Automatically and Regularly security scanning for container images
- Dominant language
- Python
- Stars
- 1.7k
- Forks
- 542
- PR merge metrics
- No merged PRs in 30d
Description
/kind feature
**Describe the solution you'd like**
[A clear and concise description of what you want to happen.]
Currently, we manually scan container images to resolve security issues just before we release the new version of katib.
Although, this is inefficient, and we should scan container images regularly, not only just before releasing.
It might be better to run OSS tools for security scanning like the following on the GitHub Actions:
- [Snyk](https://github.com/snyk/cli)
- [`docker scan`](https://docs.docker.com/engine/scan/) (internally Snyk)
- [Trivy](https://github.com/aquasecurity/trivy)
ref: #2094
**Anything else you would like to add:**
[Miscellaneous information that will assist in solving the issue.]
---
Love this feature? Give it a 👍 We prioritize the features with the most 👍
Contributor guide
Research direction
Start by reviewing the repository's GitHub Actions workflows and how Katib container images are built and released. Compare Snyk, docker scan, and Trivy for regularly scanning those images, then define the scan schedule and failure criteria. Done means security scans run automatically outside release time and report actionable findings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions
- Domain
- ci-cd, devops, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100