Skip to content

Commit 7892e3e

Browse files
temblekingtembleking
authored
feat: implement docker-compose image analysis (#16)
1 parent 21489cb commit 7892e3e

File tree

13 files changed

+815
-140
lines changed

13 files changed

+815
-140
lines changed

‎Cargo.lock‎

Lines changed: 81 additions & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "sysdig-lsp"
3-
version = "0.5.1"
3+
version = "0.6.0"
44
edition = "2024"
55
authors = [ "Sysdig Inc." ]
66
readme = "README.md"
@@ -18,12 +18,14 @@ clap = { version = "4.5.34", features = ["derive"] }
1818
dirs = "6.0.0"
1919
futures = "0.3.31"
2020
itertools = "0.14.0"
21+
marked-yaml = { version = "0.8.0", features = ["serde"] }
2122
rand = "0.9.0"
2223
regex = "1.11.1"
2324
reqwest = "0.12.14"
2425
semver = "1.0.26"
2526
serde = { version = "1.0.219", features = ["alloc", "derive"] }
2627
serde_json = "1.0.135"
28+
serde_yaml = "0.9.34"
2729
serial_test = { version = "3.2.0", features = ["file_locks"] }
2830
tar = "0.4.44"
2931
thiserror = "2.0.12"

‎README.md‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,16 @@ helping you detect vulnerabilities and misconfigurations earlier in the developm
1515
1616
## Features
1717

18-
| Feature | **[VSCode Extension](https://github.com/sysdiglabs/vscode-extension)** | **[Sysdig LSP](./docs/features/README.md)** |
19-
|---------------------------------|------------------------------------------------------------------------|----------------------------------------------------------|
20-
| Scan base image in Dockerfile | Supported | [Supported](./docs/features/scan_base_image.md) (0.1.0+) |
21-
| Code lens support | Supported | [Supported](./docs/features/code_lens.md) (0.2.0+) |
22-
| Build and Scan Dockerfile | Supported | [Supported](./docs/features/build_and_scan.md) (0.4.0+) |
23-
| Layered image analysis | Supported | [Supported](./docs/features/layered_analysis.md) (0.5.0+)|
24-
| Docker-compose image analysis | Supported | In roadmap |
25-
| K8s Manifest image analysis | Supported | In roadmap |
26-
| Infrastructure-as-code analysis | Supported | In roadmap |
27-
| Vulnerability explanation | Supported | In roadmap |
18+
| Feature | **[VSCode Extension](https://github.com/sysdiglabs/vscode-extension)** | **[Sysdig LSP](./docs/features/README.md)** |
19+
|---------------------------------|------------------------------------------------------------------------|------------------------------------------------------------------------|
20+
| Scan base image in Dockerfile | Supported | [Supported](./docs/features/scan_base_image.md) (0.1.0+) |
21+
| Code lens support | Supported | [Supported](./docs/features/code_lens.md) (0.2.0+) |
22+
| Build and Scan Dockerfile | Supported | [Supported](./docs/features/build_and_scan.md) (0.4.0+) |
23+
| Layered image analysis | Supported | [Supported](./docs/features/layered_analysis.md) (0.5.0+) |
24+
| Docker-compose image analysis | Supported | [Supported](./docs/features/docker_compose_image_analysis.md) (0.6.0+) |
25+
| K8s Manifest image analysis | Supported | In roadmap |
26+
| Infrastructure-as-code analysis | Supported | In roadmap |
27+
| Vulnerability explanation | Supported | In roadmap |
2828

2929
## Build
3030

‎docs/features/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,7 @@ Sysdig LSP provides tools to integrate container security checks into your devel
1818
- Scans each Dockerfile layer individually for precise vulnerability identification.
1919
- Supports detailed analysis in single-stage and multi-stage Dockerfiles.
2020

21+
## [Docker-compose Image Analysis](./docker_compose_image_analysis.md)
22+
- Scans the images defined in your `docker-compose.yml` files for vulnerabilities.
23+
2124
See the linked documents for more details.

‎docs/features/docker_compose_image_analysis.gif‎

1.57 MB
Loading

‎docs/features/docker_compose_image_analysis.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Docker-compose Image Analysis
2+
3+
Sysdig LSP scans the images defined in your `docker-compose.yml` files to identify vulnerabilities.
4+
5+
> [!IMPORTANT]
6+
> Sysdig LSP analyzes each service's image in your compose file.
7+
8+
![Sysdig LSP executing docker-compose image scan](./docker_compose_image_analysis.gif)
9+
10+
## Example
11+
12+
```yaml
13+
services:
14+
web:
15+
image: nginx:latest
16+
db:
17+
image: postgres:13
18+
```
19+
20+
In this example, Sysdig LSP will provide actions to scan both `nginx:latest` and `postgres:13` images.

‎src/app/commands.rs‎

Lines changed: 8 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -67,59 +67,33 @@ impl<C> CommandExecutor<C>
6767
where
6868
C: LSPClient,
6969
{
70-
pub async fn scan_image_from_file(
70+
pub async fn scan_image(
7171
&self,
7272
uri: &str,
73-
line: u32,
73+
range: Range,
74+
image_name: &str,
7475
image_scanner: &impl ImageScanner,
7576
) -> Result<()> {
76-
let document_text = self
77-
.document_database
78-
.read_document_text(uri)
79-
.await
80-
.ok_or_else(|| {
81-
Error::internal_error().with_message("unable to obtain document to scan")
82-
})?;
83-
84-
let image_for_selected_line =
85-
self.image_from_line(line, &document_text).ok_or_else(|| {
86-
Error::parse_error().with_message(format!(
87-
"unable to retrieve image for the selected line: {line}"
88-
))
89-
})?;
90-
9177
self.show_message(
9278
MessageType::INFO,
93-
format!("Starting scan of {image_for_selected_line}...").as_str(),
79+
format!("Starting scan of {image_name}...").as_str(),
9480
)
9581
.await;
9682

9783
let scan_result = image_scanner
98-
.scan_image(image_for_selected_line)
84+
.scan_image(image_name)
9985
.await
10086
.map_err(|e| Error::internal_error().with_message(e.to_string()))?;
10187

10288
self.show_message(
10389
MessageType::INFO,
104-
format!("Finished scan of {image_for_selected_line}.").as_str(),
90+
format!("Finished scan of {image_name}.").as_str(),
10591
)
10692
.await;
10793

10894
let diagnostic = {
109-
let range_for_selected_line = Range::new(
110-
Position::new(line, 0),
111-
Position::new(
112-
line,
113-
document_text
114-
.lines()
115-
.nth(line as usize)
116-
.map(|x| x.len() as u32)
117-
.unwrap_or(u32::MAX),
118-
),
119-
);
120-
12195
let mut diagnostic = Diagnostic {
122-
range: range_for_selected_line,
96+
range,
12397
severity: Some(DiagnosticSeverity::HINT),
12498
message: "No vulnerabilities found.".to_owned(),
12599
..Default::default()
@@ -128,7 +102,7 @@ where
128102
if scan_result.has_vulnerabilities() {
129103
diagnostic.message = format!(
130104
"Vulnerabilities found for {}: {} Critical, {} High, {} Medium, {} Low, {} Negligible",
131-
image_for_selected_line,
105+
image_name,
132106
scan_result.count_vulns_of_severity(VulnSeverity::Critical),
133107
scan_result.count_vulns_of_severity(VulnSeverity::High),
134108
scan_result.count_vulns_of_severity(VulnSeverity::Medium),

0 commit comments

Comments
 (0)