手动扫描操作系统软件包

本快速入门介绍了如何拉取容器映像，使用 On-Demand Scanning API 手动扫描该映像是否存在操作系统漏洞，以及检索已发现的漏洞。如需完成本快速入门，您将使用 Cloud Shell 和一个 Ubuntu 映像示例。

准备工作

  1. Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

  2. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  3. Make sure that billing is enabled for your Google Cloud project.

  4. Enable the On-Demand Scanning API.

    Enable the API

  5. In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

    Go to project selector

  6. Make sure that billing is enabled for your Google Cloud project.

  7. Enable the On-Demand Scanning API.

    Enable the API

    8.

下载并扫描图片

  1. 在项目中打开 Cloud Shell。

    打开 Cloud Shell

    系统会打开一个终端，其中包含遵循本指南所需的所有工具。

  2. 使用 Docker 拉取最新的 Ubuntu 映像。

    docker pull ubuntu:latest

  3. 运行扫描。

    gcloud artifacts docker images scan ubuntu:latest

    这会触发扫描过程，并在完成后返回扫描名称：

    ✓ Scanning container image
  ✓ Locally extracting packages and versions from local container image
  ✓ Remotely initiating analysis of packages and versions
  ✓ Waiting for analysis operation to complete [projects/my-project/locations/us/operations/1a6fd941-b997-4e5f-ba4f-6351f30e7dad]
Done.

done: true
metadata:
  '@type': type.googleapis.com/google.cloud.ondemandscanning.v1.AnalyzePackagesMetadata
  createTime: '2021-01-26T13:43:53.112123Z'
  resourceUri: ubuntu:latest
name: projects/my-project/locations/us/operations/1a6fd941-b99f-4eaf-ba4f-6e5af30e7dad
response:
  '@type': type.googleapis.com/google.cloud.ondemandscanning.v1.AnalyzePackagesResponse
  scan: projects/my-project/locations/us/scans/893c91ce-7fe6-4f1a-a69a-d6ca1b465160

  4. 使用扫描名称（即输出中的 scan 值）来提取扫描结果。

    gcloud artifacts docker images list-vulnerabilities \
projects/my-project/locations/us/scans/893c91ce-7fe6-4f1a-a69a-d6ca1b465160

清理

为避免因本页中使用的资源导致您的 Google Cloud 账号产生费用，请按照以下步骤操作。

如果您为此指南创建了一个新项目，现在可以删除该项目。

后续步骤