Important Support Information

Notwithstanding anything that may be contained to the contrary in your agreement(s) with Sysdig, Sysdig provides no support, and no warranty or guarantee of any kind with respect to these script(s), including as to their functionality or their ability to work in your environment(s). Sysdig disclaims all liability and responsibility with respect to any use of these scripts.

Sysdig Secure Task Extension for Azure DevOps Pipelines

Sysdig Secure is part of Sysdig’s container intelligence platform. Sysdig uses a unified platform to deliver security, monitoring, and forensics in a cloud, container and microservices-friendly architecture integrated with Docker and Kubernetes. Sysdig Secure takes a services-aware approach to protect workloads while bringing deep cloud and container visibility, posture management (compliance, benchmarks, CIEM), vulnerability scanning, forensics and threat detection and blocking.

This extension provides integration with Sysdig Secure to scan container images within the Azure DevOps pipeline.

Pre-requisites

You will require a valid Sysdig Secure API token.

Task usage

Default behaviour

By default, the task will simply scan a local image using Sysdig Vulnerability Management Engine (https://docs.sysdig.com/en/docs/sysdig-secure/vulnerabilities/pipeline).

The task will output the known vulnerabilities and overall policy results of the image scan as well as send the reports to Sysdig Secure for detailed review.

Under default behavior, the pipeline will not fail when the container failes the Sysdig Secure defined policies.

Example yaml:

- task: Sysdig@1
  displayName: Sysdig Vulnerability Management Engine
  inputs:
    apikey: '$(secureApiKey)'
    image: '$(imageName):$(tags)'

Failing the pipeline

In order to fail the pipeline when Sysdig Secure returns a fail based on the results of the Sysdig Secure scan, set the failBuild option to true.

Example yaml:

- task: Sysdig@1
  displayName: Sysdig Vulnerability Management Engine
  inputs:
    apikey: '$(secureApiKey)'
    image: '$(imageName):$(tag)'
    failBuild: true

Policy Evaluation

In order to explicitly evaluate one or more policies use the scanPolicy option and provide a comma-separated list of policy names.

Example yaml:

- task: Sysdig@1
  displayName: Sysdig Vulnerability Management Engine
  inputs:
    apikey: '$(secureApiKey)'
    image: '$(imageName):$(tag)'
    scanPolicy: 'best-practice-policy'

Using a Web Proxy

In order use the extension from behind a proxy ensure your agents have been configured accroding to the following - https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/proxy?view=azure-devops&tabs=unix

Then configure the extenstion to use these settings by setting useProxy option to true.

Example yaml:

- task: Sysdig@1
  displayName: Sysdig Vulnerability Management Engine
  inputs:
    apikey: '$(secureApiKey)'
    image: '$(imageName):$(tag)'
    useProxy: true

Example azure-pipelines.yaml

The below provides an example of a local image build which integrates with Sysdig Secure to scan the image. It will also fail the build if the Sysdig Secure policy scan returns a fail result.

pool:
  vmImage: 'ubuntu-latest'

variables:
  imageName: 'docker.io/sysdigdan/dummy-vuln-app'
  tags: |
    latest
steps:
- bash: echo "Hello World"

- task: Docker@2
  displayName: Build image
  inputs:
    repository: $(imageName)
    command: build
    tags: $(tags)

- task: Sysdig@1
  displayName: Sysdig Vulnerability Management Engine
  inputs:
    apikey: '$(secureApiKey)'
    image: '$(imageName):$(tags)'
    failBuild: true

Legacy Image Scanning Engine

As of April 20, 2022, Sysdig offers both a Legacy Scanner engine and the newer Vulnerability Management engine which is used by default. (https://docs.sysdig.com/en/docs/sysdig-secure/scanning/new-scanning-engine/)

In order to use the Legacy Image Scanning Engine in your pipeline, set the legacyScanning option to true.

- task: Sysdig@1
  displayName: Legacy Sysdig Image Scanning Engine
  inputs:
    apikey: '$(secureApiKey)'
    image: '$(imageName):$(tag)'
    failBuild: true
    skipTLS: true
    verbose: true
    legacyScanning: true

More Information

For documentation on Sysdig Secure, including policy and capabilities see the Sysdig Secure Documentation