fix(scan): drop hard docker.sock dependency for container-mode scans - #59
Draft
Vickydew1 wants to merge 7 commits into
Draft
fix(scan): drop hard docker.sock dependency for container-mode scans#59Vickydew1 wants to merge 7 commits into
Vickydew1 wants to merge 7 commits into
Conversation
Enforce --max-target-bytes 5000000 in the SAST scan args unless the caller already supplies their own --max-target-bytes.
Every scan type (sast, iac, dast, container, secret, ml-scan, sq-sast, api-discovery, trivy) hardcoded "docker" as the container-run binary, so container-mode fails on containerd-only nodes (EKS/k3s) with no dockerd: "failed to connect to the docker API at unix:///var/run/docker.sock". Add aspm_cli/utils/container_runtime.get_container_runtime(), which resolves docker/nerdctl/podman by actual usability (docker/nerdctl only count if their daemon responds; podman is daemonless) rather than mere PATH presence -- so bundling the docker CLI without a daemon behind it no longer wins by default. All hardcoded "docker" call sites now route through it, overridable via ACCUKNOX_CONTAINER_RUNTIME. Dockerfile now also installs podman (vfs storage driver, permissive signature policy) alongside the existing docker CLI, so container-mode works out of the box in a Kubernetes pod without docker.sock, DinD, or --privileged.
Resolves conflicts between our container-runtime resolution (get_container_runtime: docker/nerdctl/podman by usability) and main's cross-platform docker_runtime helpers (build_docker_run_prefix: Windows path handling, conditional docker.sock mount for trivy image scans). Kept main's build_docker_run_prefix as the single command-building choke point for all 9 scan types, and wired get_container_runtime() into it so both fixes apply together: correct Windows/macOS behavior plus automatic fallback to podman when no docker daemon is reachable (EKS/k3s).
Vickydew1
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Container-mode scans hardcoded "docker" as the runtime binary across every scan type (sast, iac, dast, container, secret, ml-scan, sq-sast, api-discovery, trivy). On containerd-only nodes (EKS/k3s, no dockerd) this fails:
failed to connect to the docker API at unix:///var/run/docker.sock.Changes
aspm_cli/utils/container_runtime.get_container_runtime(): resolves docker/nerdctl/podman by actual usability (docker/nerdctl only count if their daemon responds; podman is daemonless), overridable viaACCUKNOX_CONTAINER_RUNTIME.aspm_cli/utils/docker_runtime.build_docker_run_prefix()(the shared command-builder used by all 9 scan types) andaspm_cli/utils/docker_pull.py, so a scanner image that merely bundles the docker CLI with no daemon behind it no longer wins by default.Dockerfile: installs podman (vfs storage driver, permissive signature policy) alongside the existing docker CLI, so container-mode works out of the box in a Kubernetes pod without docker.sock, DinD, or--privileged.tests/test_container_runtime.py: 11 tests covering resolution priority, env override, and the daemon-unreachable fallback (reproduces the exact EKS failure).Known limitation
Trivy's
image/container/rootfssubcommands still need a reto inspect images — that's an inherent trivy capabilityrequirement, not something the runtime resolver can work around. Filesystem/SCA scans and SAST/IaC/secrets are unaffected.CLI syntax unchanged: `accuknox-aspm-scanner scan sast --command