The Anchore Plugin offers several operations to enhance container scanning in your devops pipeline. Anchore is specifically targeted at image scanning, unlike some of the other tools such as Docker Bench Security, which make it a perfect match to your image building CI process.

For those inexperienced with Anchore, the scanLocalImage operation is just where to start. This operation doesn't require any prerequisites other than having docker installed. For those looking scan and publish results to an existing Anchore Engine installation, analyzeLocalImage and analyzeImage are what you are looking for.

This plugin uses Anchore CI Tools to perform local scanning. Anchore requires images to be pushed to a registry prior to analyzing. The Anchore CI Tools get around this by starting a temporary local Anchore container with a 'localbuild' registry. This allows you to scan and analyze images directly after building on your local docker engine.

Supported Versions

Key Features

Outputs and Groovy Condition

Each operation in this plugin supplies the option to configure a Groovy script to determine if the scan results are inacceptable and should fail the operation. Below is a list of variables available to the Groovy script.

Each of these variables is also available as a plugin output

Groovy VariablePlugin OutputDescriptionExample
STATUSFDANCR_OUT_STATUSOverall status of the scan/analysis. This is ultimately determined by the policy bundle that is used. Possible values are pass or
FINAL_ACTIONFDANCR_OUT_FINAL_ACTIONSimilar to the status, this provides the recommended action for the image.stop
STOP_COUNTFDANCR_OUT_STOP_COUNTAn integer count of the number of STOP rules detected for the image2
WARN_COUNTFDANCR_OUT_WARN_COUNTAn integer count of the number of WARN rules detected for the image10
ALL_COUNTSFDANCR_OUT_ALL_COUNT_LISTA full list of all counts returned[STOP:2, WARN:10, GO:37]

All other FlexDeploy Variables are also available in the Groovy Script Condition

Example Groovy Script Conditions

Project Configuration

Anchore is FlexDeploy's preferred choice when it comes to container scanning. As such, you can configure your project to scan the specified image without any configuration other than setting the below properties:

For more information on the properties outlined above and all of the Project Container Configuration see here.

Plugin Operations