run-manual-docker-security-scan

# Run Manual Docker Security Scan Use this workflow to run and document manual security scans for the tracker production container. ## Scope - Target image: tracker runtime image built from root `Containerfile`. - Main severity gate: `HIGH,CRITICAL`. - Documentation outputs: - `docs/security/docker/scans/torrust-tracker.md` - `docs/security/docker/scans/README.md` - `docs/security/analysis/production/CVE-*.md` (when non-affecting CVEs are analyzed) ## Quick Commands ```bash # 1) Build runtime image docker build -t torrust-tracker:local -f Containerfile . # 2) Gate scan (primary) trivy image --severity HIGH,CRITICAL torrust-tracker:local # 3) Full context scan (optional but recommended) trivy image --severity MEDIUM,HIGH,CRITICAL torrust-tracker:local ``` ## Workflow ### Step 1: Check Existing Catalog First Before analyzing any CVE, search the existing catalog: ```bash grep -R "CVE-<id>" docs/security/analysis/ ``` If already present and `requires-recheck-when` conditions have not changed, reuse the existing verdict. ### Step 2: Build and Scan - Build local runtime image from `Containerfile`. - Run the gate scan with `HIGH,CRITICAL`. - Run optional full scan (`MEDIUM,HIGH,CRITICAL`) to capture trend context. ### Step 3: Update Scan History Docs Update: - `docs/security/docker/scans/torrust-tracker.md` with: - date/time, Trivy version, totals by severity - notable CVEs and rationale - `docs/security/docker/scans/README.md` summary table with latest status and date. ### Step 4: Document New Non-Affecting CVEs For any new non-affecting CVE, create `docs/security/analysis/production/CVE-<id>.md` or `docs/security/analysis/build/CVE-<id>.md` using [docs/templates/SECURITY-ANALYSIS.md](../../../../../docs/templates/SECURITY-ANALYSIS.md). The template defines the reusable frontmatter, evidence-based rationale, and recheck-condition structure; retain this skill's scan-specific process steps. ### Step 5: Escalate Affecting CVEs If a CVE is affecting: - Confirm it is already public or approved for disclosure. Privately reported or embargoed vulnerabilities must instead follow `docs/security/vulnerability-remediation.md`; do not create public documentation, issues, or pull requests. - create/update a tracking issue - include impact, affected component, exploitability context, and remediation plan - update scan docs with current status and owner ## Recheck Triggers Re-evaluate catalog verdicts when any of these happen: - `Containerfile` base image changes - new runtime/system dependency is introduced - code path changes that satisfy a CVE file's `requires-recheck-when` condition ## Completion Checklist - [ ] `trivy` gate scan executed (`HIGH,CRITICAL`) - [ ] scan history files updated - [ ] new CVEs cataloged or linked to existing catalog entries - [ ] affecting CVEs escalated - [ ] `linter all` passes