FlexDeploy can be configured to automatically build and scan Docker images as part of your build workflow. In cases where you are running your container directly on a docker runtime you can automatically configure that here as well.
...
As of FlexDeploy 6.0.0.0 the way Containers are configured has changed completely. There is no longer specific pages for Docker and Kubernetes configurations. Docker, Kubernetes and Helm plugins have now been updated to use project properties and plugin inputs putting them in line with other plugins. This makes configuration a bit less confusing, if you are already familiar with FlexDeploy concepts.
Additionally a container blueprint has been created to make the process even simpler. It is highly recommended you use the container blueprint. For more information on blueprints check out the blueprints page.
...
Optionally, a path to Dockerfile can be provided. If it is empty, a default Dockerfile in a project source checkout folder is expected. If the checkout folder is empty, then a Dockerfile is expected in the root of the FD_TEMP_DIR. A Dockerfile must be present to build an image. This behavior changed slightly in 5.0.3 beta. Previously, the location was expected to be in FD_TEMP_DIR/FD_PROJECT_NAME
| Info |
|---|
Anything previously configured in the Docker and Kubernetes tabs has been removed. If you’d like to reference your previous configuration please look inside of the <FlexDeployApplicationDirectory>/migration/6.0/container directory. |
Image Settings/Build
Everything under the Image Settings section will be used during the build workflow of your Project. If Build Image is checked then FlexDeploy will automatically add the dockerBuildProjectImage operation of the FlexDeployDockerPlugin at the end of your workflow.
| Info |
|---|
If you wish to change the location of the dockerBuildProjectImage step in your workflow, you can manually add the step anywhere you wish and FlexDeploy will no longer automatically add it at the end. |
At the end of the build, the workflow execution will store a reference to the built Docker Image which is available on the Artifacts tab of the workflow execution screen.
The build instance must be a Docker host to use this feature, and the dockerBuildProjectImage operation of the FlexDeployDockerPlugin must be associated to the build instance. See Creating and Editing Instances for more information on how to add a plugin operation to an Instance.
...
Setting
...
Input Type
...
Description
...
Example
...
Image Name
...
Groovy
...
A Groovy Script that evaluates to the local image tag that should be built. This should include the full registry prefix, user repository, image name and tag.
docker.io can be omitted as a registry prefix as that is the default.
...
"joelwenzel/natours:"+ProjectVersion
"comp.azureio.registry/ourcompany/app:"+ProjectVersion
...
Registry Account
...
Selection
...
Specify a Registry Account (created in Topology->Integrations→Containers) you would like to push your image to.
Note that this is optional and can be set in Topology Overview Properties as well.
...
DockerIO
...
Build Image
...
Boolean
...
Should FlexDeploy automatically add the buildProjectImage workflow step?
...
true
...
Push Image
...
Boolean
...
After building the image should it be pushed to the specified Registry?
...
true
...
Tag Latest
...
Boolean
...
Should the image also be tagged with 'latest'?
...
true
Image name (including repository) and image tag are now configurable as project properties. Several new variables have also become available with project properties, including the stream name, stream attributes, and project version. Most of the functionality previously available should be achievable with these additions. See the Docker plugin guide for details.
Image Scanning
FlexDeploy supports local image scanning out of the box with the Anchore plugin. The only requirement is docker being installed on your build server. The configuration here will always scan the locally built Docker image. If you want to analyze a remote image or publish results to an Anchore Engine application, you will need to modify your workflow with the appropriate Anchore Operations.
...
Setting
...
Input Type
...
Description
...
Example
...
Scan Image
...
Selection
...
No Scan - No scan will take place
Before Push - The built image will be scanned prior to pushing it to a registry
After Push - The built image will be scanned after pushing it to a registry. Note that if Push Image is false, then it will be scanned regardless.
...
BEFORE_PUSH
...
Fail When
...
Groovy
...
. See the Anchore
...
If the script should evaluate to true (I.E. a failure) then the image building process will halt and the workflow execution will fail.
...
STATUS == "fail"
...
Custom Policy Bundle
...
Plain Text
...
Anchore uses "policy bundles" to define analysis/scanning criteria. You can provide a custom bundle here defining your own scanning requirements.
You can reference an absolute path on your docker build server or a relative location in your source control for the image.
...
plugin guide for configuration details.
| Info |
|---|
Windows ScanningAt this time, inline(local) image scanning is not supported on windows. |
| Info |
|---|
Pre-deploy Scanning |
...
Scans can also be executed as a Pre-deploy Workflow. This has the added benefit of creating approval tasks from the scan results. |
Container Settings/Deploy
...