Scan host images running containerd

[DrissiReda]

I've read in the doc that if I'm running a docker container I can bind /var/run/docker.socket to the container, it'll detect host images. I've tried doing this with containerd instead of docker, I bound /var/run/containerd/ (the whole folder just to be sure) and it still cannot detect containerd's local images. I don't have docker on this machine and want to use trivy with containerd, is this possible?

[knqyf263]

Trivy doesn't support the socket of containerd as of today.

[github-actions]

This issue is stale because it has been labeled with inactivity.

[deuch]

Any plan to be compatible with containerd to check image on a host ? AKS in Azure fo to containerd with 1.19 version, so this compatibility will be a big plus !

[github-actions]

This issue is stale because it has been labeled with inactivity.

[kaz-33]

Hello all,
no progress in this topic?
Br

[survivant]

I which Trivy had containerd support for my cluster. Would had been useful to scan for CVE-2021-44228.

[mowangdk]

I would be happy to have some guidance to take this issue. @knqyf263

[knqyf263]

Trivy depends on fanal which is a core library communicating with container runtime. Inside of fanal, it calls the API provided by container runtime. You can find two examples.

• Docker Engine
  • https://github.com/aquasecurity/fanal/blob/1b333c8c39958b5687354c9808dc28d1d90190b6/image/daemon/docker.go#L14-L53
• Podman
  • https://github.com/aquasecurity/fanal/blob/1b333c8c39958b5687354c9808dc28d1d90190b6/image/daemon/podman.go#L73-L83

What the above examples do is calling API to export a container image. They are a bit different as we use github.com/docker/docker/client to talk with Docker Engine, while we directly call the socket of Podman without the Podman library for some reasons.

Once the image is exported, the format is basically the same regardless of container runtime since it is defined as OCI Image Spec.

So, what we have to do is

1. Search how the containerd API works
2. Check if we can use the library of containerd to call the API like Docker Engine
3. If it is not the case, we may need to call the socket directly like Podman
4. Create a function like func ContainerdImage(ref name.Reference) (Image, func(), error) {
5. Call it like this.

[knqyf263]

@mowangdk Please feel free to ask any questions!

[mowangdk]

ok, gotcha

[youwalther65]

See new issue https://github.com/aquasecurity/trivy/issues/2540