Managing SWR Private Images

Constraints

• Only the HSS container edition supports this function. For details about how to purchase and upgrade HSS, see Purchasing an HSS Quota and Upgrading Your Edition.

• Security scans can be performed only on Linux images.

Viewing Private Images

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Asset Management > Containers & Quota.
   

   If your servers are managed by enterprise projects, you can select the target enterprise project to view or operate the asset and detection information.

4. Click the Container Images tab and click SWR private image.
5. You can click Update Private Images from SWR to update self-owned images from SWR.
   

   Images can be synchronized only after being authorized by SWR. For details, see SWR Authorization Methods.

Scanning a Private Image

You can choose all images, multiple images, or a single image and manually start a scan. The duration of a security scan depends on the scanned image size. Generally, scanning an image takes shorter than 3 minutes. After the scan is complete, click View Report to check the report.

Scan items of private images in SWR are as follows:

1. Log in to the management console and go to the HSS page.
2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and click SWR private image.
4. Perform a security scan for a single image or multiple images.
   

   • Multi-architecture images do not support batch scan or full scan.
   • A full scan takes a long time and cannot be interrupted after it starts. Exercise caution when performing this operation.
   • Single image security scan

     In the Operation column of the target image, click Scan to perform security scan.

   • Batch image security scan

     Select all target images and click Scan above the image list to perform security scan for multiple target images.

   • Full image security scan

     Click Scan All above the image list to perform a security scan for all images.

5. In the displayed dialog box, click OK to start the scan job.

   After a full scan task is started, you can move the cursor over the grey Scan All button to view the scan progress.

6. Scanned in the Scan Status column indicates the target image scan completed.

Checking the Vulnerability Report of Private Images

After the scanning is complete, you can view the security reports.

1. Log in to the management console and go to the HSS page.
2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and select SWR private image. Click Security Report in the Operation column to view the report details of the image version.
   Figure 1 Security report
   

4. Choose Vulnerability Reports to view the vulnerability report.
   • Viewing vulnerability details

     Click the vulnerability name to go to the vulnerability details page and view the basic information and affected images.

   • Viewing the CVE ID, CVSS Score, and Disclosed Time of a vulnerability

     Click in front of the target vulnerability name to view the CVE ID, CVSS Score, and Disclosed Time.

   • Viewing vulnerability solutions

     In the Solution column of the row containing the target vulnerability, click the solution description to view the vulnerability solution details.

Viewing the Malicious File Report of a Private Image

After images are scanned, you can view malicious files on them. This section describes how to view malicious files in an image version.

1. Log in to the management console and go to the HSS page.
2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and select SWR private image. Click Security Report in the Operation column to view the report details of the image version.
   Figure 2 Security report
   

4. Click Malicious Files to view malicious files on the image.

Viewing Software Information About a Private Image

1. Log in to the management console and go to the HSS page.
2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and select SWR private image. Click Security Report in the Operation column to view the report details of the image version.
   Figure 3 Security report
   

4. Click Software Information to view the software contained in the image version, software type, and number of vulnerabilities in the software.
5. Click next to a software name to view the software vulnerability name, repair urgency, and solution.

Viewing File Information About a Private Image

1. Log in to the management console and go to the HSS page.
2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and select SWR private image. Click Security Report in the Operation column to view the report details of the image version.
   Figure 4 Security report
   

4. Click File Information to view the file information about the image.
   Including the number of files, total file size, and details about the top 50 files.

   Figure 5 File information
   

Viewing the Unsafe Settings of a Private Image

1. Log in to the management console and go to the HSS page.
2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and select SWR private image. Click Security Report in the Operation column to view the report details of the image version.
   Figure 6 Security report
   

4. Select Unsafe Settings to view the baseline check report.

   You can view the unsafe configurations, password complexity policy detection, and common weak password detection results of the target image.

   • Viewing unsafe configurations and modification suggestions
     1. On the Unsafe Configurations tab page, select the target baseline.
     2. In the detection item column of the target detection item, click Description to view the detection item description and modification suggestions.
   • Common weak password detection
     1. Click Common Weak Password Detection.
     2. Configure weak passwords and click OK.

Viewing the Sensitive Information Report of a Private Image

1. Log in to the management console and go to the HSS page.
2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and select SWR private image. Click Security Report in the Operation column to view the report details of the image version.
   Figure 7 Security report
   

4. Click the Sensitive Information tab to view details about sensitive image information and ignore risk alarms.
5. Click Configure Sensitive File Path to view and edit the custom file path whitelist.
   Figure 8 Editing the sensitive file whitelist
   

   Table 1 Custom path description

   Path Specification Item	Description	Example Value
   OS	Only Linux is supported.	-
   Requirement	A maximum of 20 paths can be specified. One path occupies one line.	/usr/ /lib/test.txt
   Default whitelist path	The following whitelist directories or file formats are supported by default and do not need to be configured: /usr/* /lib/* /lib32/* /bin/* /sbin/* /var/lib/* /var/log/* Any path/node_modules/any path/any name.md Any path/node_modules/any path/test/any path */service/iam/examples_test.go Any path/grafana/public/build/any name.js NOTE: Any path: indicates that the current path is a customized value and can be any path in the system. Any name: indicates that the file name in the current path is a customized value, which can be any name ended with .md or .js in the system.	-
   Non-scanning scenario	The file size is greater than 20 MB. The following file types are not scanned: Common binary files Common program files Automatically generated files	jpg|png|gif|mov|avi|mpeg|pdf|mp4|mp3|svg|tar|gz|zip js|jar|java||md|cpp|cxx|scala|pl [0-9a-zA-Z_-]{32,64}

Viewing the Software Compliance Report About a Private Image

1. Log in to the management console and go to the HSS page.

2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and click SWR private image.
4. In the Operation column of the target image, click View Report. The security scan report page is displayed.
5. Choose Software Compliance to view the report.

   You can view the name, software version, path, and image layer of non-compliant software.

Viewing the Base Image Report of a Private Image

1. Log in to the management console and go to the HSS page.

2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and click SWR private image.
4. In the Operation column of the target image, click View Report. The security scan report page is displayed.
5. Click the Base Images tab and view reports.

   You can view the name, version, and image layer path of a service image that is not created using a base image.

Exporting a Private Image Vulnerability Report or Baseline Report

Vulnerability or baseline report cannot be exported for multi-architecture images.

1. Log in to the management console and go to the HSS page.

2. In the navigation pane, choose Asset Management > Containers & Quota.
3. Click the Container Images tab and click SWR private image.
4. Click Export Vulnerability above the image list and select a report type to export the vulnerability or baseline report.

   If you want to export the vulnerability report of a specified image, select the image type in the search box and click Export Vulnerability.

5. View the export status in the upper part of the container management page. After the export is successful, obtain the exported information from the default file download address on the local host.
   

   Do not close the browser page during the export. Otherwise, the export task will be interrupted.