Basic Pipeline using Snyk Container, OCI Images, Azure DevOps all part of Cloud Native Application Security

Snyk Container will find vulnerabilities in containers and Kubernetes workloads throughout the SDLC by scanning any compliant OCI image which includes those created by Cloud Native Buildpacks or other build tools that create OCI images.

So what could an Azure DevOps Pipeline look like that incorporates the following using Snyk?

Running a Snyk Scan against the project repository

Here we run a "snyk test" from the root folder of the repository itself and that report is then

Building your Artifact

Here we use a Maven task which packages the application Artifact as a JAR file ready to run

Creating an OCI compliant container image from the Artifact itself

There are various ways to create a OCI compliant image but by the far the simplest is using Cloud Native Buildpacks and for this we use the pack CLI which in turns using the Java Buildpack from our JAR file directly avoid a compilation step from the source code given we already did that on the step above.

Running a Snyk Scan against the container image directly on the Container Registry

With our container image now in our Container Registry we can use "snyk container" to check for issues directly from the registry and also check for application security issues from the open source dependancies as well.

The finished Pipeline ...

azure-pipeline.yml Pipeline used in Azure DevOps

# Starter pipeline

# Start with a minimal pipeline that you can customize to build and deploy your code.

# Add steps that build, run tests, deploy, and more:

# https://aka.ms/yaml

trigger:

- master

pool:

vmImage: ubuntu-latest

steps:

- task: Maven@3

inputs:

mavenPomFile: 'pom.xml'

mavenOptions: '-Xmx3072m'

javaHomeOption: 'JDKVersion'

jdkVersionOption: '1.11'

jdkArchitectureOption: 'x64'

publishJUnitResults: true

options: "-Dskiptests -Dsnyk.skip"

goals: 'package'

displayName: "Build artifact JAR"

- task: SnykSecurityScan@0

inputs:

serviceConnectionEndpoint: 'snyk-token'

testType: 'app'

monitorOnBuild: false

failOnIssues: false

displayName: "snyk test from source"

- task: Docker@2

inputs:

containerRegistry: 'docker-pasapples-connection'

command: 'login'

displayName: "Login to DockerHub"

- script: |

curl -sSL "https://github.com/buildpacks/pack/releases/download/v0.19.0/pack-v0.19.0-linux.tgz" | tar -C ./ --no-same-owner -xzv pack

./pack build pasapples/springbootemployee:cnb-paketo-base --builder paketobuildpacks/builder:base --publish --path ./target/springbootemployee-0.0.1-SNAPSHOT.jar

displayName: 'Build Container with Pack'

- task: SnykSecurityScan@0

inputs:

serviceConnectionEndpoint: 'snyk-token'

testType: 'container'

dockerImageName: 'pasapples/springbootemployee:cnb-paketo-base'

severityThreshold: 'low'

monitorOnBuild: false

failOnIssues: false

additionalArguments: "--app-vulns"

displayName: "snyk container scan from image"

More Information

So, for Container and Kubernetes security, designed to help developers find and fix vulnerabilities in cloud native applications, click the links below to learn more and get started today.

Snyk Container

Snyk Platform