7.10. Scanning container and container images for vulnerabilities
Use this procedure to find security vulnerabilities in a container or a container image.
Conditions préalables
-
The
openscap-utilsandbzip2packages are installed.
Procédure
Download the latest RHSA OVAL definitions for your system:
# wget -O - https://www.redhat.com/security/data/oval/v2/RHEL9/rhel-9.oval.xml.bz2 | bzip2 --decompress > rhel-9.oval.xmlGet the ID of a container or a container image, for example:
# podman images REPOSITORY TAG IMAGE ID CREATED SIZE registry.access.redhat.com/ubi9/ubi latest 096cae65a207 7 weeks ago 239 MBScan the container or the container image for vulnerabilities and save results to the vulnerability.html file:
# oscap-podman 096cae65a207 oval eval --report vulnerability.html rhel-9.oval.xmlNote that the
oscap-podmancommand requires root privileges, and the ID of a container is the first argument.
Vérification
Check the results in a browser of your choice, for example:
$ firefox vulnerability.html &
Ressources supplémentaires
-
For more information, see the
oscap-podman(8)andoscap(8)man pages.
