Add fully support for Alpine based containers

[laurrentt]

Many Docker projects are now using Alpine as base for their containers (Deis for example). Just last month the Alpine repo had on the Docker hub.

[Quentin-M]

Hello,

Sure. There are two main steps to support that operating system:

• The proper detectors (operating system's name/version + packages) have to be implemented in worker/detectors. That would be straight-forward to do.
• A vulnerability fetcher has to be implemented if we want Clair to auto-discover and update vulnerabilities that affect Alpine.

As far as I know, there is no great trusted vulnerability source for it (only thing I found is that). Detection would be supported but vulnerability would probably have to be inserted manually.

Any contributions are much appreciated.

[jzelinskie]

If you'd like this feature in Clair, you should rally upstream for the Alpine Linux package maintainers to curate a database of vulnerabilities. Grepping their git log would be able to extract some information, but that isn't an ideal data source.

[stepanstipl]

+1 yep, having this for Alpine would be great. I've came across this on the wiki, although not sure how useful or not it might be in this case - http://wiki.alpinelinux.org/wiki/Cvechecker.

[philips]

@stepanstipl @laurrentt Any interest in taking up the torch and trying to build this alpine checker for clair? I know @jzelinskie and @Quentin-M would happily jump on a video call or chat to give you a rundown of what is necessary.

[lian]

👍 on getting support in

[jeremyd]

👍

[stepanstipl]

@philips I would be happy to have some initial chat to get at least a rough idea what this would involve, in general I would be happy and interested to work on this feature, just not sure whether I can dedicate enough time

[philips]

@stepanstipl I talked to @Quentin-M and I think there are two sides

1. Adding support to analyze alpine

2. Pushing on Alpine to track and publish CVE data; this needs to happen with the alpine upstream community and @Quentin-M is going to ping them tomorrow.

[Quentin-M]

Just initiated a discussion on the alpine-devel mailing-list. Feel free to participate to share your thoughts and backup the request.

[borzamircea]

+1

[Quentin-M]

Please say +1 on the mailing-list thread linked above. There's little we can do until Alpine decides to maintain a proper vulnerability database.

[andyshinn]

Would we care if the database was actually maintained by the Alpine Linux organization or could it be a 3rd party database?

When I originally saw this issue I envisioned something like a GitHub project that housed a mapping of CVE to Alpine packages that could be maintained by users through pull requests (and initially seeded http://wiki.alpinelinux.org/wiki/Cvechecker). New CVE would be pull requests. Then the fetcher for Alpine would pull the git repository and parse the CVE mapping format (TBD).

Plausible?

[mattlorimor]

Then the fetcher for Alpine would pull the git repository and parse the CVE mapping format (TBD).

I think this method would be a strain (and misuse) of GitHub/GitHub's API if all the Clair servers in the wild have to go to GitHub for the CVE information. Would it not?

[dsampath]

+1

[JonathanRosado]

+1

[sylus]

This would be a pretty big win for container security in alpine. ^_^

[Quentin-M]

@andyshinn That's a plausible solution, however, this is definitely not the greatest solution nor the one we aim for. I believe that security and thorough vulnerability tracking shall be treated as a first-class citizen and handled as close as possible to the source. Therefore, it should be handled upstream, by both the maintainers, the developers and the community. Additionally, Alpine already has an active Redmine tracking security issues, only not in a machine-readable manner. As a side note, Ubuntu tracks CVEs using bzr (https://code.launchpad.net/~ubuntu-security/ubuntu-cve-tracker/master).

[paulmcgoldrick]

+1

[philips]

@paulmcgoldrick @sylus @JonathanRosado @dsampath @borzamircea @jeremyd @stepanstipl @lian All of the +1's on this issue to add Alpine support to Clair are great but it would be better if you lobbied upstream on the alpine-dev mailing list and could pitch in helping them figure out how the Alpine project is going to solve this: http://lists.alpinelinux.org/alpine-devel/5228.html

[philips]

Anyone want to take a swing at "fuzzy" alpine support for Clair: #187?

[rqc]

@philips we are working towards this. It would be great to get your feedback. Thanks!

[Quentin-M]

Referencing #187 (comment).

[jzelinskie]

Closing this since I think #272 is the closest we're going to get.