Anchore Container Security Scanning: Complete Cheatsheet

Introduction to Anchore Security Scanning

Anchore is a powerful open-source container security platform that allows developers and security teams to analyze, inspect, and validate container images. It performs deep inspection of container images, evaluating them against user-defined policies to provide governance and compliance with security standards. Anchore is particularly valuable in DevSecOps pipelines, helping organizations detect vulnerabilities, malware, and policy violations before containers reach production environments.

Core Concepts and Components

Key Anchore Components

Anchore Workflow

1. Image Analysis – Container images are submitted for deep inspection
2. Policy Evaluation – Images are checked against defined security policies
3. Vulnerability Scanning – CVE detection across OS packages and application dependencies
4. SBOM Generation – Creation of detailed Software Bill of Materials
5. Results & Reports – Actionable security findings are presented

Installation and Setup

Installing Anchore Engine

# Using Docker Compose (recommended for quick setup)
curl -O https://engine.anchore.io/docs/quickstart/docker-compose.yaml
docker-compose up -d

# Verify installation
docker-compose ps

Installing Anchore CLI

# Install via pip
pip install anchorecli

# Verify installation
anchore-cli --version

# Configure CLI
export ANCHORE_CLI_URL=http://localhost:8228/v1
export ANCHORE_CLI_USER=admin
export ANCHORE_CLI_PASS=foobar

Installing Standalone Tools

# Install Syft (SBOM generator)
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

# Install Grype (vulnerability scanner)
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

Key Commands and Operations

Anchore CLI Commands

Syft Commands (SBOM)

# Generate SBOM for container image
syft alpine:latest

# Output in different formats (JSON, SPDX, CycloneDX)
syft alpine:latest -o json > alpine-sbom.json
syft alpine:latest -o spdx-json > alpine-spdx.json
syft alpine:latest -o cyclonedx-json > alpine-cyclonedx.json

# Scan specific package types
syft alpine:latest --scope all-layers

Grype Commands (Vulnerability Scanning)

# Basic vulnerability scan
grype alpine:latest

# Scan with specific database
grype alpine:latest --db ./path/to/db

# Output in different formats
grype alpine:latest --output json > results.json

# Only show vulnerabilities of specified severity
grype alpine:latest --fail-on medium

Policy Management

Policy Structure

Anchore policies consist of:

• Gates: High-level security categories (e.g., vulnerabilities, secrets)
• Triggers: Specific conditions to check within each gate
• Actions: What to do when trigger conditions are met (stop, warn, go)

Sample Policy File

{
  "id": "sample_policy",
  "version": "1_0",
  "name": "Sample Policy",
  "rules": [
    {
      "action": "STOP",
      "gate": "vulnerabilities",
      "trigger": "package",
      "params": [
        { "name": "package_type", "value": "all" },
        { "name": "severity", "value": "high" }
      ]
    }
  ]
}

Managing Policies

# List policies
anchore-cli policy list

# Get current policy
anchore-cli policy get

# Add new policy
anchore-cli policy add policy-file.json

# Activate policy
anchore-cli policy activate POLICY_ID

Integration with CI/CD Pipelines

Jenkins Pipeline Example

pipeline {
    agent any
    stages {
        stage('Build') {
            steps {
                sh 'docker build -t myapp:latest .'
            }
        }
        stage('Scan') {
            steps {
                sh 'anchore-cli image add myapp:latest'
                sh 'anchore-cli image wait myapp:latest'
                sh 'anchore-cli evaluate check myapp:latest'
            }
        }
    }
}

GitHub Actions Example

name: Anchore Container Scan

on: push

jobs:
  anchore-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
        
      - name: Build image
        run: docker build -t myapp:latest .
        
      - name: Anchore scan
        uses: anchore/scan-action@v3
        with:
          image: "myapp:latest"
          fail-build: true
          severity-cutoff: high

Common Challenges and Solutions

Best Practices

Scanning Efficiency

• Scan early in the development process
• Cache analysis results for base images
• Use distroless or minimal base images when possible
• Implement policy-as-code for consistent enforcement

Security Posture

• Define graduated severity thresholds based on environment (dev vs. prod)
• Integrate with vulnerability management systems
• Implement “break the build” for critical findings
• Use image signing and attestation after successful scans

Compliance and Governance

• Map policies to compliance frameworks (NIST, CIS, etc.)
• Document policy exceptions with justification
• Generate compliance reports for audits
• Track vulnerability remediation metrics

Anchore vs. Other Container Scanning Tools

Resources for Further Learning

Official Documentation

• Anchore Engine Documentation
• Anchore Enterprise Documentation
• Syft GitHub Repository
• Grype GitHub Repository

Community Resources

• Anchore GitHub
• Anchore Blog
• Container Security Best Practices Guide

Training Resources

• Anchore Academy
• Container Security Fundamentals

Related Tools

• Kubernetes admission controllers for Anchore integration
• CI/CD pipeline plugins for various platforms
• Container registry integrations

This cheatsheet provides a comprehensive overview of Anchore container security scanning, covering everything from basic concepts to advanced techniques. Whether you’re just getting started with container security or looking to optimize your existing implementation, these tools and practices will help you build a robust security posture for your containerized applications.