anchore-engine - A service that analyzes docker images and scans fo

项目说明

Anchore Engine ![CircleCI]()

IMPORTANT NOTE

As of 2023, Anchore Engine is no longer maintained. There will be no future released. Users are advised to use Syft and Grype.

For users interested in a supported commercial solution for container scanning and complaiance, schedule a demo to see Anchore Enterprise’s broad set of enterprise capabilities including SBOM management, management, and compliance management.

About

Anchore Engine is an open-source project that provides a centralized service for inspection, analysis, and certification of container images. Anchore Engine is provided as a Docker container image that can be run standalone or within an orchestration platform such as Kubernetes, Docker Swarm, Rancher, Amazon ECS, and other container orchestration platforms.

With a deployment of Anchore Engine running in your en, container images are downloaded and analyzed from Docker V2 compatible container registries and then e against a database.

Historical documentation is a at Anchore Documentation.

Anchore Engine can be accessed directly through a RESTful API or via the Anchore CLI.

Supported Operating Systems

Supported Packages

Installation

There are several ways to get started with Anchore Engine, for the latest information on quickstart and full production installation with docker-compose, Helm, and other methods, please visit:

The Anchore Engine is distributed as a Docker Image a from DockerHub.

Quick Start (TLDR)

See documentation for the full quickstart guide.

To quickly bring up an installation of Anchore Engine on a system with docker (and docker-compose) installed, follow these simple steps:

Once the Engine is up and running, you can begin to interact with the system using the CLI.

Getting Started using the CLI

The Anchore CLI is an easy way to control and interact with the Anchore Engine.

The Anchore CLI can be installed using the Python pip command, or by running the CLI from the Anchore Engine CLI container image. See the Anchore CLI project on Github for code and more installation options and usage.

CLI Quick Start (TLDR)

By default, the Anchore CLI tries to connect to the Anchore Engine at with no authentication.
The username, password, and URL for the server can be passed to the Anchore CLI as command-line arguments:

--u TEXT Username eg. admin
--p TEXT Password eg. foobar
--url TEXT Service URL eg.

Rather than passing these parameters for every call to the tool, they can also be set as en :

ANCHORE_CLI_URL=
ANCHORE_CLI_USER=admin
ANCHORE_CLI_PASS=foobar

Add an image to the Anchore Engine:

anchore-cli image add docker.io/library/debian:latest

Wait for the image to move to the 'analyzed' state:

anchore-cli image wait docker.io/library/debian:latest

List images analyzed by the Anchore Engine:

anchore-cli image list

Get image o and summary information:

anchore-cli image get docker.io/library/debian:latest

List feeds and wait for at least one data feed sync to complete. The first sync can take some time (20-30 minutes) after that syncs will only merge deltas.

anchore-cli system feeds list
anchore-cli system wait

Obtain the results of the scan on an image:

anchore-cli image vuln docker.io/library/debian:latest os

List operating system packages present in an image:

anchore-cli image content docker.io/library/debian:latest os

API

For the external API definition (the user-facing service), see External API Swagger Spec. If you ha Engine running, you can also review the Swagger by directing your browser at (NOTE: the trailing slash is required for the embedded swagger UI browser to be properly).

Each service implements its own API, and all APIs are defined in Swagger/OpenAPI spec. You can find each in the _anchore_engine/services/\<ser\>/api/swagger_ directory.

More Information

For further details on the use of the Anchore CLI with the Anchore Engine, please refer to the Anchore Engine Documentation

De

This repo was reformatted using Black in Nov. 2020. This commit can
be ignored in your local en when using git blame since it impacted so many files. To ignore the commit you need
to configure git-blame to use the provided file: .git-blame-ignore-revs as a list of commits to ignore for blame.

Set your local git configuration to use the provided file by running this from within the root of this source tree:
git config blame.ignoreRe .git-blame-ignore-revs

项目信息

开发语言：Python

Star 数：1591

技术要点

该项目属于漏洞知识库方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A service that analyzes docker images and scans for vulnerabilities展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。