Implementing Container Security Scanning

1. Integrating Image Scanning Tools

Tool	Description	Integration Method	Supported Formats
Trivy	Open-source vulnerability scanner for containers and systems	Plugin or CLI integration in Jenkins pipeline	`docker`, `oci`
Clair	Static analysis tool for vulnerabilities in container images	Jenkins plugin or external API call	`docker`
Snyk	Security platform for container image scanning and monitoring	Jenkins plugin or API integration	`docker`, `k8s`
Aqua Security	Container security platform with image scanning capabilities	Jenkins plugin or integration via Aqua CLI	`docker`, `k8s`

Example: Trivy Integration in Jenkins Pipeline

pipeline {
    agent any
    stages {
        stage('Scan Image') {
            steps {
                sh '''trivy image --format json --output report.json your-image:latest'''
            }
        }
    }
}

Note: Ensure the scanning tool is installed on the Jenkins agent or in a container within the pipeline.

2. Scanning Base Images for Vulnerabilities

Image	Vulnerability Scan Result	Scan Date	Notes
node:18-alpine	NEW 0 critical, 2 high, 5 medium	2026-04-01	Includes CVE-2023-XXXXX, CVE-2023-YYYYY
python:3.10-slim	0 critical, 1 high, 3 medium	2026-04-02	Known vulnerability in urllib3
openjdk:17-jdk-alpine	0 critical, 0 high, 1 low	2026-04-03	Minor dependency issue, no impact

Example: Jenkins Pipeline Scan Step

pipeline {
    agent any
    stages {
        stage('Scan Base Image') {
            steps {
                sh '''docker scan node:18-alpine'''
            }
        }
    }
}

Note: Docker Scan is available in Docker Desktop and Enterprise Editions. For open-source tools, consider Trivy or Snyk.

3. Implementing Container Registry Scanning

Example: Jenkins Pipeline with Trivy Scan

pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                sh 'docker build -t myapp .'
            }
        }
        stage('Scan Container') {
            steps {
                sh '''
                    trivy image --format table --output scan-report.html myapp
                '''
            }
        }
    }
}

Scan Type	Description	Tool	Output Format
Image Scan	Scans container image for vulnerabilities	`Trivy`	`table`, `json`
Vulnerability DB	Database of known vulnerabilities	`Trivy`	`local`, `remote`

Note: Ensure Trivy is installed and configured in Jenkins environment.

Warning: Scan results should be reviewed manually before deployment.

Key Steps for Registry Scanning

Build container image
Run security scan using Trivy or Clair
Store scan results in Jenkins artifacts
Fail pipeline if critical vulnerabilities found

4. Configuring Vulnerability Thresholds

Threshold Type	Configuration	Description
critical	`0`	Fail build if any critical severity vulnerabilities found
high	`0`	Fail build if any high severity vulnerabilities found
medium	`10`	Fail build if more than 10 medium severity vulnerabilities found
low	`50`	Fail build if more than 50 low severity vulnerabilities found
unscanned	`0`	Fail build if any unscanned images found

Example: Jenkins Pipeline Configuration

pipeline {
    agent any
    stages {
        stage('Security Scan') {
            steps {
                sh '''docker scan --threshold=critical=0,high=0,medium=10,low=50 my-image:latest'''
            }
        }
    }
}

Note: Thresholds can be adjusted based on your organization's risk tolerance and compliance requirements.

5. Blocking Builds on Critical CVEs

Example: Jenkins Pipeline with CVE Blocking

pipeline {
    agent any
    stages {
        stage('Security Scan') {
            steps {
                sh 'trivy image --exit-code 1 --severity CRITICAL myapp:latest'
            }
        }
    }
}

Option	Values	Description
trivy.image	`myapp:latest`	Image to scan for vulnerabilities
trivy.exit-code	`1`	Exit with code 1 if critical CVEs found
trivy.severity	`CRITICAL`	Scan for critical severity issues only

Note: The exit-code 1 flag ensures that Jenkins will mark the build as failed if any critical CVEs are detected.

Warning: Ensure that the security scanning tool (e.g., Trivy) is properly configured to scan for all relevant CVEs and that the build pipeline is updated with the latest vulnerability database.

6. Using Clair for Image Analysis

Feature	Description	Configuration	Notes
clair.image	Image name to scan with Clair	`"myapp:latest"`	Must be accessible to Jenkins
clair.endpoint	Clair server URL	`"http://clair:6060"`	Ensure network access from Jenkins
clair.timeout	Scan timeout in seconds	`300`	Default is 5 minutes
clair.failOnHigh	Fail build on high severity issues	`true`	Set to `false` to allow builds with high issues

Example: Configure Clair in Jenkins Pipeline

pipeline {
  agent any
  stages {
    stage('Scan Image') {
      steps {
        sh '''docker pull myapp:latest'''
        clairScan(
          image: 'myapp:latest',
          endpoint: 'http://clair:6060',
          timeout: 300,
          failOnHigh: true
        )
      }
    }
  }
}

Note: Clair requires Docker daemon access to scan images. Ensure the Jenkins agent has Docker installed and configured.

Warning: Clair does not support scanning images from private registries without proper authentication setup.

7. Implementing Compliance Policies

Policy Type	Description	Implementation	Status
Security Policy	Defines security requirements and standards for container images	Enforce image scanning with tools like Trivy or Clair	NEW
Access Control Policy	Restricts access to container registries and build environments	Use Jenkins Role-Based Access Control (RBAC) or LDAP integration	DEPRECATED
Vulnerability Management Policy	Establishes procedures for identifying and mitigating vulnerabilities	Integrate with Jenkins plugins like OWASP Dependency-Check	BETA

Example: Security Policy Configuration

pipeline {
    agent any
    stages {
        stage('Scan Image') {
            steps {
                sh 'trivy image --security-checks vuln my-image:latest'
            }
        }
    }
}

Note: Ensure all compliance policies are reviewed regularly to adapt to new threats and regulatory changes.

Warning: Failure to implement compliance policies can lead to security breaches and non-compliance with industry standards.

8. Generating Security Scan Reports

Report Type	Description	Output Format	Configuration
OWASP ZAP Scan Report	Security scan report from OWASP ZAP tool	`xml`, `json`	`owaspZapReportFormat`
Trivy Scan Report	Container image vulnerability scan report from Trivy	`json`, `html`	`trivyReportFormat`
Snyk Scan Report	Security vulnerabilities report from Snyk	`json`, `html`	`snykReportFormat`

Example: Trivy Scan Report Configuration

pipeline {
    agent any
    stages {
        stage('Security Scan') {
            steps {
                sh '''trivy image --format json --output trivy-report.json my-image:latest'''
            }
        }
    }
}

Note: Ensure that the security scan report is generated in a format compatible with your CI/CD pipeline and reporting tools.

9. Integrating with Security Dashboards

Dashboard	Integration Method	Features	Notes
Jenkins Security Dashboard	`Security Dashboard Plugin`	Real-time scan results, vulnerability trends	Part of Jenkins core security plugin suite
SonarQube	`Security Dashboard Plugin`	Vulnerability tracking, compliance reports	Requires SonarQube server setup
Nexus IQ	`Nexus IQ Plugin`	Dependency risk analysis, policy enforcement	Requires Nexus IQ server integration
OWASP ZAP	`OWASP ZAP Plugin`	Automated security scanning, report generation	Can be integrated via Jenkins Pipeline

Example: Configuring Jenkins with SonarQube

pipeline {
    agent any
    stages {
        stage('Security Scan') {
            steps {
                sh 'sonar-scanner -Dsonar.projectKey=my-project -Dsonar.sources=.' 
            }
        }
    }
}

Note: Ensure that the SonarQube server is accessible from Jenkins and that proper authentication tokens are configured.

10. Automating Remediation Workflows

Example: Jenkins Pipeline for Automated Remediation

pipeline {
    agent any
    stages {
        stage('Scan and Remediate') {
            steps {
                sh 'docker scan my-app:latest'
                script {
                    def scanResult = sh(
                        script: "docker scan my-app:latest",
                        returnStdout: true
                    )
                    if (scanResult.contains('HIGH') || scanResult.contains('CRITICAL')) {
                        echo 'Security issues found, initiating remediation...'
                        sh 'docker build -t my-app:remediated .'
                        sh 'docker push my-app:remediated'
                    } else {
                        echo 'No critical issues found.'
                    }
                }
            }
        }
    }
}

Step	Description	Action	Status
Scan Container	Run security scan on container image	`docker scan my-app:latest`	Completed
Check Results	Parse scan output for critical issues	`scanResult.contains('HIGH')`	Pending
Remediate Image	Rebuild image with fixes applied	`docker build -t my-app:remediated .`	Failed
Push Image	Push updated image to registry	`docker push my-app:remediated`	Not Started

Note: Remediation workflows should be tested in a staging environment before applying to production images.

Warning: Ensure that automated remediation does not introduce new vulnerabilities or break application functionality.

Summary of Remediation Workflow

Initiate security scan on container image
Automatically detect critical vulnerabilities
Rebuild and re-scan image with fixes
Push updated image to registry if no new issues found