Container Image Scanning

What is image scanning?

Image scanning is the process of inspecting container images for potential security issues, such as vulnerabilities, misconfigurations, malware, and more. It’s an essential practice for Kubernetes security, as it helps to ensure that only trusted and secure images are deployed to Kubernetes clusters.

Container Image Scanning Process

The image scanning process typically involves the following steps:

1. Building or pulling an image from a registry

The first step is to obtain an image by building it from a Dockerfile or other source code or pulling it from a public or private registry.

2. Analyzing the image for vulnerabilities, misconfigurations, malware, etc.

The next step is to scan the image using an image scanning tool, which can analyze the image for various security issues, such as:

Misconfigurations: Incorrect or suboptimal settings or parameters in the image or its components, such as the user, permissions, ports, environment variables, or files, that can increase the risk or exposure of the image.
Malware: Malicious or unwanted software or code in the image or its components, such as viruses, worms, trojans, ransomware, spyware, or backdoors, that can harm or compromise the image or the cluster.
Kubernetes vulnerability scanning: A specific type of image scanning that focuses on detecting and resolving vulnerabilities that affect Kubernetes clusters, such as insecure cluster configurations, exposed API endpoints, or outdated Kubernetes versions. Vulnerabilities are usually identified by their Common Vulnerabilities and Exposures (CVE) identifiers and rated by their severity and impact.

3. Generating a report with the scan results and recommendations

The next step is to generate a report, which can include:

A summary of the scan findings, including the number and severity of issues, the affected components, and the potential impact or risk.
A detailed list of the issues, such as the CVE identifiers, descriptions, references, scores, and fixes for vulnerabilities, or the names, types, signatures, and removal methods for malware.
A set of recommendations or best practices for improving the security of the image, such as applying patches, fixes, or mitigations or modifying or removing specific components or configurations.

4. Applying patches, fixes, or mitigations to the image

The next step is to apply patches, fixes, or mitigations to the image, which can involve:

Updating or upgrading the image or its components to the latest versions which can resolve or prevent known vulnerabilities or issues.
Removing or disabling unnecessary or unused components or features from the image, which can reduce the attack surface or exposure of the image.
Configuring or hardening the image or its components according to security standards or best practices to enhance the security posture or resilience of the image.

5. Pushing the updated image to a registry or deploying it to a cluster

The final step is to push the updated image to a registry or deploy it to a cluster, such as:

Tagging or labeling the image with metadata, such as the scan date, status, or results to track or verify the image’s security.
Signing or encrypting the image with cryptographic keys to ensure the integrity or confidentiality of the image.
Pushing or pulling the image to or from a registry, which can be a public or private repository for storing and distributing images.
Deploying or running the image to or on a cluster, which can be a group of nodes or machines that run Kubernetes and host the containers.

Container image scanning tools

Many image scanning tools are available, each with its features, strengths, weaknesses, and compatibility with Kubernetes. Some popular open-source image scanning tools are Clair, Anchore, Trivy, and Kubescape.

1. Clair

Clair detects vulnerabilities in images from platforms like Docker, OCI, or ACI, offering a RESTful API for integration and notifications for new vulnerabilities. It scans operating system and application layers using NVD, CVE, or Alpine SecDB databases.

Integrated with Kubernetes via Admission Controllers like OPA Gatekeeper, Clair enforces image scanning policies to block insecure deployments. However, it doesn’t detect misconfigurations or malware and lacks fixes or recommendations for identified issues.

2. Anchore

Anchore detects vulnerabilities, misconfigurations, and malware in images from registries like Docker Hub, Quay, or Harbor. It offers a CLI and RESTful API for integration with other tools, utilizing multiple vulnerability databases, including NVD, CVE, and Alpine SecDB. Integrated with Kubernetes, it enforces image scanning policies through Admission Controllers like OPA Gatekeeper to block insecure images.

Anchore provides fixes and recommendations, enforcing image security policies, but note that it can be complex to install and may produce false positives or false negatives.

3. Trivy

Trivy scans images from registries like Docker Hub, Quay, or Harbor with a CLI and RESTful API for integration. It checks for vulnerabilities using databases like NVD, CVE, or Alpine SecDB and scans for malware with signatures, heuristics, or behavioral analysis. Integrated with Kubernetes via Admission Controllers like OPA Gatekeeper, it enforces image scanning policies to block insecure deployments.

Trivy offers solutions and recommendations for detected issues and can be installed as a standalone binary or a container. However, it doesn’t scan for malware and may lack support for certain image components or features like multi-stage builds or scratch images.

4. Kubescape

Kubescape is a Kubernetes security tool that helps you secure your images and Kubernetes clusters. It scans images from various sources, such as Docker, OCI, and Helm, and checks the configuration of Kubernetes clusters. It also offers practical fixes and recommendations and follows the best practices from NIST and NSA.

Kubescape works with popular registries, such as Docker Hub, Quay, or Harbor, and uses Kubernetes Admission Controllers, such as OPA Gatekeeper, to prevent unsafe deployments.

Benefits of image scanning in Kubernetes security

Image scanning helps to ensure that only trusted and secure images are deployed to Kubernetes clusters. Some of the benefits of image scanning are:

Early detection of security issues: This lets you track your containers’ security status and plan practical remediation steps. Additionally, integrating image scanning into your container lifecycle within Kubernetes automates the process, minimizing the risk of data theft or deployment tampering by reducing the attack surface.
Reduction of security risks and threats: Remediating or mitigating security issues by applying patches, fixes, or best practice configurations to the images. Thus preventing or minimizing the risk of exploitation via vulnerabilities or malware. This can help to reduce the security risks and threats posed by attackers who target the images, such as ransomware, cryptojacking, or backdoors.
Ensuring compliance with security policies and regulations: Image scanning enforces security standards and requirements through policies and rules, validating image security levels to comply with industry standards and regulatory requirements. It promotes best practices like using the latest versions and removing unnecessary parts to mitigate breaches, non-compliance penalties, or reputational damage risks.

Image scanning is a valuable technique for detecting known vulnerabilities and security issues in container images. Still, it also has a drawback, in that images can be a source for not only CVEs but also for malware, which is not identified by most image scanners and requires runtime detection capabilities.

Image scanning best practices

To implement image scanning effectively, it’s recommended to:

Scan images regularly and continuously: Image scanning should be a regular and continuous practice performed at every stage of the image lifecycle, from development to deployment. It ensures that the images are always up-to-date and secure and that any new or emerging security issues are detected and resolved as soon as possible.
Integrate image scanning into the CI/CD pipeline: It ensures consistent identification and resolution of security issues when running CI/CD before deployment. This integration should occur at various pipeline stages and include configuration as a security gate. Tools like Git, Jenkins, or Kubernetes should be leveraged for automated scanning.
Use policies and rules to enforce image scanning standards: Image scanning should be governed by policies that define the standards and expectations for image security, such as the minimum or maximum number or severity of issues allowed, the frequency or timing of scans, or the actions or consequences for non-compliance.
Monitor and audit the image scanning activities and outcomes: Image scanning should be monitored and audited to track and verify the activities and outcomes, including scan status, issue severity, fix effectiveness, and incident impact, to assess performance and identify improvement areas.

Enhancing Kubernetes security

Image scanning is an essential practice for Kubernetes security, as it helps to ensure that only trusted and secure images are deployed to Kubernetes clusters. It should be performed regularly and continuously, integrated into the CI/CD pipeline, and complemented by runtime security tools to achieve the optimal level of security for Kubernetes clusters and resources.