Show HN: I built ContainerCVE – a web tool to scan public Docker images • Hacker News Board

Show HN: I built ContainerCVE – a web tool to scan public Docker images

#1

Post by steelcityamir » Sat, Dec 30, 2023, 2:16 AM UTC

I found it odd there wasn’t a simple web tool to scan Docker Hub images for vulnerabilities.

So I built one.

It’s powered by the popular open-source tool Trivy.

Show HN: I built ContainerCVE – a web tool to scan public Docker images
containercve.com

Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images

#2

Post by calrain » Sat, Dec 30, 2023, 2:46 AM UTC

It looks great. My main concern with Docker Hub images is what else is in the image that shouldn't be there. Not necessarily CVE issues, but just down right malicious code.

How do you identify what is a safe Docker Hub image?

Surely it's not just reputation of the publisher of the image.

Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images

#3

Post by andenacitelli » Sat, Dec 30, 2023, 2:47 AM UTC

Don’t Docker themselves have a tool for this, Docker Scout? Pops up with how many known vulnerabilities are in each layer when you go to the page for a specific tag on Docker Hub.

I think it’s a somewhat new product so it may not be too widespread yet, but it seems to work pretty well from my admittedly uninformed perspective.

Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images

#4

Post by SoftTalker » Sat, Dec 30, 2023, 3:39 AM UTC

calrain wrote: post #2

It looks great. My main concern with Docker Hub images is what else is in the image that shouldn't be there. Not necessarily CVE issues, but just down right malicious code. How do you identify what is a safe Docker Hub image? Surely it's not just reputation of the publisher of the image.

Honestly I think it is just the reputation of the publisher. Isn't that the case with almost all software?

Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images

#5

Post by athorax » Sat, Dec 30, 2023, 4:01 AM UTC

calrain wrote: post #2

It looks great. My main concern with Docker Hub images is what else is in the image that shouldn't be there. Not necessarily CVE issues, but just down right malicious code. How do you identify what is a safe Docker Hub image? Surely it's not just reputation of the publisher of the image.

That seems pretty much impossible to accurately classify. Any container image that runs a server could be seen as malicious depending on the user

Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images

#6

Post by nubb » Sat, Dec 30, 2023, 4:39 AM UTC

you should include seed phrase and private key detection. a few crypto protocols that offer public docker images have been drained from accidentally committing keys to docker hub.

Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images

#7

Post by raister » Sat, Dec 30, 2023, 6:01 AM UTC

Responded: > Scanning is unavailable at the moment. Try again later.

Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images

#8

Post by bityard » Sat, Dec 30, 2023, 6:05 AM UTC

calrain wrote: post #2

It looks great. My main concern with Docker Hub images is what else is in the image that shouldn't be there. Not necessarily CVE issues, but just down right malicious code. How do you identify what is a safe Docker Hub image? Surely it's not just reputation of the publisher of the image.

Docker images can be signed. And docker images are no different than any other software: if you don't trust who it's from, don't run it.

(Whether the standard docker tooling or user decides to validate signatures is another thing.)

Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images

#9

Post by 8organicbits » Sat, Dec 30, 2023, 6:53 AM UTC

calrain wrote: post #2

It looks great. My main concern with Docker Hub images is what else is in the image that shouldn't be there. Not necessarily CVE issues, but just down right malicious code. How do you identify what is a safe Docker Hub image? Surely it's not just reputation of the publisher of the image.

Docker is slowly improving tooling for reproducible builds. I'm working in a blog post presently about how to do it. Reproducible images allow others to audit the build. If you're worried about third party build systems getting infected and injecting malware (unknown to the otherwise trustworthy publisher), this can help.

At the moment I'm rat-holing on apt package pinning, which doesn't work at all like I expected. Looking like I'm stuck between the Debian snapshot archive and vendoring .deb files (I don't like either).

Eventually this will go out on https://alexsci.com/blog/

Re: Show HN: I built ContainerCVE – a web tool to scan public Docker images

#10

Post by 8organicbits » Sat, Dec 30, 2023, 6:58 AM UTC

nubb wrote: post #6

you should include seed phrase and private key detection. a few crypto protocols that offer public docker images have been drained from accidentally committing keys to docker hub.

I think Trivy does that already [1]. I personally use trufflehog [2] to find secrets of all kinds. Unfortunately, these sorts of tools have false positives

[1] https://aquasecurity.github.io/trivy/v0.27.1/docs/secret/sca...

[2] https://github.com/trufflesecurity/trufflehog