Local Image Security Scan Overview

What Is a Local Image Security Scan?

Local images are stored or running on your container hosts. If they come from user-built repositories without security assurance, or be uploaded by developers without strict security review, they may have vulnerabilities or other risks that harm the production environment.

Local image security scan scans local images to detect security risks such as system vulnerabilities and application vulnerabilities and provides rectification suggestions, helping users reduce risks caused by non-compliant or invalid images.

Local Image Security Scan Principles

HSS embeds scan tools in images to access and parse their file systems, and to perform comprehensive security checks on files and directories. After the check is complete, all check results are summarized and reported to the management console.

Local Image Security Scan Items

The image security scan items are listed in Table 1.

Scenarios

You can scan images in the production environment when your company or organizations deploy containerized applications.

Constraints

• Edition requirement: Only the HSS container edition supports local image security scan. You can scan images for an unlimited number of times. For details about how to purchase and upgrade an HSS edition, see Purchasing an HSS Quota and Upgrading Protection Quotas.
• Runtime environments that can be scanned: Linux local images of Docker, containerd, Podman, CRI-O, and iSulad. For CRI-O only independent nodes are supported.
• Storage drives: overlay, overlay2, devicemapper, zfs, and btrfs.
• Restrictions on the image storage paths: If the storage drive is overlay, overlay2, devicemapper, or zfs, all local file system paths can be scanned. If the storage driver is btrfs, only the default root paths can be scanned, including /var/lib/docker, /var/run/containerd, /var/lib/containers, /var/lib/podman, and /var/lib/isulad.
• Name constraints: The images or versions whose names contain -- cannot be scanned.
• To scan the cce-pause/pause image, HSS needs to start the sh/bash process. If the cce-pause/pause container does not have this process, the image scan task will fail. The cce-pause/pause container is a sandbox container. It has only one static compilation process and no vulnerabilities. Therefore, an image scan task failure does not affect services.

Local Image Security Scan Process

Figure 1 Usage process