Add automated security scanning of container images

[jaydrogers]

Problem

• There are many dependencies within a PHP docker image and as of now, there's no automated security notification

Proposed Solution

• Integrate an automated security container scanning service that will scan all dependencies within each container image
• The container security report should be public for the world to review

Requirements

• Must work with GitHub actions
• Must be open and report results to the world
• Must be free to use for Open Source projects
• Must notify maintainers in some manner when there is a critical vulnerability

Open for discussion

1. Do you have any recommendations on what service to use?

Please comment below 🙌

[minkbear]

https://snyk.io/product/container-vulnerability-management/
What do you think?

[jaydrogers]

Adding this as a note for signing the images too:

https://github.com/sigstore/cosign

[anb-test-user]

https://www.aikido.dev/scanners/container-image-scanning
Aikido has container image scanning
Also has a 'free forever' tier for solo devs & opensource projects
& has a github actions integration