

Executed CLI commands:

# check the docker cli client is available
docker version 

# check whether target image exists and its hash has not already been scanned
docker inspect manifest <image>

# create the container locally 
docker create <image>

# export the container to a .tar file
docker export <containerID> <temp-file-to-scan.tar>

# stop the container and remove the image from disk
docker stop <containerID>
docker rmi <containerID>

Configuration

To configure the Docker image module, Edit these settings.

Below is the default configuration from: docker/config.yaml (* Required Fields).

Edit Online

# 🔟❎ 'compile' Docker configuration

# Pull docker images files using the Docker CLI client from container registries to
# scan for symbol values. To learn more see https://doc.log10x.com/compile/pull/docker

# Set the 10x pipeline to 'compile'
tenx: compile

# ============================= Docker Options ================================

docker:

  # 'username' specifies the  user name for authenticating the docker client.
  #  If not set, the docker client is assumed to be pre-authenticated.
  #  To learn more see https://docs.docker.com/reference/cli/docker/login/#username
  username: $=TenXEnv.get("DOCKER_USERNAME") # (❗ EnvVar REQUIRED)

  # 'password' specifies the password argument for authenticating the docker client login command.
  #  This value is written into the docker client's std input via the --password-stdin argument.
  #  To learn more see https://docs.docker.com/reference/cli/docker/login/#password-stdin.
  password: $=TenXEnv.get("DOCKER_TOKEN")  # (❗ EnvVar REQUIRED)

  # 'command' specifies the location of docker cli https://docs.docker.com/reference/cli/docker/ program
  #command: $=TenXString.includes(TenXEnv.get("os.name"), "Windows") ? "C:/Program Files/Docker/Docker/resources/bin/docker.exe":"/usr/local/bin/docker"

  # 'images' specify images to pull and export to matching .tar files to scan
  images: [
  #   docker.io/grafana/grafana:11.1.0 
  ]

  # 'remove' specifies whether to remove exported images once their contents are extracted.
  #  To learn more see https://docs.docker.com/reference/cli/docker/image/rm
  remove: false

  # 'githubRepoToken' defines an access token for pulling Github repos referenced
  # by a target image's 'org.opencontainers.image.source' property.
  githubRepoToken: $=TenXEnv.get("GH_TOKEN")  # (❗ EnvVar REQUIRED)

Options

Specify the options below to configure the Docker image:

Name	Description
dockerImages	Docker image files to pull
dockerUsername	Docker user name
dockerPassword	Docker password
dockerRemove	Remove image after scan
dockerGithubRepoToken	GitHub API token for pulling image source code repositories
dockerCommand	Path to docker command

`dockerImages`

Docker image files to pull.

Type	Default
List	[]

specifies the URLs for the remote Docker images to pull in the form of: <container-repository>/<image>/<version>.

For example:

dockerImages:
- docker.io/grafana/grafana:11.1.0

`dockerUsername`

Docker user name.

Type	Default
String	""

specifies the user name for authenticating the docker client. If this value is not set, the docker client is assumed to be pre-authenticated.

This value should be set via an environment variable:

dockerUsername: $=TenXEnv.get("DOCKER_USERNAME")

`dockerPassword`

Docker password.

Type	Default
String	""

specifies the password for authenticating the docker client in conjunction with dockerUsername.

This value is written into the docker client's std input via the login command's password-stdin argument.

This value should be set via an environment variable:

dockerPassword: $=TenXEnv.get("DOCKER_TOKEN")

`dockerRemove`

Remove image after scan.

Type	Default
Boolean	true

Specifies whether to remove dockerImages using docker rmi -f.

`dockerGithubRepoToken`

GitHub API token for pulling image source code repositories.

Type	Default
String	""

Defines an access token for pulling Github repos referenced by a target image's org.opencontainers.image.source property.

If this property is not available within the image manifest, an attempt is made to infer a valid GitHub repo name from the image name. For example, for the the target image name: docker.io/grafana/grafana:11.1.0, the grafana/grafana GitHub repo is inferred.

If not an API token is not specified, GitHub repos referenced within image manifests or inferred from image names are not pulled. To learn more see GitHub tokens.

`dockerCommand`

Path to docker command.

Type	Default
String	*NIX: /usr/local/bin/docker, Win: C:/Program Files/Docker/Docker/resources/bin/docker.exe

Defines the path to the docker program used pulling and exporting images.

This module is defined in docker/module.yaml.