Improve readme

README.md

@@ -6,39 +6,39 @@
 
 ## Docker containers vulnerability scan
 
-When you work with containers (Docker) you are not only packaging your application but also part of the OS. Therefore it is crucial to know what kind of libraries might be vulnerable in you container. One way to find this information is to use and look at the Docker Hub or Quay.io security scan. The problem whit these scans is that they are only showing you the information but are not part of your CI/CD that actually blocks your container when it contains vulnerabilities.
+When you work with containers (Docker) you are not only packaging your application but also part of the OS. It is crucial to know what kind of libraries might be vulnerable in your container. One way to find this information is to look at the Docker registry [Hub or Quay.io] security scan. This means your vulnerable image is already on the Docker registry.
 
-What you want is:
+What you want is a scan as a part of CI/CD pipeline that stops the Docker image push on vulnerabilities:
 
 1. Build and test your application
 1. Build the container
 1. Test the container for vulnerabilities
-1. Check the vulnerabilities against allowed ones, if everything is allowed pass, otherwise fail
+1. Check the vulnerabilities against allowed ones, if everything is allowed then pass otherwise fail
 
-This straight forward process is not that easy to achieve when using the services like Docker Hub or Quay.io. This is because they work asynchronously which makes it harder to do straight forward CI/CD pipeline.
+This straightforward process is not that easy to achieve when using the services like Docker Hub or Quay.io. This is because they work asynchronously which makes it harder to do straightforward CI/CD pipeline.
 
 ## Clair to the rescue
 
-CoreOS has created an awesome container scan tool called "clair". Clair is also used by Quay.io. What clair does not have is a simple tool that scans your image and compares the vulnerabilities against a whitelist to see if they are approved or not.
+CoreOS has created an awesome container scan tool called Clair. Clair is also used by Quay.io. What clair does not have is a simple tool that scans your image and compares the vulnerabilities against a whitelist to see if they are approved or not.
 
-This is where clair-scanner comes in to place. The clair-scanner does the following:
+This is where clair-scanner comes into place. The clair-scanner does the following:
 
 * Scans an image against Clair server
 * Compares the vulnerabilities against a whitelist
-* Tells you if there are vurnabilities that are not in the whitelist and fails
+* Tells you if there are vulnerabilities that are not in the whitelist and fails
 * If everything is fine it completes correctly
 
 ## Clair server or standalone
 
-For the clair-scanner to work you need a clair server. It is not always convenient to have a dedicated clair server therefore I have created a way to run this standalone. See here <https://github.com/arminc/clair-local-scan>
+For the clair-scanner to work, you need a clair server. It is not always convenient to have a dedicated clair server, therefore, I have created a way to run this standalone. See here <https://github.com/arminc/clair-local-scan>
 
 ## Credits
 
-The clair-scanner is a copy of the Clair 'analyze-local-images' <https://github.com/coreos/analyze-local-images> with changes/improvments and addition that checks the vulnerabilities against a whitelist.
+The clair-scanner is a copy of the Clair 'analyze-local-images' <https://github.com/coreos/analyze-local-images> with changes/improvements and addition that checks the vulnerabilities against a whitelist.
 
 ## Build
 
-clair-scanner is build with Go 1.9 and uses `dep` as dependencies manager. Use the Makefile to build and install dependencies.
+clair-scanner is built with Go 1.9 and uses `dep` as dependencies manager. Use the Makefile to build and install dependencies.
 
 ```bash
 make ensure && make build
@@ -59,16 +59,53 @@ docker run -p 5432:5432 -d --name db arminc/clair-db:2017-09-18
 docker run -p 6060:6060 --link db:postgres -d --name clair arminc/clair-local-scan:v2.0.1
 ```
 
-Now scan a container, that has a whitelisted CVE:
+Now scan a container, that has a whitelisted CVE (this is on OSX with Docker for Mac):
 
 ```bash
-clair-scanner nginx:1.11.6-alpine example-nginx.yaml http://YOUR_LOCAL_IP:6060 YOUR_LOCAL_IP
+clair-scanner -w example-alpine.yaml --ip YOUR_LOCAL_IP alpine:3.5
 ```
 
-Or a container that does not have a whitelisted CVE:
+Output:
 
 ```bash
-clair-scanner nginx:1.11.6-alpine example-whitelist.yaml http://YOUR_LOCAL_IP:6060 YOUR_LOCAL_IP
+2017/09/24 11:20:24 [INFO] ▶ Start clair-scanner
+2017/09/24 11:20:24 [INFO] ▶ Server listening on port 9279
+2017/09/24 11:20:24 [INFO] ▶ Analyzing 693bdf455e7bf0952f8a4539f9f96aa70c489ca239a7dbed0afb481c87cbe131
+2017/09/24 11:20:24 [INFO] ▶ Image [alpine:3.5] not vulnerable
+```
+
+Or a container that does not have a whitelisted CVE (this is on OSX with Docker for Mac):
+
+```bash
+clair-scanner --ip YOUR_LOCAL_IP alpine:3.5
+```
+
+Output:
+
+```bash
+2017/09/24 11:16:41 [INFO] ▶ Start clair-scanner
+2017/09/24 11:16:41 [INFO] ▶ Server listening on port 9279
+2017/09/24 11:16:41 [INFO] ▶ Analyzing 693bdf455e7bf0952f8a4539f9f96aa70c489ca239a7dbed0afb481c87cbe131
+2017/09/24 11:16:41 [CRIT] ▶ Image contains unapproved vulnerabilities: [CVE-2016-9840 CVE-2016-9841 CVE-2016-9842 CVE-2016-9843]
+```
+
+## Help information
+
+```bash
+$ ./clair-scanner -h
+
+Usage: clair-scanner [OPTIONS] IMAGE
+
+Scan local Docker images for vulnerabilities with Clair
+
+Arguments:
+  IMAGE=""     Name of the Docker image to scan
+
+Options:
+  -w, --whitelist=""                    Path to the whitelist file
+  -c, --clair="http://127.0.0.1:6060"   Clair url
+  --ip="localhost"                      IP addres where clair-scanner is running on
+  -l, --log=""                          Log to a file
 ```
 
 ## Example whitelist yaml file
@@ -85,4 +122,8 @@ images:
     CVE-2017-5230: XSX
   alpine:
     CVE-2017-3261: SE
-```
+```
+
+## Release
+
+To make a release create a tag and push it

clair.go

@@ -13,7 +13,7 @@ func analyzeLayers(layerIds []string, clairURL string, scannerIP string) {
 	tmpPath := "http://" + scannerIP + ":" + httpPort
 
 	for i := 0; i < len(layerIds); i++ {
-		Logger.Info("Analyzing %s\n", layerIds[i])
+		Logger.Infof("Analyzing %s", layerIds[i])
 
 		if i > 0 {
 			analyzeLayer(clairURL, tmpPath+"/"+layerIds[i]+"/layer.tar", layerIds[i], layerIds[i-1])

example-alpine.yaml

@@ -0,0 +1,6 @@
+images:
+  alpine:
+    CVE-2016-9840: zlib
+    CVE-2016-9841: zlib
+    CVE-2016-9842: zlib
+    CVE-2016-9843: zlib

scanner.go

@@ -49,6 +49,7 @@ func scan(imageName string, whitelist vulnerabilitiesWhitelist, clairURL string,
 	if err = vulnerabilitiesApproved(imageName, vulnerabilities, whitelist); err != nil {
 		Logger.Fatalf("Image contains unapproved vulnerabilities: %s", err)
 	}
+	Logger.Infof("Image [%s] not vulnerable", imageName)
 }
 
 func vulnerabilitiesApproved(imageName string, vulnerabilities []vulnerabilityInfo, whitelist vulnerabilitiesWhitelist) error {