[ECR] [request]: Support for Distroless Image via Basic Vulnerability Scan in ECR- claircore
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
If you currently scanning an Distroless-Image with Basic-Scan in ECR, you just getting no results via Console/API once Scan finished (Note: 'Fixing it' on AWS-side by returning an UnsupportedImageError would not help!). Hence, **_we like to get support for Distroless-Images in AWS ECR Basic Scanner_**!
**Which service(s) is this request for?**
ECR
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
AWS ECR Basic Scanning does not support [Distroless-Images](https://github.com/GoogleContainerTools/distroless) for detection of vulnerabilities. AWS ECR Basic Scanning using Clair. Futhermore, AWS Basic Scanner doesn't use the current upstream release (from claircore). Clair added support via https://github.com/quay/claircore/issues/181 (in 2020) and https://github.com/quay/claircore/issues/1018 (in 2023) - Maybe this helps to enable/re-implement Scanning in "ECR-Clair-codebase". Sure, there are still ongoing discussions via https://github.com/quay/claircore/issues/969.
**Are you currently working around this issue?**
We using an Ubuntu images, which are per se more vulnerable! We like to switch to Distroless, as recommended by Envoy team (https://github.com/envoyproxy/envoy/issues/31015#issuecomment-1822969819)
**Additional context**
_Here is a real life background:_ We are heavily relay on [Envoy Proxy](https://github.com/envoyproxy/envoy) within our AWS ECR cluster setup (yes, we doesn't use the new, fancy AWS App Mesh - we are using patterns like: https://aws.amazon.com/de/blogs/compute/setting-up-an-envoy-front-proxy-on-amazon-ecs/). Envoy recently stopped built & provide Alpine Images. Having this said, now only Ubuntu-based and Distroless-based Images for Envoy Proxy are available. As a first step, we tried the Ubuntu-based Image: We saw a bunch of security issues, which we highlighted here: https://github.com/envoyproxy/envoy/issues/31015 As a next steps, we moved to the Distroless-based Images of Envoy Proxy. Since we integrated ECR Basic Scanning within our Pipelines (proceed with deployment based on the return of Basic-Scan), a switch to Enhanced Scanning is not an (easy) option yet for us.
Contributor guide
Research direction
No project files, tests, or entry points are named. Start by reviewing Clair issues 181, 1018, and 969 alongside the ECR Basic Scanning behavior described here; done means Distroless images produce vulnerability scan results through the ECR Basic Scanner.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100