Skip to main content

Configure STO to Download Images from a Private Registry

Harness maintains its own set of scan images for STO-supported scanners. By default, a Harness pipeline build pulls scan images from Docker Hub.

This topic describes how to override the default behavior and use a private registry instead. You can download the scan images you need, perform your own security checks on the images, upload them to a private registry, and then set up your STO steps to download images from this registry.

Create STO scanner images with your own SSL certificates (optional)

You can set up your STO scan images and pipelines to run scans as non-root and establish trust for your own proxies using self-signed certificates. This workflow supports any STO-compatible scanner that can run natively without root access. This workflow also supports build environments that use a self-signed proxy server between the Harness Delegate and the Harness Manager.

note

Running container image scans as a non-root user is not currently supported.

  1. Save a copy of the following Dockerfile into a folder along with the certificates you want to copy to the image.

  2. Update the FROM, COPY, and USER commands as described in the Dockerfile comments.

  3. Build the new image and then publish it to your private registry.

  4. Update the scan step in your pipeline as follows:

    1. Update the Image setting to point to the new image in your registry.
    2. If you specified a USER in your Dockerfile, set the Run as User (runAsUser) setting to the user you specified in your Dockerfile.
Dockerfile template for adding certificates to an STO scanner image
# STEP 1 
# Specify the STO scanner image where you want to add your certificates
# For a list of all images in the Harness Container Registry, run the following:
# curl -X GET https://app.harness.io/registry/_catalog
FROM harness/twistlock-job-runner:latest as scanner

# FYI Root access is required to load and trust certificates
USER root

# STEP 2
# Copy your certificates to the engine
# You can copy multiple ca from completely different paths into SHARE_CA_PATH
COPY ./CERTIFICATE_1.pem ../another-folder/CERTIFICATE_2.pem /shared/customer_artifacts/certificates/


# FYI establishes trust for certificates in Python and the OS
RUN sto_plugin --trust-certs
# Optional: To trust certificates for Java for tools such as
# - Black Duck Hub
# - Checkmarx
# - Sonarqube
# - Veracode
# - NexusIQ
# RUN sh /bin/setup.sh

# STEP 3 (optional)
# Create a user and assume limited permission user
# If you set this, you need to add runAsUser setting in the scan step
# i.e., runAsUser: "1000"
USER 1000

Workflow description

  1. Download the scan images you need, test and validate the images, and store them in your private registry.

    Harness maintains a Container Image Registry that is dedicated exclusively to hosting Harness-supported images. You can download your scan images from this registry instead of Docker Hub. To view the list of images in this registry, enter the following command:

    curl -X  GET https://app.harness.io/registry/_catalog

    You can also set up your CI pipelines to download build images from this registry instead of Docker Hub.

  2. For each Security Scan step, add these settings:

    • runner_registry_domain — The URL of the Docker registry where the images are stored.

      The supported format is <_domain_>/<_directory_> (such as, app.harness.io/registry).

      Do not include the scheme (such as http:// or https://).

    • runner_registry_image_prefix : harness

    • runner_registry_username — As needed

    • runner_registry_token — As needed

    If you need to use a proxy server, you must also specify the following:

    • http_proxy — The hostname and port to use for proxied HTTP requests

    • https_proxy — The hostname and port to use for proxied HTTPS requests

    • no_proxy — A comma-separated list of hosts to bypass the proxy

YAML example

The following pipeline downloads its Security Scan image (bandit) and all of its CI build images from the Harness Image Registry.

pipeline:
projectIdentifier: my_project
orgIdentifier: my_org
tags: {}
properties:
ci:
codebase:
connectorRef: $GITHUB_CONNECTOR
repoName: dvpwa
build: <+input>
stages:
- stage:
name: securityTestStage
identifier: securityTestStage
type: CI
spec:
cloneCodebase: true
sharedPaths:
- /var/run
infrastructure:
type: KubernetesDirect
spec:
connectorRef: $K8S_CONNECTOR
namespace: harness-delegate-ng
automountServiceAccountToken: true
nodeSelector: {}
harnessImageConnectorRef: account.harnessImage
os: Linux
execution:
steps:
- step:
type: Background
name: docker-dind
identifier: dockerdind
spec:
connectorRef: $DOCKERHUB_CONNECTOR
image: docker:dind
shell: Sh
privileged: true
- step:
type: Security
name: banditScan
identifier: banditScan
spec:
privileged: true
settings:
policy_type: orchestratedScan
scan_type: repository
product_name: bandit
product_config_name: default
repository_branch: <+codebase.branch>
repository_project: dvpwa
fail_on_severity: CRITICAL
runner_registry_domain: app.harness.io/registry
runner_registry_image_prefix: harness
# Here the Harness delegate downloads from the
# Harness Image Registry rather than a private registry.
# Username and token are undefined.
variables: []
identifier: STO_Tutorial_1
name: STO Tutorial 1