azure-pipelines-clair.yaml

# Pipeline to build an image based on a Dockerfile and perform vulernability scan by Clair V2
name: $(BuildDefinitionName)_$(date:yyyyMMdd)_$(BuildID)$(rev:.r)

trigger: none

pool: app-agents

resources:
- repo: self

variables:
  image_name: openjdk
  image_tag: 17-jdk-slim
  clair_db: arminc/clair-db:latest
  clair_scan: arminc/clair-local-scan:v2.1.7_5125fde67edee46cb058a3feee7164af9645e07d

jobs:

- job: ClairScanContainerImage
  displayName: Scan container image by ClairV2

  steps:
  - task: Docker@2
    displayName: 'Build an image'
    inputs:
      command: build
      repository: $(image_name)
      tags: $(image_tag)
      dockerFile: '**/Dockerfile'

  - script: |
      mkdir report

      docker run -d --name clair-db $(clair_db)
      docker run -p 6060:6060 --link clair-db:postgres -d --name clair $(clair_scan)
      MY_IP=$(ifconfig eth0 | grep -Eo 'inet (addr:)?([0-9]*\.){3}[0-9]*' | grep -Eo '([0-9]*\.){3}[0-9]*' | grep -v '127.0.0.1')
      sleep 10
      CLAIR_IP=$(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' clair)
      clair-scanner --ip $MY_IP --clair http://$CLAIR_IP:6060 -t High --reportAll=false $(image_name):$(image_tag) | tee ./report/clair-image-scan-report.txt

      docker stop clair
      docker rm clair
      docker stop clair-db
      docker rm clair-db
      docker image rm $(clair_db)
    displayName: "Image scan by Clair"
    continueOnError: true

  - publish: ./report
    artifact: ImageScans
    displayName: Publish Clair Scan Report
    condition: always()