trivy image bkimminich/juice-shop:v20.0.0 \

  --severity HIGH,CRITICAL \

  --format json --output labs/lab7/results/trivy-image.json

trivy image bkimminich/juice-shop:v20.0.0 \

  --severity HIGH,CRITICAL \

  --format table | tee labs/lab7/results/trivy-image.txt

cat > /tmp/Dockerfile-bad <<'EOF'

FROM node:latest                      # CKV_DOCKER_3: avoid :latest

USER root                             # CKV_DOCKER_8: USER non-root

EXPOSE 22                             # CKV_DOCKER_1: don't expose SSH

ADD https://example.com/app.tar /     # CKV_DOCKER_4: ADD URL is risky

EOF

trivy config /tmp/Dockerfile-bad --severity HIGH,CRITICAL --format table

jq '[.Results[].Vulnerabilities[]? | select(.FixedVersion != null) |

    {cve: .VulnerabilityID, severity: .Severity, pkg: .PkgName, fix: .FixedVersion}] |

    sort_by(.severity) | .[:10]' \

  labs/lab7/results/trivy-image.json

kubectl apply -f labs/lab7/k8s/

# Wait for the pod

kubectl -n juice-shop wait --for=condition=ready pod -l app=juice-shop --timeout=120s

# Capture full pod spec for proof

kubectl -n juice-shop get pod -l app=juice-shop -o yaml > labs/lab7/results/pod-spec.yaml

# Quick PSS compliance check

kubectl -n juice-shop describe pod -l app=juice-shop | grep -A 3 -i "security context"

trivy k8s --include-namespaces juice-shop \

  --severity HIGH,CRITICAL \

  --format json --output labs/lab7/results/trivy-k8s.json

trivy k8s --include-namespaces juice-shop \

  --severity HIGH,CRITICAL \

  --report=summary