Question : Why aren´t the images recorded in anchore engine

[ThinkBriK]

Hi !

I was looking for a way to add images to Anchore engine (as I can do manually with anchore cli image add) on Harbor scans. The idea behind it is to discover images in the registry dynamically and be able to be notified when new CVE are detected.

If I read well, so far, Anchore engine is used in a one-shot fashion ?

[zhill]

Hi @ThinkBriK ! Thanks for the question. The adapter will request an analysis/scan from Anchore on each "scan job" initiated by Harbor. Harbor itself configures and executes the scan jobs, and that can be setup to scan each new image when it is pushed to Harbor (https://goharbor.io/docs/2.2.0/administration/vulnerability-scanning/). I think it is so you should be able to get the behavior you are describing unless I misunderstood your request.

Once Anchore has analyzed the image, it will retain the SBoM and other analysis artifacts and automatically update for new vulnerabilities inside Anchore as it syncs the vuln feeds down from the sources, so you can get update notifications from Anchore itself outside of the Harbor scan process as well. Harbor will only see the updated result on its next scan job where it will query Anchore for a new result to pull into its UI. But, if Anchore has seen the image before it does not need to re-download the image content and will simply provide an updated vuln scan report.

There may also be a non-adapter approach that may work for your use-case:
Anchore also has the ability to "watch" are repository in a registry for new tags and images and automatically scan them, even outside of this specific Harbor integration. The value this integration gives is that the scan results are viewable in the Harbor UI itself next to the image, and that those results can be used to block external pulls on an image based on the vulnerability status of the image.

[ThinkBriK]

Hi @zhill , it seems I may have encountered a DB issue that would have prevented the recording of the image in Anchore : if I use the anchore-cli tool, I can see the images when using GET on /images but I don't get to see images that were scanned through the harbor adapter.

I'll reinstall to try it out again.

The endgame would be to be able to block downloads and have anchore cli / API to check actual scan results.

Another question : is the malware scan automatically done too (using clamav) if anchore is configured to use it ?