paclair 3.2.1

Example

An example configuration file is available in the conf directory

General:
  clair_url: 'https://localhost:6060'
  # clair_api_version: 3
  # Whitelist known CVE's not to shown in html report
  # cve_whitelist:
  #   - CVE-2016-9843
  #   - CVE-2016-9840
  #   - CVE-2016-6313
Plugins:
  Docker:
    class: paclair.plugins.docker_plugin.DockerPlugin
    registries:
      artifactory.registry.com:
        token_url: "https://artifactory.registry.com/api/docker/{image.repository}/v2/token?service=artifactory.registry.com"
        protocol: 'http'
        api_prefix: '/api/docker/{image.repository}'
      registry.gitlab.domain.com:
        auth:
          - "*****"
          - "*****"
      # Example for a private gitlab server
      gitlab.example.com:4567:
        # If using https with an internal CA, ensure verify is pointing to it
        protocol: 'https'
        verify: "/etc/ssl/certs/ca-certificates.crt"
        auth:
          - "*****"
          - "*****"
      # Example for ECR Docker Repository
      xxxxxxxxxxxxxxxx.dkr.ecr.eu-west-1.amazonaws.com:
        token: "" # Execute this command to get token aws ecr get-authorization-token --output text --query 'authorizationData[].authorizationToken'
        protocol: 'https'
        token_type: Basic

Plugins are dynamically loaded during execution. That’s why you have to specify the class of the plugins you want to use.

We have various plugins to interact with different sources (ex: docker registry, Elasticsearch) because we use a custom variant of Clair which can analyse more than Docker images.

If you want to use Paclair only to analyse docker images, don’t bother with others plugins.

Options

Analyse command usage

usage: paclair plugin hosts [hosts ...] analyse [-h]
                                            [--output-format {stats,html}]
                                            [--output-report {file,term}]
                                            [--output-dir OUTPUT_DIR]
                                            [--delete]

optional arguments:
  -h, --help            show this help message and exit
  --output-format {stats,html}
                        Change default output format (default: json)
  --output-report {file,term}
                        Change report location (default: logger)
  --output-dir OUTPUT_DIR
                        Change output directory (default: current)
  --delete              Delete after analyse

Examples

Push ubuntu image to Clair

$ paclair --conf conf/conf.yml Docker ubuntu push
Pushed ubuntu to Clair.

Analyse ubuntu image (stats only show fixable CVE)

$ paclair --conf conf/conf.yml Docker ubuntu analyse --output-format stats
Medium: 3

You can have the full json if you don’t specify –output-format stats.

Analyse ubuntu image and get a html report in directory /tmp

$ paclair --conf conf/conf.yml Docker ubuntu analyse --output-format html --output-dir /tmp

Delete ubuntu image

$ paclair --conf conf/conf.yml Docker ubuntu delete
ubuntu was deleted from Clair.