Grype - A Vulnerability Scanner For Container Images And Filesystems

scan, regardless of its presence in the final image, provide --scope all-layers:

grype <image> --scope all-layers

Grype can scan a variety of sources beyond those found in Docker.

# scan a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
grype path/to/image.tar

# scan a directory
grype dir:path/to/dir

The output format for Grype is configurable as well:

grype <image> -o <format>

Where the formats available are:

• json: Use this to get as much information out of Grype as possible!
• cyclonedx: An XML report conforming to the . This database is updated at the beginning of each scan, but an update can also be triggered manually.
  CODE Kopieren

  grype db update
  

  
  Installation
  

  Recommended

  CODE Kopieren

  # install the latest version to /usr/local/bin
  curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
  
  # install a specific version into a specific dir
  curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b <SOME_BIN_PATH> <RELEASE_VERSION>

  macOS

  CODE Kopieren

  brew tap anchore/grype
  brew install grype

  You may experience a "macOS cannot verify app is free from malware" error upon running Grype because it is not yet signed and notarized. You can override this using xattr.

  CODE Kopieren

  xattr -rd com.apple.quarantine grype

  
  Shell Completion
  

  Grype supplies shell completion through its CLI implementation (, but as soon as that gets released, we will add it here!

  
  Configuration
  

  Configuration search paths:

  • .grype.yaml
  • .grype/config.yaml
  • ~/.grype.yaml
  • <XDG_CONFIG_HOME>/grype/config.yaml

  Configuration options (example values are the default):

  CODE Kopieren

  # enable/disable checking for application updates on startup
  check-for-app-update: true
  
  # same as --fail-on ; upon scanning, if a severity is found at or above the given severity then the return code will be 1
  # default is unset which will skip this validation (options: negligible, low, medium, high, critical)
  fail-on-severity: ''
  
  # same as -o ; the output format of the vulnerability report (options: table, json, cyclonedx)
  output: "table"
  
  # same as -s ; the search space to look for packages (options: all-layers, squashed)
  scope: "squashed"
  
  # same as -q ; suppress all output (except for the vulnerability list)
  quiet: false
  
  db:
    # check for database updates on execution
    auto-update: true
  
    # location to write the vulnerability database cache
    cache-dir: "$XDG   _CACHE_HOME/grype/db"
  
    # URL of the vulnerability database
    update-url: "https://toolbox-data.anchore.io/grype/databases/listing.json"
  
  log:
    # location to write the log file (default is not to have a log file)
    file: ""
  
    # the log level; note: detailed logging suppress the ETUI
    level: "error"
  
    # use structured logging
    structured: false

  
  Future plans
  

  The following areas of potential development are currently being investigated:

  • Support for allowlist, package mapping
  • Establish a stable interchange format w/Syft
  • Accept SBOM (CycloneDX, Syft) as input instead of image/directory
  
  
  
  Download Grype
  
  Vollständiger Original-Bericht

  Ausführliche Details, Code-Beispiele & Hersteller-Stellungnahme auf feedproxy.google.com.

  ↗ Original-Artikel auf feedproxy.google.com lesen