Obtenha o DevSecOps com o Bitbucket Pipelines e o Snyk Pipe

This tutorial outlines how to secure your build workflow on Bitbucket Pipelines with Snyk. An important step in securing your environment is to scan and analyze both your application and Linux-based container project for known vulnerabilities, which helps you identify and mitigate security vulnerabilities. The exercises in this tutorial will help secure your application and container by leveraging the Snyk Pipe for Bitbucket Pipelines to scan the application manifest file and the container base image for its dependencies.

The tutorial, How Snyk and Bitbucket Cloud enable DevSecOps, focused on application dependencies. However, by also scanning your container base image you can detect:

• The operating system (OS) packages installed and managed by the package manager
• Key binaries —layers that were not installed through the package manager

Based on these results, Snyk provides advice and guidance, including:

• Origins of the vulnerabilities in OS packages and key binaries
• Base image upgrade details or a recommendation to rebuild the image
• Dockerfile layer where the affected package was introduced
• Fixed-in version of the operating system and key binary packages

This example leverages the Snyk Scan pipe in the pipeline to perform a scan of the application. The source contains a complete, YAML definition of all supported variables, but only those included in this snippet are necessary for this purpose.

Here’s a closer look at a few of these:

1. SNYK_TOKEN is passed into the pipe as a repository variable previously defined in the [Bitbucket Configuration] module.

2. PROJECT_FOLDER is the folder where the project resides and normally defaults to. However, in this example, we set this to app/goof and pass this as an artifact to other steps in ther pipeline.

3. CODE_INSIGHTS_RESULTS defaults to false. However, since we want to create a Code Insight report with Snyk test results, set this to true.

4. SEVERITY_THRESHOLD reports on issues equal or higher to the provided level. The default is low. But in this case, we are interested only in high, so we defined this variable accordingly.

5. The DONT_BREAK_BUILD default is false, which is expected. Under normal circumstances, you would want to break the build if issues are found. However, for the purpose of this learning exercise, set this to true.

Até 2022, mais de 75% das empresas globais vão executar aplicativos em contêineres em produção (Gartner). Junto com a adoção generalizada, houve um aumento nas vulnerabilidades de contêineres, com um crescimento quatro vezes maior nas vulnerabilidades relatadas pelo sistema operacional em 2018. E, no entanto, 80% dos desenvolvedores dizem que não testam as imagens de contêiner durante o desenvolvimento. Segundo eles, esse ponto não faz parte das responsabilidades deles ou estão acostumados a repassar esses itens a alguém no futuro, o que torna o dimensionamento da segurança de contêineres um desafio para empresas em rápido crescimento.

O que cria a imagem do contêiner e a marca e, em seguida, aproveitando o pipe do Snyk Scan no pipeline para realizar uma verificação da imagem do contêiner. Mantenha os mesmos valores para CODE_INSIGHTS_RESULTS, SEVERITY_THRESHOLD e DONT_BREAK_BUILD. Também passa algumas variáveis adicionais compatíveis relevantes ao Snyk Pipe para entender a solicitação de uma verificação de imagem de contêiner em vez de uma verificação de aplicativo. Essa ação significa definir a configuração LANGUAGE para docker, declarar o IMAGE_NAME e passar a variável de repositório adequado, bem como definir o TARGET_FILE para Dockerfile.

O pipeline agora verifica a imagem do contêiner em busca de vulnerabilidades conhecidas, bem como o código do aplicativo.

Veja mais integrações para o Atlassian Open DevOps