- [Instructor] With Docker images being pushed and pulled
all over the place, could be up to the public internet,
across large enterprises,
it's important to ensure that images that are being used
in a production environment are secure.
So how do you ensure that images pass security scans?
That's what we're going to talk about in this video.
Before we do, I wanna point out that in the past,
Docker Hub included a beta feature for security scanning.
At this point that is no longer available,
and so the only way to perform security scans with Docker,
is to use Docker's Enterprise Edition,
with Docker Trusted Registry.
So let's jump over into DTR
and I'd like to demonstrate for you exactly how this works.
Here in Docker Trusted Registry,
to configure security scanning, you go into System,
and then over to the Security tab.
And it's very easy here to enable scanning.
In fact I've already done it because,
I'll tell you this actually takes
a little while to enable.
It has to download roughly a 300 megabyte CVE database
from the internet and it takes a little while to do it
and it takes a little while to enable scanning
once it's been downloaded.
So the first time I did this I thought something was wrong,
it was broken.
I disabled it, I re-enabled it.
Anyhow what you should know
is that it could take a little while
and that I've already done it for you here,
simply by moving this slider.
And I've chosen to use the online,
automatically synchronizing vulnerability database option
because that's going to be the most secure.
With the offline option you have to download this file
and then import it
into Docker Trusted Registry periodically.
So as you might guess,
it's not always going to be up to date.
Now once image scanning is enabled here,
it doesn't just automatically happen with every image.
What you then need to do is to go over
into your Repositories and when you create a repository,
or if you have existing repositories,
you need to go into Settings for that repository,
and then scroll down and right here it says image scanning,
check for vulnerabilities in your images.
And the default here is manual,
so image scans must be manually initiated.
But if you want those to be automatic
whenever someone pushes up an image
to Docker Trusted Registry,
you need to click here to enable on push,
which means anytime an image is pushed to this registry,
it's automatically scanned.
And that's something I've already enabled as well.
So if we go back into the Repository here,
and look at the images.
You can see that we have one image, it's a 44 megabyte,
this is an Nginx web server image that I pushed up,
and it took a little while to scan which is why again,
I've done this ahead of time so we don't have to wait.
Once the image is pushed up,
it sits here and it scans for vulnerabilities
for quite some time.
Once the image is pushed up it sits here
for quite some time, scanning for vulnerabilities,
and you can see just with this
standard Nginx web server image that I downloaded,
very recently, there are already one critical vulnerability,
11 major vulnerabilities and one minor vulnerability.
If we go in to view the details,
you can see it says,
all layers are already scanned.
And right here it lists out which components
have the vulnerabilities.
For example glibc has the critical vulnerability.
If we click on that it gives us more detail here,
and it says,
in glibc 2.26 and earlier,
there is confusion in the usage of something,
getcwd by realpath,
which can be used to write blah blah blah.
The point being here,
not that we're gonna get into vulnerabilities exactly,
the point being here
is that there's a critical problem with this,
and I don't understand this exact description,
you probably don't, but what we need to understand,
is that there's a critical vulnerability
and we need to do something about it.
We can click here to get more detail on the exact CVE
and we can read more about it if we'd like to do that,
but in most cases what you're just going to wanna do
is to download the latest image for, in this case,
it's the Nginx web server.
And that way you get an update.
You update your images to ensure that you're
not using images that have vulnerabilities.
So that's how easy it is to enable security scanning
in Docker Trusted Registry.
Simply move the slider right here to enable scanning,
most likely use the online option,
and then enable scanning over in your Repository,
so that images are automatically scanned
when they're pushed up to the registry.