Container Registries

# Install Trivy
brew install aquasecurity/trivy/trivy    # Mac
apt-get install trivy                    # Ubuntu/Debian
trivy --version

# === Basic scan — see ALL vulnerabilities ===
trivy image myapp:v1.0.0

# Example output:
# Total: 27 (CRITICAL: 0, HIGH: 2, MEDIUM: 8, LOW: 17)
#
# ┌──────────────┬────────────────┬──────────┬────────────┐
# │  Library     │ Vulnerability  │ Severity │  Fixed In  │
# ├──────────────┼────────────────┼──────────┼────────────┤
# │ openssl      │ CVE-2023-5678  │  HIGH    │  3.1.5     │
# │ libssl       │ CVE-2023-5679  │  HIGH    │  3.1.5     │
# │ zlib         │ CVE-2023-1234  │  MEDIUM  │  1.2.13    │
# └──────────────┴────────────────┴──────────┴────────────┘

# === Filter by severity ===
trivy image --severity HIGH,CRITICAL myapp:v1.0.0

# === Exit code 1 if found (for CI gate) ===
trivy image --exit-code 1 \
            --severity HIGH,CRITICAL \
            myapp:v1.0.0
# Exit 0 → no HIGH/CRITICAL → CI passes
# Exit 1 → found HIGH/CRITICAL → CI fails

# === JSON output for automation ===
trivy image --format json \
            --output results.json \
            myapp:v1.0.0

# === Scan a remote image (from GHCR) ===
trivy image ghcr.io/user/myapp:v1.0.0

# === Scan filesystem (CI — before build) ===
trivy fs --severity HIGH,CRITICAL .

# === Scan IaC files (Terraform, K8s YAML) ===
trivy config ./k8s/

# === GHCR: GITHUB_TOKEN (no setup needed) ===
# In GitHub Actions, just add permissions:
permissions:
  packages: write

# === GHCR: PAT for local push ===
# Create PAT: github.com/settings/tokens
# Scopes: write:packages, read:packages, delete:packages
echo $GITHUB_PAT | docker login ghcr.io \
  -u YOUR_USERNAME \
  --password-stdin

# === ACR: Service Principal (CI) ===
az acr login --name acrinfra
# Or with credentials:
docker login acrinfra.azurecr.io \
  -u $SP_CLIENT_ID \
  -p $SP_CLIENT_SECRET

# === K8s: imagePullSecret for private registry ===
kubectl create secret docker-registry ghcr-secret \
  --docker-server=ghcr.io \
  --docker-username=YOUR_USER \
  --docker-password=$GITHUB_PAT
# In pod spec:
spec:
  imagePullSecrets:
    - name: ghcr-secret

# === Image signing with cosign ===
# Install: brew install cosign
cosign generate-key-pair
cosign sign --key cosign.key \
  ghcr.io/user/myapp:v1.0.0
# Verify signature:
cosign verify --key cosign.pub \
  ghcr.io/user/myapp:v1.0.0
# K8s: Policy Controller enforces: only signed images run

# === Login ===
az acr login --name acrinfra
# uses az CLI credentials — no password in shell!

# === Build + push directly in Azure ===
az acr build \
  --registry acrinfra \
  --image myapp:v1.0.0 \
  .
# Builds in Azure, no local Docker needed!
# Great for CI runners without Docker daemon

# === List repositories ===
az acr repository list \
  --name acrinfra \
  --output table

# === List tags for a repo ===
az acr repository show-tags \
  --name acrinfra \
  --repository myapp \
  --orderby time_desc

# === ACR Defender: scan results ===
az security assessment list \
  --query "[?contains(name,'acr')]"

# === GitHub Actions → ACR (Managed Identity) ===
# In your workflow:
- uses: azure/login@v2
  with:
    client-id: \${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: \${{ secrets.AZURE_TENANT_ID }}
    subscription-id: \${{ secrets.AZURE_SUBSCRIPTION_ID }}

- uses: azure/docker-login@v1
  with:
    login-server: acrinfra.azurecr.io
    username: \${{ secrets.ACR_USERNAME }}
    password: \${{ secrets.ACR_PASSWORD }}

name: Container CI/CD

on:
  push:
    branches: [ main ]
  push:
    tags: [ 'v*.*.*' ]    ← also runs on git tag

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: \${{ github.repository }}

jobs:
  build-scan-push:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write    ← for uploading scan results

    steps:
      - uses: actions/checkout@v4

      - name: Set up Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: \${{ github.actor }}
          password: \${{ secrets.GITHUB_TOKEN }}

      - name: Extract metadata (tags)
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/\${{ env.IMAGE_NAME }}
          tags: |
            type=sha
            type=semver,pattern={{version}}
            type=semver,pattern={{major}}.{{minor}}
            type=raw,value=latest,enable=\${{ github.ref == 'refs/heads/main' }}

      - name: Build image (don't push yet)
        uses: docker/build-push-action@v5
        with:
          context: .
          push: false            ← build only, scan first!
          load: true             ← load into local Docker
          tags: \${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Scan with Trivy (BLOCK on CRITICAL)
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ghcr.io/\${{ env.IMAGE_NAME }}:latest
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: '1'          ← fail if CRITICAL/HIGH found

      - name: Upload scan results to GitHub
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results.sarif

      - name: Push to GHCR (only if scan passed)
        uses: docker/build-push-action@v5
        with:
          context: .
          push: true             ← now push
          tags: \${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

# === Step 1: Authenticate ===
export GITHUB_PAT="ghp_yourtoken"
export GITHUB_USERNAME="priyakaviyil"

echo $GITHUB_PAT | docker login ghcr.io \
  -u $GITHUB_USERNAME \
  --password-stdin
# Login Succeeded

# === Step 2: Build with all tags ===
IMAGE="ghcr.io/$GITHUB_USERNAME/my-devops-app"
VERSION="1.0.0"
SHA=$(git rev-parse --short HEAD)

echo "Building $IMAGE:$VERSION-$SHA"

docker build \
  -t $IMAGE:$VERSION \
  -t $IMAGE:$VERSION-$SHA \
  -t $IMAGE:latest \
  -f Dockerfile .

# === Step 3: Push all tags ===
docker push $IMAGE:$VERSION
docker push $IMAGE:$VERSION-$SHA
docker push $IMAGE:latest

# Check: github.com/USERNAME/my-devops-app → Packages
# You should see: v1.0.0, v1.0.0-abc1234, latest

# === Step 4: Scan locally ===
# Install if needed:
# brew install aquasecurity/trivy/trivy

trivy image $IMAGE:$VERSION
trivy image --severity HIGH,CRITICAL $IMAGE:$VERSION

# Test the gate:
trivy image --exit-code 1 \
            --severity CRITICAL \
            $IMAGE:$VERSION
echo "Exit code: $?"
# 0 = no CRITICAL → CI would pass
# 1 = CRITICAL found → CI would fail

# metadata-action generates tags automatically
- id: meta
  uses: docker/metadata-action@v5
  with:
    images: ghcr.io/\${{ github.repository }}
    tags: |
      # Git SHA — always generated
      type=sha                             → sha-a3f7c2d

      # Branch name — on branch push
      type=ref,event=branch                → main

      # PR number — on pull request
      type=ref,event=pr                    → pr-42

      # Full SemVer — on git tag v1.2.3
      type=semver,pattern={{version}}      → 1.2.3

      # Minor version — on git tag
      type=semver,pattern={{major}}.{{minor}} → 1.2

      # Major version — on git tag
      type=semver,pattern={{major}}        → 1

      # latest — only on main branch
      type=raw,value=latest,\
        enable=\${{ github.ref == 'refs/heads/main' }}

# On push to main:
# Tags: sha-a3f7c2d, main, latest

# On git tag v2.4.1:
# Tags: sha-a3f7c2d, 2.4.1, 2.4, 2, latest

# === Image scanning ===
trivy image myapp:latest          # local image
trivy image ghcr.io/u/app:v1.0.0  # remote image
trivy image nginx:alpine           # official image

# === Severity filtering ===
trivy image --severity HIGH,CRITICAL myapp
trivy image --severity CRITICAL myapp

# === CI gate ===
trivy image --exit-code 1 \
            --severity CRITICAL \
            myapp:latest
# exit 0 = no CRITICAL → pipeline passes
# exit 1 = CRITICAL found → pipeline fails

# === Output formats ===
trivy image --format table myapp      # default
trivy image --format json myapp       # machine-readable
trivy image --format sarif myapp      # GitHub Security tab
trivy image --format cyclonedx myapp  # SBOM output

# === Filesystem scan (before build) ===
trivy fs .                            # scan current dir
trivy fs --severity HIGH,CRITICAL .

# === Repo scan ===
trivy repo github.com/user/repo

# === IaC scan ===
trivy config ./k8s/           # K8s YAML
trivy config ./terraform/     # Terraform
trivy config Dockerfile       # Dockerfile lint

# === Secret scanning ===
trivy fs --scanners secret .
# finds: AWS keys, GitHub tokens, etc.

# === Ignore specific CVEs ===
# Create .trivyignore:
# CVE-2023-1234   # accepted risk: no fix available
# CVE-2023-5678   # not exploitable in our config

# Auth
echo $PAT | docker login ghcr.io -u user --password-stdin
az acr login --name acrinfra

# Build with proper tags
IMAGE="ghcr.io/user/myapp"
VERSION="1.0.0"
SHA=$(git rev-parse --short HEAD)
docker build \
  -t $IMAGE:$VERSION \
  -t $IMAGE:$VERSION-$SHA \
  -t $IMAGE:latest .

# Push
docker push $IMAGE:$VERSION
docker push $IMAGE:$VERSION-$SHA
docker push $IMAGE:latest

# Pull / inspect
docker pull $IMAGE:v1.0.0
docker inspect $IMAGE:v1.0.0

# List local images
docker images $IMAGE
docker image ls --digests $IMAGE

# Trivy scan
trivy image $IMAGE:v1.0.0
trivy image --severity HIGH,CRITICAL \
            --exit-code 1 \
            $IMAGE:v1.0.0

# Create release tag
git tag v1.0.0
git push origin v1.0.0