Vilicus — An overseer for security scanning of container images
Tags: security, docker, devops, tooling
Published: 2021-03-31 20:19:18

Vilicus is an open-source tool that orchestrates security scans of container images(Docker/OCI) and centralizes all results into a database for further analysis and metrics.

---

## Why scan for vulnerabilities?

> A recent [analysis](https://blog.prevasio.com/2020/12/operation-red-kangaroo-industrys-first.html) of around 4 million Docker Hub images by cyber security firm Prevasio found that 51% of the images had exploitable vulnerabilities. A large number of these were cryptocurrency miners, both open and hidden, and 6,432 of the images had malware.
> [https://www.infoq.com/news/2020/12/dockerhub-image-vulnerabilities/](https://www.infoq.com/news/2020/12/dockerhub-image-vulnerabilities/)

<figure class="image">
  <img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/971e3mglk3o8dkls3h03.png" alt="Image from https://prevasio.com/static/web/viewer.html?file=/static/Red_Kangaroo.pdf"><figcaption>Image from https://prevasio.com/static/web/viewer.html?file=/static/Red_Kangaroo.pdf</figcaption>
</figure>

> Docker image security scanning is a process for finding security vulnerabilities within your Docker image files.
> Typically, image scanning works by parsing through the packages or other dependencies that are defined in a container image file, then checking to see whether there are any known vulnerabilities in those packages or dependencies.
> [https://resources.whitesourcesoftware.com/blog-whitesource/docker-image-security-scanning](https://resources.whitesourcesoftware.com/blog-whitesource/docker-image-security-scanning)

---

## How does it work?

There are many tools to scan container images for vulnerabilities such as [Anchore](https://github.com/anchore/anchore-engine), [Clair](https://github.com/quay/clair), and [Trivy](https://github.com/aquasecurity/trivy). But sometimes the results from the same image can be different. And this project comes to help the developers to improve the quality of their container images by finding vulnerabilities and thus addressing them with agnostic sight from vendors.

Some articles comparing the scanning tools:

* [Open Source CVE Scanner Round-Up: Clair vs Anchore vs Trivy](https://boxboat.com/2020/04/24/image-scanning-tech-compared/)

* [5 open source tools for container security](https://opensource.com/article/18/8/tools-container-security)

* [Docker Image Security: Static Analysis Tool Comparison — Anchore Engine vs Clair vs Trivy](https://www.a10o.net/devsecops/docker-image-security-static-analysis-tool-comparison-anchore-engine-vs-clair-vs-trivy/)

---

## Architecture

![](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/obow7zp9z7oirw5r6l2n.png)

---

## Cached Database

Vilicus updates daily the vendor databases with the latest changes in the vulns DBs.

Using a strategy to storage the database data in layers of docker images, the whole platform is ready to use in minutes instead of hours. Starting the sync feed with vulns from scratch can take at least 6 hours.

Check the strategy used in [Anchore](https://github.com/edersonbrilhante/vilicus/blob/main/scripts/build-anchore-image.sh), [Clair](https://github.com/edersonbrilhante/vilicus/blob/main/scripts/build-clair-image.sh) and [Trivy](https://github.com/edersonbrilhante/vilicus/blob/main/scripts/build-trivy-image.sh)

---

## Local Registry

Vilicus provides a local registry, so you can build a local image and scanning it without pushing it to a remote repository.
```
docker build -t localhost:5000/local-image:my-tag .

curl -o docker-compose.yml https://raw.githubusercontent.com/edersonbrilhante/vilicus/main/deployments/docker-compose.yml

docker-compose up -d

IMAGE=localregistry.vilicus.svc:5000/local-image:my-tag

docker run -v ${PWD}/artifacts:/artifacts \
  --network container:vilicus \
  vilicus/vilicus:latest \
  sh -c "dockerize -wait http://vilicus:8080/healthz -wait-retry-interval 60s -timeout 2000s vilicus-client -p /opt/vilicus/configs/conf.yaml -i ${IMAGE}  -t /opt/vilicus/contrib/sarif.tpl -o /artifacts/results.sarif"
```

---

## GitHub Action
> GitHub Actions makes it easy to automate all your software workflows, now with world-class CI/CD. Build, test, and deploy your code right from GitHub. Make code reviews, branch management, and issue triaging work the way you want.
> [https://github.com/features/actions](https://github.com/features/actions)

Vilicus provides a [GitHub action](https://github.com/marketplace/actions/vilicus-scan) to help you scanning container images in your CI/CD.

**Container scanning**

A scan can be done using a remote image and a local image. Using a remote repository such as docker.io the image will be ***`docker.io/your-organization/image:tag`***:
```
  - name: Scan image
    uses: edersonbrilhante/vilicus-github-action@main
    with:
      image: "docker.io/myorganization/myimage:tag"
```

And to use a local image its need to tag as ***`localhost:5000/image:tag`***:
```
  - name: Scan image
    uses: edersonbrilhante/vilicus-github-action@main
    with:
      image: "localhost:5000/myimage:tag"
```

**Full example**

Complete example with steps for cleaning space, building local image, Vilicus scanning, and uploading results to GitHub Security
```
name: Container Image CI
on: [push]
jobs:
  build
    runs-on: ubuntu-latest
    steps:
      - name: Maximize Build Space
        uses: easimon/maximize-build-space@master
        with:
          root-reserve-mb: 512
          swap-size-mb: 1024
          remove-dotnet: 'true'
          remove-android: 'true'
          remove-haskell: 'true'
      - name: Checkout branch
        uses: actions/checkout@v2
      - name: Build the Container image
        run: docker build -t localhost:5000/local-image:${GITHUB_SHA} .
      - name: Vilicus Scan
        uses: edersonbrilhante/vilicus-github-action@main
        with:
          image: localhost:5000/local-image:${{ github.sha }}
      - name: Upload results to github security
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: artifacts/results.sarif
```

---

## Results in GitHub Security

[Check an example](https://github.com/edersonbrilhante/vilicus-scan-examples) using Vilicus GitHub Action

<figure class="image">
  <img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mtmicxlyd96ikk9a0xqu.png" alt="Pipeline example"><figcaption>Pipeline example</figcaption>
</figure>
<figure class="image">
  <img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zcq9ox1c1zifdusp9k6a.jpeg" alt="List with all vulns found"><figcaption>List with all vulns found</figcaption>
</figure>
<figure class="image">
  <img src="https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gx8g581t9k2gqexyusms.jpeg" alt="Vuln details"><figcaption>Vuln details</figcaption>
</figure>

---

## Source Code

[VIlicus GitHub Action](https://github.com/edersonbrilhante/vilicus-github-action)

[Vilicus](https://github.com/edersonbrilhante/vilicus)


---

## That’s it!

In case you have any questions, please leave a comment here or ping me on [🔗 LinkedIn](https://www.linkedin.com/in/edersonbrilhante).