Scan OS packages manually
This quickstart shows you how to pull a container image, manually scan it for operating system vulnerabilities with the On-Demand Scanning API, and retrieve identified vulnerabilities. To follow this quickstart you will use Cloud Shell and an example Ubuntu image.
Before you begin
- Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Enable the On-Demand Scanning API.
-
In the Google Cloud console, on the project selector page, select or create a Google Cloud project.
-
Make sure that billing is enabled for your Google Cloud project.
-
Enable the On-Demand Scanning API.
Download and scan an image
Open a Cloud Shell in your project.
This opens a terminal with all the required tools to follow this guide.
Use docker to pull the latest Ubuntu image.
docker pull ubuntu:latest
Run the scan.
gcloud artifacts docker images scan ubuntu:latest
This triggers that scanning process and returns the scan name when finished:
✓ Scanning container image ✓ Locally extracting packages and versions from local container image ✓ Remotely initiating analysis of packages and versions ✓ Waiting for analysis operation to complete [projects/my-project/locations/us/operations/1a6fd941-b997-4e5f-ba4f-6351f30e7dad] Done. done: true metadata: '@type': type.googleapis.com/google.cloud.ondemandscanning.v1.AnalyzePackagesMetadata createTime: '2021-01-26T13:43:53.112123Z' resourceUri: ubuntu:latest name: projects/my-project/locations/us/operations/1a6fd941-b99f-4eaf-ba4f-6e5af30e7dad response: '@type': type.googleapis.com/google.cloud.ondemandscanning.v1.AnalyzePackagesResponse scan: projects/my-project/locations/us/scans/893c91ce-7fe6-4f1a-a69a-d6ca1b465160
Use the scan name, the value of
scan
from the output, to fetch the scan results.gcloud artifacts docker images list-vulnerabilities \ projects/my-project/locations/us/scans/893c91ce-7fe6-4f1a-a69a-d6ca1b465160
Clean up
To avoid incurring charges to your Google Cloud account for the resources used on this page, follow these steps.
If you created a new project for this guide, you can now delete the project.