-
Notifications
You must be signed in to change notification settings - Fork 541
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: container app vulns by default #3433
Conversation
5f0b94b
to
c0cc31d
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If we could hold on releasing this until we've talked about the internal enablement needs please.
We had issues with Go modules not being detected. Version 5.0.1 of `snyk-docker-plugin` should fix those issues. This commit includes a workaround since we have a blocked PR (#3433) for making app vulns the default using the lates version of `snyk-docker-plugin`. Until we are able to make scanning app vulns the default, we need to make sure that we set `exclude-app-vulns` option when a user doesn't set the `app-vulns` option.
2ac384c
to
12d2588
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Small nit regarding the docs suggestion.
You're currently also missing the actual changes regarding the flag; e.g. the parts in src/cli/commands/{test,monitor}/index.ts
:)
c928df8
to
3e45154
Compare
6994477
to
3af25f6
Compare
|
b77bc8f
to
6fd4878
Compare
We've changed the default value of the "containerCliAppVulnsEnabled" feature flag to be `true`, which means that the acceptance tests that are depending on this being `false` are failing. This commit fixes the tests and also tests for the new default behaviour instead.
This commit refactors the docker suggestion text that will be printed if the user hasn't opted out of suggestions.
6fd4878
to
6723568
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
From Gareth: "Don’t block on me for PR reviews."
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
What does this PR do?
Enables container app scan by default. We are introducing a new flag,
exclude-app-vulns
in case a user would like to disable app scan.How should this be manually tested?
snyk container test <image_with_app>
should return app scan results without additional parameters.snyk container test --exclude-app-vulns <image_with_app>
should return only operating system scan results.Any background context you want to provide?
What are the relevant tickets?
https://snyksec.atlassian.net/browse/MYC-56