kubeflow / kubeflow/katib

Automatically and Regularly security scanning for container images

Open
#2,095 7 comments 1 reaction 0 assignees View on GitHub
kind/feature lifecycle/frozen
Dominant language
Python
Stars
1.7k
Forks
542
PR merge metrics
No merged PRs in 30d

Description

/kind feature

**Describe the solution you'd like**
[A clear and concise description of what you want to happen.]
Currently, we manually scan container images to resolve security issues just before we release the new version of katib.

Although, this is inefficient, and we should scan container images regularly, not only just before releasing.

It might be better to run OSS tools for security scanning like the following on the GitHub Actions:

- [Snyk](https://github.com/snyk/cli)
- [`docker scan`](https://docs.docker.com/engine/scan/) (internally Snyk)
- [Trivy](https://github.com/aquasecurity/trivy)

ref: #2094

**Anything else you would like to add:**
[Miscellaneous information that will assist in solving the issue.]

---

Love this feature? Give it a 👍 We prioritize the features with the most 👍

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the repository's GitHub Actions workflows and how Katib container images are built and released. Compare Snyk, docker scan, and Trivy for regularly scanning those images, then define the scan schedule and failure criteria. Done means security scans run automatically outside release time and report actionable findings.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, github-actions
Domain
ci-cd, devops, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.