You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: website/docs/quick-start.md
+77-86Lines changed: 77 additions & 86 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,7 +2,7 @@
2
2
title: Quick Start
3
3
---
4
4
5
-
This sample illustrates how to patch containers using vulnerability reports with `copa`.
5
+
This guide illustrates how to patch outdated containers with `copa`.
6
6
7
7
## Prerequisites
8
8
@@ -12,32 +12,13 @@ This sample illustrates how to patch containers using vulnerability reports with
12
12
* The `docker` daemon runs a buildkit service in-process. If you are using this for your buildkit instance, Docker must have the [containerd image store feature](https://docs.docker.com/storage/containerd/) enabled.
13
13
* If you are using a buildx instance, or using buildkitd directly, there is no need to enable the containerd image store. However, only images in a remote registry can be patched using these methods.
14
14
*[docker](https://docs.docker.com/desktop/linux/install/#generic-installation-steps) daemon running and CLI installed & pathed.
* Alternatively, see [scanner plugins](#scanner-plugins) for custom scanner support.
17
18
18
19
## Sample Steps
19
-
Copa can patch images in two ways:
20
-
- Update only vulnerable packages as detected by a supported scanner report.
21
-
- Update all outdated packages in a container, regardless of vulnerability status.
22
20
23
-
:::note
24
-
The update all functionality allows you to address discrepancies that may arise between scanners and the packages they flag as vulnerable. It is important to note, however, that some upgrades can introduce dependency or compatibility conflicts.
25
-
:::
26
-
27
-
### Patch with scanner report:
28
-
1. Scan the container image for patchable OS vulnerabilities, outputting the results to a JSON file:
29
-
30
-
```bash
31
-
trivy image --vuln-type os --ignore-unfixed -f json -o nginx.1.21.6.json docker.io/library/nginx:1.21.6
32
-
```
33
-
34
-
You can also see the existing patchable vulnerabilities in table form on the shell with:
35
-
36
-
```bash
37
-
trivy image --vuln-type os --ignore-unfixed docker.io/library/nginx:1.21.6
38
-
```
39
-
40
-
2. To patch the image, use the Trivy report and specify a buildkit instance to connect to:
21
+
1. Before patching your image, specify a buildkit instance to connect to:
41
22
42
23
By default copa will attempt to auto-connect to an instance in order:
43
24
1. Default docker buildkit endpoint (requires at least docker v24.0 with [containerd image store](https://docs.docker.com/storage/containerd/#enable-containerd-image-store-on-docker-engine) support enabled)
@@ -46,38 +27,95 @@ The update all functionality allows you to address discrepancies that may arise
46
27
47
28
If an instance doesn't exist or that instance doesn't support all the features copa needs the next will be attempted. Please see [custom buildkit addresses](custom-address.md) for more information.
48
29
49
-
After setting up the buildkit instance, run the following command to patch the image:
50
-
51
-
```bash
52
-
copa patch -r nginx.1.21.6.json -i docker.io/library/nginx:1.21.6
53
-
```
54
-
55
-
If you want to patch an image using the digest, run the following command instead:
56
-
3.
30
+
2. Scan the container image to check for patchable OS vulnerabilities:
57
31
```bash
58
-
copa patch -r nginx.1.21.6.json -i docker.io/library/nginx:1.21.6@sha256:25dedae0aceb6b4fe5837a0acbacc6580453717f126a095aa05a3c6fcea14dd4
32
+
$ export IMAGE=docker.io/library/nginx:1.21.6
33
+
$ trivy image --vuln-type os --ignore-unfixed $IMAGE
Alternatively, you can chose to have a targeted patching of your image by providing an optional vulnerability report. In the following commands, we are only updating packages marked vulnerable by Trivy:
63
+
64
+
2.1. Scan the container image for patchable OS vulnerabilities, outputting the results to a JSON file:
2.2. Supply the Trivy report as an additional argument to the Copa command to patch image.
70
+
71
+
```bash
72
+
copa patch -r $(basename $IMAGE).json -i $IMAGE
73
+
```
74
+
75
+
In both cases by default, Copa will produce a tag with a `-patched` suffix and export a new image with the specified `1.21.6-patched` label to the local Docker daemon.
62
76
63
77
:::note
64
78
If you're running this sample against an image from a private registry instead,ensure that the credentials are configured in the default Docker config.json before running `copa patch`, for example, via `docker login -u <user> -p <password> <registry>`.
65
79
:::
66
80
67
81
:::note
68
-
If you're scanning and patching an image that is local-only (i.e. built or tagged locally but not pushed to a registry), `copa` is limited to using `docker`'s built-in buildkit service, and must use the [`containerd image store`](https://docs.docker.com/storage/containerd/) feature. This is because only `docker`'s built-in buildkit service has access to the docker image store (see [Prerequisites](#prerequisites) for more information.)
82
+
If you're patching an image that is local-only (i.e. built or tagged locally but not pushed to a registry), `copa` is limited to using `docker`'s built-in buildkit service, and must use the [`containerd image store`](https://docs.docker.com/storage/containerd/) feature. This is because only `docker`'s built-in buildkit service has access to the docker image store (see [Prerequisites](#prerequisites) for more information.)
69
83
:::
84
+
85
+
4. Scan the patched image again and verify that the vulnerabilities have been patched:
70
86
71
-
3. Scan the patched image and verify that the vulnerabilities have been patched:
87
+
```bash
88
+
$ trivy image --vuln-type os --ignore-unfixed $IMAGE-patched
0 commit comments