Skip to content

README.md

Latest commit

 

History

History
134 lines (88 loc) · 3.75 KB

README.md

File metadata and controls

134 lines (88 loc) · 3.75 KB

Deployer Docker Image Security

This directory covers security scanning for Docker images used by the deployer tooling. These are Priority 3 images — they run locally for minutes during deployment and are not exposed to the internet.

For production image security, see ../../production/.

Purpose

Regular security scanning ensures that deployer tool images are free from known vulnerabilities. This documentation provides:

  • Instructions for running security scans on deployer images
  • Configuration guidelines
  • Best practices for vulnerability management

See ../../production/ for scanning guidance on production-deployed images.

Automated Scanning

For ongoing security monitoring, see Issue #250: Implement periodic security vulnerability scanning workflow.

The automated workflow will:

  • Run Trivy scans on CI/CD pipeline
  • Generate security reports
  • Alert on new vulnerabilities
  • Track vulnerability trends over time

Manual Scanning with Trivy

Installation

# macOS
brew install trivy

# Linux (Debian/Ubuntu)
sudo apt-get install trivy

# Or use Docker
docker run --rm aquasec/trivy:latest image <image-name>

Scan Configuration

Recommended Scan Command:

trivy image --severity HIGH,CRITICAL <image-name>

Severity Levels:

  • CRITICAL: Exploitable vulnerabilities with severe impact
  • HIGH: Significant vulnerabilities requiring attention
  • MEDIUM: Moderate vulnerabilities (optional to include)
  • LOW: Minor vulnerabilities (typically noise)

Example Scans

# Scan the deployer image
trivy image --severity HIGH,CRITICAL torrust/tracker-deployer:latest

# Scan with all severities for full report
trivy image torrust/tracker-deployer:latest

# Scan and output as JSON
trivy image --format json --output report.json torrust/tracker-deployer:latest

# Scan specific image version
trivy image --severity HIGH,CRITICAL prom/prometheus:v3.5.0

Trivy Warning Messages Explained

Common Warnings (Not Security Issues)

"OS is not detected" (Prometheus):

  • Expected for minimal scratch images
  • Application binary has zero vulnerabilities
  • No OS packages to scan

"Alpine/Oracle Linux no longer supported":

  • Cosmetic warning from Trivy's detection heuristics
  • Official images are actively maintained by vendors
  • Zero vulnerabilities confirm images are secure

When to Act

If HIGH/CRITICAL vulnerabilities appear:

  1. Review vulnerability details in Trivy output
  2. Check if vendor has released patched image
  3. Update image version in templates/docker-compose/docker-compose.yml.tera
  4. Re-run security scan to verify fix
  5. Update scan documentation with new results

Security Best Practices

Image Selection

  • ✅ Use official vendor images (prom, grafana, mysql, torrust)
  • ✅ Pin to specific versions (not latest tags in production)
  • ✅ Prefer LTS versions for production stability
  • ✅ Verify support EOL dates before deployment

Regular Scanning

  • 🔄 Scan images before deployment
  • 🔄 Re-scan periodically (monthly recommended)
  • 🔄 Monitor vendor security advisories
  • 🔄 Update images when patches available

Documentation

  • 📝 Record scan dates and results in scans/
  • 📝 Document update rationale
  • 📝 Track support lifecycle dates
  • 📝 Maintain historical scan records

Historical Scan Results

See the scans/ directory for historical security scan results:

References