Hacktoberfest 2026：维护者为十月标记出来的 issue，仍然开放、适合新手。 浏览 Hacktoberfest issue

Trivy image scan on private ACR

未关闭
  • 哪里不对？
#98 1 条评论 2 个 reaction 已指派 0 人 在 GitHub 查看

还没有人认领这个 Issue。

评估

难度
3/5
预计耗时
1-2 天
新手友好度
35/100
Issue 类型
文档
描述清晰度
基本清楚
活跃度
停滞
技术栈
azure, docker
领域
cloud, documentation, security

调研方向

检查链接的 Trivy 环境变量文档以及 issue 中展示的 MicrosoftSecurityDevOps@1 配置，然后将其与可正常工作的 Bash@3 示例和报告的扫描器错误进行比较。完成的标准是：私有 ACR 场景、所需的环境变量以及任何任务支持限制都已得到清晰记录。

由索引模型根据 Issue 内容生成。

描述

Description
The current documentation for the MicrosoftSecurityDevOps@1 task does not include instructions on how to perform Trivy image scans on private Azure Container Registries (ACR). This functionality is crucial, as not all users build their images on VMs with Docker; many utilize containerized agents alongside the ACR build task for image creation. Despite Trivy's documented ability to scan remote/private container registries, the MicrosoftSecurityDevOps@1 task appears to only support scanning local image locations. This discrepancy has left me unable to configure the task to target a remote repository, even though I have successfully set up remote registry scanning using Trivy in a standalone configuration.

Problem Statement
Lack of documentation and apparent functionality for scanning images in private ACRs using the MicrosoftSecurityDevOps@1 task.
The task defaults to scanning local image locations, ignoring the capability of Trivy to scan remote/private container registries.

Importance
This issue is significant for workflows that rely on containerized agents and ACR build tasks for image creation, as it limits the usability of the MicrosoftSecurityDevOps@1 task for security scanning in such environments. Enabling this functionality would greatly enhance security measures for Azure DevOps pipelines that utilize private ACRs.

Expected Behavior:

Environement variable documentation should be more descriptive and informational on how to use it, because it is not clear what Envs to use to target a remote ACR.

- task: MicrosoftSecurityDevOps@1
  displayName: 'Microsoft Security DevOps'
  inputs:
    command: 'run'
    policy: 'microsoft'
    tools: 'trivy'
  env:
    TRIVY_ACTION: 'image'
    TRIVY_TARGET: 'image
    TRIVY_AUTH_URL: 
    TRIVY_USERNAME:
    TRIVY_PASSWORD:
    TRIVY_IMAGE_SRC:
    TRIVY_REGISTRY_TOKEN:
    TRIVY_INPUT: 
    TRIVY_IMAGEPATH:

I've tried just about every mix of environment variables, even switching between uppercase and lowercase, to get remote scanning to work, but the documentation doesn't really help make sense of how to use Trivy's environment variables with this task. It looks like the task actually does support Trivy's own environment variables, which was a surprise since it's not mentioned anywhere in the docs. This makes setting everything up for remote scanning a bit of a guessing game.

The error encountered suggests a failure to recognize the remote image location, indicating an issue with how the task is configured to interact with private container registries. The task fails to initialize a scanner for the remote image, suggesting a possible misconfiguration or lack of support for scanning images located in private ACRs.

General Error Message:

Microsoft.Guardian.TrivyRedist_linux_amd64.0.45.0/tools/trivy image --exit-code 100 --format sarif --input <registryURL>/my-image:tag --output /agent/_work/1/s/.gdn/.r/trivy/001/trivy.sarif <registryURL>/my-image:tag

FATAL image scan error: scan error: unable to initialize a scanner: unable to initialize the archive scanner: 2 errors occurred:
	* unable to open <remote image> as a Docker image: unable to open the file: open <remote image>: no such file or directory
	* unable to open <remote image> as an OCI Image: stat <remote image>/index.json: no such file or directory

Working Behavior for standalone task

- task: Bash@3
  displayName: 'Trivy scan - Generate report'
  inputs:
    targetType: 'inline'
    script: |
      trivy image --skip-db-update --exit-code 0 --severity LOW,MEDIUM,HIGH,CRITICAL registryURL/my-image:tag
  env:
    TRIVY_AUTH_URL: "https://registryURL"
    TRIVY_USERNAME: "00000000-0000-0000-0000-000000000000" # Dummy username for ACR token authentication
    TRIVY_PASSWORD: $(ACR_TOKEN)

I am getting the acr_token with acr login task like this:

az acr login --name ContainerRegistryName --expose-token --output tsv --query accessToken

Question is why this similiar setup does not work using the MicrosoftSecurityDevOps@1 task?
Could the documentation be updated to include this scenario, or could the task be enhanced to support this use case?
Has anybody else gotten this to work, in that case how?

主要语言
TypeScript
星标
85
派生
22
30 天内没有已合并 PR

环境准备

这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

microsoft/security-devops-azdevops 的其他 Issue

查看 microsoft/security-devops-azdevops 的全部 Issue

相似的 Issue

更多 TypeScript Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。