WEBVTT

00:00:02.140 --> 00:00:06.650
In this demo, we're going to go over some basic usage of Dockle.

00:00:06.650 --> 00:00:11.250
First, we're going to scan a hosted container image where we pull the

00:00:11.250 --> 00:00:14.050
container from a Docker registry server.

00:00:14.940 --> 00:00:19.700
Then, we're going to scan a local container image, and we output the

00:00:19.700 --> 00:00:25.010
test results into JSON format. First, let's take a look at the source,

00:00:25.010 --> 00:00:28.410
which can be found on GitHub. On the site,

00:00:28.410 --> 00:00:33.610
github.com/goodwithtech/dockle, you can find more information about

00:00:33.610 --> 00:00:39.160
Dockle itself. And if we scroll down on this page, we can see more

00:00:39.160 --> 00:00:42.560
information about actually installing it and using it.

00:00:43.240 --> 00:00:47.510
I'm going to the section Installation, and here you can see that there are

00:00:47.510 --> 00:00:53.360
packages available for various operating systems. Since a common use case for

00:00:53.360 --> 00:00:58.040
Dockle is using it in continuous integration environments, it makes sense to

00:00:58.040 --> 00:01:00.350
run it as a Docker container itself.

00:01:01.140 --> 00:01:03.750
That method is also specified on this page.

00:01:04.540 --> 00:01:08.280
I'm now going to the top of the page, and there you can see that the latest

00:01:08.280 --> 00:01:13.760
version, as of the moment of recording, is version 0.4.3.

00:01:14.240 --> 00:01:17.360
So that's the version of the Docker image we're going to use.

00:01:18.440 --> 00:01:21.630
Let's now go to the console. As this course is about the

00:01:21.630 --> 00:01:25.200
technology to be used with Docker, I assume you're more or

00:01:25.200 --> 00:01:26.960
less familiar with Docker itself.

00:01:27.340 --> 00:01:30.950
I'm running here a vanilla Debian installation, but these commands should

00:01:30.950 --> 00:01:35.570
work on any operating system where Docker is installed. First, I'm going

00:01:35.570 --> 00:01:39.320
to check whether Docker is working as it should, and I'm doing it by

00:01:39.330 --> 00:01:42.260
running the default hello‑world image.

00:01:42.740 --> 00:01:45.560
If everything is installed correctly, then I should see

00:01:45.560 --> 00:01:48.050
the infamous Hello World message.

00:01:48.840 --> 00:01:50.160
Perfect! Docker is running.

00:01:51.140 --> 00:01:53.930
I'm going to clear my screen. As you might remember from what we

00:01:53.930 --> 00:01:57.950
saw on the website, the latest version was 0.4.3.

00:01:59.040 --> 00:02:01.160
So let's run the container by itself.

00:02:01.540 --> 00:02:05.330
I'm passing the ‑‑rm flag to make sure that the container is

00:02:05.330 --> 00:02:09.280
discarded after use. And if everything goes successfully,

00:02:09.289 --> 00:02:12.260
you should see the default help screen for Dockle.

00:02:13.040 --> 00:02:18.050
Perfect! We're able to run Dockle as a Docker container, which makes it

00:02:18.060 --> 00:02:20.950
easier to use in a continuous integration environment.

00:02:22.040 --> 00:02:26.440
I'm going to clear the screen using Ctrl+L. So let's scan a

00:02:26.450 --> 00:02:32.020
remote image, which is hosted on Docker Hub. We can do that by

00:02:32.030 --> 00:02:36.220
repeating the last command, and then passing in the name of the

00:02:36.220 --> 00:02:37.650
container that we'd like to scan.

00:02:38.140 --> 00:02:42.850
And the container I'd like to scan is the official OWASP juice‑shop container.

00:02:44.140 --> 00:02:49.140
This is a fictitious web shop, which can be used for training purposes. So the

00:02:49.150 --> 00:02:52.730
only thing I'm doing right now is passing the name of the container to Dockle.

00:02:52.890 --> 00:02:58.960
It will now retrieve the container from Docker Hub and automatically scan the

00:02:58.960 --> 00:03:02.310
resulting container. And after a while,

00:03:02.540 --> 00:03:05.900
depending on how fast or slow your internet connection is, we should

00:03:05.900 --> 00:03:10.270
see the results. By the way, it is always good practice to specify

00:03:10.270 --> 00:03:14.210
exactly which version you're using, in this specific instance,

00:03:14.220 --> 00:03:19.500
0.4.3, to make sure you perform deterministic scans with a given

00:03:19.510 --> 00:03:21.360
input and a given output.

00:03:21.740 --> 00:03:27.680
And as you can see, here we see the results of the scan. On

00:03:27.680 --> 00:03:32.070
Dockle's README page, you can find more information about what

00:03:32.070 --> 00:03:33.860
exactly the different levels mean,

00:03:34.240 --> 00:03:37.660
what the difference is between FATAL, for example, and INFO.

00:03:38.940 --> 00:03:42.110
Later in this course, we'll dive deeper into exactly what the

00:03:42.110 --> 00:03:45.560
different findings mean. Back to the console.

00:03:46.840 --> 00:03:51.220
So next up is scanning a local container. And in order to do

00:03:51.220 --> 00:03:54.940
that, well, let's first create a container. For this specific

00:03:54.940 --> 00:03:58.590
demonstration, I'm going to use a container image containing

00:03:58.590 --> 00:04:00.760
several security testing tools.

00:04:01.440 --> 00:04:06.180
First, let's clone the repository, and the repository that I'm going to use can

00:04:06.180 --> 00:04:11.660
be found on GitHub as well under PeterMosmans/tools‑image.

00:04:12.440 --> 00:04:15.640
Now let's go to the directory, and here I'm going

00:04:15.640 --> 00:04:17.940
to check out a specific version.

00:04:17.950 --> 00:04:18.860
Why?

00:04:18.870 --> 00:04:23.720
So, should you want to follow along, you can follow along and see the exact

00:04:23.720 --> 00:04:27.050
same results that you will see here during the course.

00:04:28.040 --> 00:04:34.400
I'm going to check out version 1.2.0. Perfect! So I cloned the

00:04:34.400 --> 00:04:39.900
repository, and I checked out version 1.2.0. I'm going to clear

00:04:39.900 --> 00:04:44.060
the screen. And if you look in this repository, you can see that

00:04:44.060 --> 00:04:45.760
it contains a Dockerfile.

00:04:46.140 --> 00:04:49.170
So next up, in order to test the local image, we're

00:04:49.170 --> 00:04:50.760
going to build a local image.

00:04:51.140 --> 00:04:55.460
So I'm going to execute the docker build command, and I'm going to build

00:04:55.460 --> 00:04:58.750
the current directory, and I'm going to give it a tag,

00:04:58.750 --> 00:05:00.710
let's say localimage.

00:05:00.720 --> 00:05:05.930
So this will build the Docker container, and it will tag it with

00:05:05.940 --> 00:05:10.450
localimage, and it builds the container. So far, so good.

00:05:11.240 --> 00:05:14.850
And after Docker has finished building my container image,

00:05:14.860 --> 00:05:18.860
I'd like to use Dockle to lint that container image.

00:05:20.040 --> 00:05:20.760
Ultimately,

00:05:20.770 --> 00:05:25.340
the goal of using Dockle is not only to build the best practice Docker images,

00:05:25.350 --> 00:05:28.460
but also to build more secure Docker images.

00:05:28.840 --> 00:05:30.550
That's why we're using Dockle here.

00:05:31.840 --> 00:05:36.740
Docker has finished building our container image. In order to scan

00:05:36.740 --> 00:05:39.660
it using Dockle, could we just pass in the tag?

00:05:41.040 --> 00:05:44.700
I'm going to clear the screen, and I'm going to execute the same

00:05:44.700 --> 00:05:48.440
command as we did before, running the Docker container, and then

00:05:48.440 --> 00:05:52.210
passing in the tag name that we just created. And the full name of

00:05:52.210 --> 00:05:55.260
the image was localimage:latest.

00:05:56.140 --> 00:05:57.360
Let's see what happens.

00:05:57.840 --> 00:06:00.650
Huh, apparently it cannot find the image.

00:06:00.780 --> 00:06:05.910
This is something you should know when using Dockle. In order for Dockle,

00:06:05.910 --> 00:06:11.060
when running it as a container to scan local images, you should give Dockle

00:06:11.060 --> 00:06:16.460
a bit more permissions, quite a bit more permissions. Specific, you need to

00:06:16.630 --> 00:06:23.130
map the /var/run/docker.sock volume, and this can introduce security risks.

00:06:23.130 --> 00:06:27.940
Still for demonstration purposes, let's try out whether we can actually scan

00:06:27.950 --> 00:06:28.960
the local image.

00:06:29.340 --> 00:06:33.150
So I'm going to repeat the previous command, but then specify

00:06:33.150 --> 00:06:35.650
the volume that I'm going to map for Dockle.

00:06:37.540 --> 00:06:41.950
So the difference between the one failing and the successful one is that we

00:06:41.960 --> 00:06:47.260
mapped /var/run/docker.sock file to the Dockle container.

00:06:47.940 --> 00:06:52.290
And if you do that, then Dockle, to be more specific the Dockle

00:06:52.290 --> 00:06:55.660
container, can scan locally‑built images.

00:06:56.240 --> 00:06:58.400
And here you can see the results of scanning this

00:06:58.400 --> 00:07:01.230
specific image. There is, however,

00:07:01.240 --> 00:07:04.360
an alternative method on scanning local images.

00:07:04.940 --> 00:07:09.760
This we shall see in a later demo. And in the final step of this demo,

00:07:09.770 --> 00:07:12.860
let's format the output to the JSON file format.

00:07:13.150 --> 00:07:16.140
I'm going to do that by running the previous command

00:07:16.150 --> 00:07:18.440
and then specifying the format flag.

00:07:18.940 --> 00:07:22.060
I can execute the previous command by pressing the arrow up.

00:07:23.040 --> 00:07:27.780
Let's remove the image name first, and then I'm going to add the ‑‑format

00:07:27.780 --> 00:07:33.560
parameter and then the specific format, which will be JSON. So now we're

00:07:33.560 --> 00:07:38.320
running the same scans we did over the local image, but now the results

00:07:38.370 --> 00:07:44.050
will be formatted into JSON. We haven't taken a look at the results, but

00:07:44.050 --> 00:07:48.670
hopefully, this will show you how easy it is to run Dockle, especially to

00:07:48.670 --> 00:07:53.590
run Dockle from a Docker container. In the next demo, we're going to

00:07:53.600 --> 00:07:58.040
integrate Dockle into a continuous integration environment and look a

00:07:58.040 --> 00:08:01.760
little more at the results, what they are and how you can fine tune them.