Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

docs: add note about disabled DS016 check #7724

Merged
merged 2 commits into from
Oct 16, 2024

Conversation

nikpivkin
Copy link
Contributor

@nikpivkin nikpivkin commented Oct 14, 2024

Description

./trivy image --scanners misconfig --image-config-scanners misconfig registry.access.redhat.com/ubi8/python-312:1-16.1721725207
2024-10-14T14:57:39+06:00       INFO    [image] Container image config scanners scanners=[misconfig]
2024-10-14T14:57:39+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2024-10-14T14:57:41+06:00       INFO    Check disabled  ID="DS016" scanner="history-dockerfile" reason="See https://github.com/aquasecurity/trivy/issues/7368"
...

Related PRs:

Checklist

  • I've read the guidelines for contributing to this repository.
  • I've followed the conventions in the PR title.
  • I've added tests that prove my fix is effective or that my feature works.
  • I've updated the documentation with the relevant information (if needed).
  • I've added usage information (if the PR introduces new options)
  • I've included a "before" and "after" example to the description (if the PR is a user interface change).

Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io>
@nikpivkin nikpivkin marked this pull request as ready for review October 14, 2024 09:34
@knqyf263
Copy link
Collaborator

Can we add a prefix as below?

2024-10-14T14:57:41+06:00       INFO    [misconfig] Check disabled  ID="DS016" scanner="history-dockerfile" reason="See https://github.com/aquasecurity/trivy/issues/7368"

Signed-off-by: nikpivkin <nikita.pivkin@smartforce.io>
@@ -154,6 +154,8 @@ See https://avd.aquasec.com/misconfig/ds026
!!! tip
You can see how each layer is created with `docker history`.

The [AVD-DS-0016](https://avd.aquasec.com/misconfig/dockerfile/general/avd-ds-0016/) check is disabled for this scan type, see [issue](https://github.com/aquasecurity/trivy/issues/7368) for details.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This text looks nondescript. I assume users will simply skip this information.
Maybe we want to highlight it in a note/warning or make a table with rules disabled?
@knqyf263 wdyt?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Making a table sounds like a good idea, but I'm not sure we'll add more disabled checks. A table might be too much just for a single check.
I think it's enough as we're showing the logs, but using tables or bullet points would also be good. I'll leave it to you two.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's fine as is. We can revisit it if we have more disabled checks in the future.

@simar7 simar7 self-requested a review October 16, 2024 02:01
@knqyf263 knqyf263 added this pull request to the merge queue Oct 16, 2024
Merged via the queue into aquasecurity:main with commit 83e5b83 Oct 16, 2024
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants