Documentation
¶
Overview ¶
Package scan is part of the Redoubt control plane. See CLAUDE.md for its role.
Package scan runs Trivy (vulnerabilities) and Syft (SBOM) against a built or pulled image before it is started (E2.5). Both tools run as one-shot hardened job containers (docker.ContainerSpec) against an image tarball exported through the socket-proxy's allow-listed GET /images/get, so neither scanner ever touches the Docker socket.
Index ¶
Constants ¶
const ( PolicyOff = "off" // no scan, no SBOM PolicyWarn = "warn" // scan + SBOM, never block PolicyBlock = "block" // a CRITICAL finding or a scanner failure fails the deployment )
Policies.
const ( DefaultTrivyImage = "aquasec/trivy:0.70.0" DefaultSyftImage = "anchore/syft:v1.33.0" // DefaultNetwork is the dedicated egress network scanners use for vulnerability-DB // downloads; apps never join it. DefaultNetwork = "redoubt-scan" )
Pinned scanner images (overridable via REDOUBT_SCAN_TRIVY_IMAGE / REDOUBT_SCAN_SYFT_IMAGE).
Variables ¶
var ErrBlocked = errors.New("blocked by scan policy")
ErrBlocked wraps a policy block.
Functions ¶
Types ¶
type Counts ¶
type Counts struct{ Critical, High, Medium, Low, Unknown int }
Counts holds vulnerability counts by severity.
type Fake ¶
type Fake struct {
// Results maps image ref → counts; unmatched refs use Default.
Results map[string]Counts
Default Counts
// Err, when set, is returned as a scanner failure (policy decides whether it blocks).
Err error
// DataDir, when set, makes the fake write SBOM files like the real runner.
DataDir string
Calls []Request
// contains filtered or unexported fields
}
Fake is a Scanner for tests: it returns canned counts per image (or Result for all when Results is nil), records requests, and optionally writes SBOM files under DataDir/sboms.
type Request ¶
type Request struct {
ImageRef string
App string
DeploymentID string
Policy string
// Logs receives one-line progress and the final summary (already redacted upstream).
Logs io.Writer
}
Request describes one scan.
type Result ¶
type Result struct {
Critical int `json:"critical"`
High int `json:"high"`
Medium int `json:"medium"`
Low int `json:"low"`
Unknown int `json:"unknown"`
Blocked bool `json:"blocked"`
Policy string `json:"policy"`
Skipped bool `json:"skipped,omitempty"`
ScannerError string `json:"scanner_error,omitempty"`
TrivyVersion string `json:"trivy_version,omitempty"`
SBOMSPDXPath string `json:"sbom_spdx_path,omitempty"`
SBOMCycloneDXPath string `json:"sbom_cyclonedx_path,omitempty"`
Duration time.Duration `json:"duration_ns"`
Summary string `json:"summary"`
}
Result summarises a scan; SummaryJSON is what releases.scan_summary_json stores.
func (Result) SummaryJSON ¶
SummaryJSON renders the result for storage.
type Runner ¶
type Runner struct {
Docker *docker.Client
DataDir string
// HostDataDir is DataDir as the daemon sees it (see docker.ContainerSpec.HostDataDir).
HostDataDir string
TrivyImage string
SyftImage string
Network string
// Timeout bounds each scanner container.
Timeout time.Duration
// Test labels the job containers redoubt.test=1.
Test bool
// AppArmorProfile for the scanner containers (default docker-default).
AppArmorProfile string
}
Runner scans with real Trivy/Syft containers.
Source Files