DEV Community 👩‍💻👨‍💻

Cover image for 🕵️ About Java Bytecode, native binaries & security (short Grype benchmark)
adriens for opt-nc

Posted on • Updated on

🕵️ About Java Bytecode, native binaries & security (short Grype benchmark)

❔ Intro

We are currently working on the following topics :

  • Native Docker images delivery through Github Actions, on various registries (mainly GHCR.io and Docker Hub)
  • Java native experience : migration to Spring Boot Native & Quarkus experimentations
  • Security for our Images Continuous Deployment pipeline

🛡️ Security

For our source code & dependencies, we are applying security strategy thanks to Dependabot :

...and GitHub Advanced Security for some repositories.

🖕 Controlling Docker images releases

More and more we release and rely on an ever growing set of Docker images.
To make short, as Software Developers and DEVOPS engineers, the ones that interest us currently are :

  • The images we rely on
  • The image we build ourselves (on top of previous ones)

👉 What we want need to be able to do is : to be able to control the security level of the images we are building...

⚠️ And not release them if they do not reach the expected level of security, depending of the target service.

As all services do not have the same criticity, vulnerabilities level may have different impacts on runtime security governance.

👐 Experimentation and solutions

Fortunately anchore provides a set of ready to use tools that helps... a lot :

  • grype (vulnerability scanner for container images and filesystems)
  • syft (CLI tool and library for generating a Software Bill of Materials from container images and filesystems)
  • grype as a Anchore GitHub Action :

Image description

👉 So you can easily protect your Continuous Delivery pipeline thanks to the severity-cutoff :

Image description

🤔 Bytecode vs. native impact on security

We wanted to give a quick look at if - and so how - native strategy impacts security, discover the grype output below:

🔖 Resources

GitHub logo anchore / grype

A vulnerability scanner for container images and filesystems

Grype logo

Static Analysis + Unit + Integration Acceptance Go Report Card GitHub release GitHub go.mod Go version License: Apache-2.0 Slack Invite

A vulnerability scanner for container images and filesystems. Easily install the binary to try it out. Works with Syft, the powerful SBOM (software bill of materials) tool for container images and filesystems.

Join our community meetings!

grype-demo

Features

  • Scan the contents of a container image or filesystem to find known vulnerabilities.
  • Find vulnerabilities for major operating system packages
    • Alpine
    • Amazon Linux
    • BusyBox
    • CentOS
    • Debian
    • Distroless
    • Oracle Linux
    • Red Hat (RHEL)
    • Ubuntu
  • Find vulnerabilities for language-specific packages
    • Ruby (Gems)
    • Java (JAR, WAR, EAR, JPI, HPI)
    • JavaScript (NPM, Yarn)
    • Python (Egg, Wheel, Poetry, requirements.txt/setup.py files)
    • Dotnet (deps.json)
    • Golang (go.mod)
    • PHP (Composer)
    • Rust (Cargo)
  • Supports Docker and OCI image formats
  • Consume SBOM attestations.

If you encounter an issue, please let us know using the issue tracker.

Installation

Recommended

curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
Enter fullscreen mode Exit fullscreen mode

You…

Top comments (2)

Collapse
adriens profile image
adriens Author

swype : Catalog packages from source pom.xml during directory scans : github.com/anchore/syft/issues/676

Collapse
adriens profile image
adriens Author

🌚 Browsing with dark mode makes you a better developer by a factor of exactly 40.

It's a scientific fact.