Scan docker images for vulnerabilities

[EnricoMi]

This scans our to-be-released docker images for vulnerabilities. Results are reported to GitHub Security.

[crazy-max]

@EnricoMi For this error: https://github.com/horovod/horovod/runs/5019456769?check_suite_focus=true#step:8:21

Error: 2022-02-01T10:47:24.296Z	FATAL	scan error: image scan failed: failed analysis: analyze error: failed to analyze layer: sha256:209f02f28bcd94fbda5c57ffa46bc7f7f3ccd55530454ec1d07a4a35122acdbb : unable to get uncompressed layer sha256:209f02f28bcd94fbda5c57ffa46bc7f7f3ccd55530454ec1d07a4a35122acdbb: failed to get the layer (sha256:209f02f28bcd94fbda5c57ffa46bc7f7f3ccd55530454ec1d07a4a35122acdbb): unable to populate: unable to open: failed to copy the image: write /tmp/fanal-2740541230: no space left on device

Just add a step to remove dotnet for example (~23G): docker/build-push-action#321 (comment)

  -
    name: Remove dotnet
    run: sudo rm -rf /usr/share/dotnet
  -
    name: Scan for vulnerabilities
    id: scan
    uses: crazy-max/ghaction-container-scan@v1
    with:
      image: horovod/${{ matrix.docker-image }}:latest
      dockerfile: ./docker/${{ matrix.docker-image }}/Dockerfile
    env:
      TRIVY_TIMEOUT: 60m

Edit: added a note about that: https://github.com/crazy-max/ghaction-container-scan#failed-to-copy-the-image-write-tmpfanal-2740541230-no-space-left-on-device

[EnricoMi]

Thanks, I am already deleting it, among others:

/usr/share/dotnet
/usr/local/lib/android
/opt/ghc

Otherwise I would not be able to build the image in the first place.

Now, the scanning needs more disk space, which I am currently trying to find more directories to delete.

Thanks for looking into this, though!

[EnricoMi]

Little remark @crazy-max, /usr/share/dotnet consumes only 4.1GB on Ubuntu 20.04: https://github.com/horovod/horovod/runs/5022621213?check_suite_focus=true#step:6:55

Other paths:

• /usr/local/lib/android occupies 15GB
• /opt/hostedtoolcache/CodeQL another 2GB
• /opt/hostedtoolcache/go has 1.2 GB

[github-actions]

Unit Test Results

     792 files   -   38       792 suites   - 38   9h 14m 24s ⏱️ - 44m 38s
     722 tests ±    0       679 ✔️ ±    0       43 💤 ±    0  0 ❌ ±0 
17 222 runs   - 815  12 266 ✔️  - 550  4 956 💤  - 265  0 ❌ ±0 

Results for commit 3a812bb. ± Comparison against base commit 2df6e1e.

♻️ This comment has been updated with latest results.

[github-actions]

Unit Test Results (with flaky tests)

     912 files   -     8       912 suites   - 8   9h 57m 34s ⏱️ - 27m 26s
     722 tests ±    0       678 ✔️ ±  0       43 💤 ±  0  1 ❌ ±0 
19 844 runs   - 146  13 956 ✔️  - 67  5 887 💤  - 79  1 ❌ ±0 

For more details on these failures, see this check.

Results for commit 3a812bb. ± Comparison against base commit 2df6e1e.

♻️ This comment has been updated with latest results.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.