Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for Docker pre push hook #1189

Closed
danielpacak opened this issue Oct 10, 2019 · 6 comments
Closed

Add support for Docker pre push hook #1189

danielpacak opened this issue Oct 10, 2019 · 6 comments

Comments

@danielpacak
Copy link

@danielpacak danielpacak commented Oct 10, 2019

GoReleaser has great support for building and publishing Docker images. I'm using it for example in this project https://github.com/aquasecurity/harbor-scanner-trivy . There is one missing hook though where I could scan my Docker image for vulnerabilities before I push it to a Docker registry, e.g. DockerHub. The only solution I have now is to do post publish scan and then remove or rebuild a vulnerable image manually. Preferably I'd like GoReleaser to not push to a registry when the pre push hook fails.

If we introduced a pre push hook, I could execute a scanning script. If its exit code is not equal to 0 we do not execute the Docker push command.

goreleaser_docker_pre_push_hook

Alternatively the scanning for vulnerabilities (or any other pre push checks) can be done manually before actually triggering a release process. Anyway I'm wondering wdyt about supporting such feature?

@caarlos0

This comment has been minimized.

Copy link
Member

@caarlos0 caarlos0 commented Oct 10, 2019

sounds good... what would be the idea, call the hook for each image built passing it as an arg?

@danielpacak

This comment has been minimized.

Copy link
Author

@danielpacak danielpacak commented Oct 10, 2019

Yup, we need to pass somehow a valid Docker image reference to the hook. In my example it would be aquasec/harbor-scanner-trivy:0.1.0-alpha.1.

I'm just wondering how do we handle it if there're multiple image templates configured in a single docker build. Doesn't make sense to scan them all as they refer to the same image ID / digest.

@caarlos0

This comment has been minimized.

Copy link
Member

@caarlos0 caarlos0 commented Oct 10, 2019

yeah, but maybe other kinds of hooks would want to? 🤔

@danielpacak

This comment has been minimized.

Copy link
Author

@danielpacak danielpacak commented Oct 10, 2019

Good point. I haven't seen the code, but I assume that you pass all image templates to the docker push command. If that's the case the pre push hooks should accept them all as well. In case of vulns scanning, the actual hook script might decide to skip all but the first arg.

@caarlos0

This comment has been minimized.

Copy link
Member

@caarlos0 caarlos0 commented Oct 10, 2019

yeah, I think that makes sense.

@stale

This comment has been minimized.

Copy link

@stale stale bot commented Nov 2, 2019

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

@stale stale bot added the wontfix label Nov 2, 2019
@stale stale bot closed this Nov 9, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
2 participants
You can’t perform that action at this time.