awslabs/aws-container-images-toolkit

A collection of tools to statically and dynamically identify public container images that are hosted on Docker Hub.

Public Container Images Detector

This tool allows you to scan repositories and container orchestrators for public container images hosted in Docker Hub.

Install

In order to use the detector, either clone this repo or download it and extract it locally.

Use

In Dockerfiles

Please have a look at the from source part for usage details.

ECS

Please have a look at the ECS part for usage details.

Kubernetes

Please have a look at the Kubernetes part for usage details.

CodeBuild

Please have a look at the CodeBuild part for usage details.

aws-container-images-toolkit's Issues

Consider using shellcheck?

So, based on the PR that I just made ( #5 ), I was curious if you ( the code owner ) would mind another PR to implement the changes that the tool shellcheck could suggest. The PR which I just did only used the error severity ( which is saying things that might break your code ), but the tool goes all the way down to using stylistic suggestions ( i.e. using -n instead of ! -z for if statements: https://github.com/koalaman/shellcheck/wiki/SC2236 ).

Here is the gcc formatted output of the tool, which gives the output in a very concise format but all the necessary information:

$ shellcheck -S style -o all -f gcc */*.sh
codebuild/detect-images.sh:8:13: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:9:18: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:11:18: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:11:40: note: Double quote to prevent globbing and word splitting. [SC2086]
codebuild/detect-images.sh:11:40: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:13:10: note: Double quote to prevent globbing and word splitting. [SC2086]
codebuild/detect-images.sh:13:10: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:18:14: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:20:37: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:21:23: note: Double quote to prevent globbing and word splitting. [SC2086]
codebuild/detect-images.sh:21:23: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:22:21: note: Double quote to prevent globbing and word splitting. [SC2086]
codebuild/detect-images.sh:22:21: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:23:20: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:23:30: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:30:16: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:31:56: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:35:19: note: Double quote to prevent globbing and word splitting. [SC2086]
codebuild/detect-images.sh:35:19: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:36:25: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:37:19: note: Double quote to prevent globbing and word splitting. [SC2086]
codebuild/detect-images.sh:37:19: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:38:25: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:42:11: note: Use -n instead of ! -z. [SC2236]
codebuild/detect-images.sh:42:16: error: Arrays implicitly concatenate in [[ ]]. Use a loop (or explicit * instead of @). [SC2199]
codebuild/detect-images.sh:44:19: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
codebuild/detect-images.sh:44:28: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:8:13: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:9:18: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:11:18: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:11:40: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:11:40: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:13:10: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:13:10: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:20:39: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:21:13: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:22:18: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:24:18: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:24:40: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:24:40: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:26:10: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:26:10: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:31:14: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:33:31: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:34:23: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:34:23: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:35:25: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:35:25: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:36:15: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:36:29: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:43:16: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:46:18: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:48:40: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:48:40: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:48:50: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:49:27: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:49:27: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:50:26: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:50:26: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:51:19: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:54:56: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:54:56: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:54:73: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:54:73: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:55:25: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:55:38: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:58:19: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:58:19: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:63:19: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:63:19: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:64:25: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:65:19: note: Double quote to prevent globbing and word splitting. [SC2086]
ecs/detect-images.sh:65:19: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:66:25: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:70:11: note: Use -n instead of ! -z. [SC2236]
ecs/detect-images.sh:70:16: error: Arrays implicitly concatenate in [[ ]]. Use a loop (or explicit * instead of @). [SC2199]
ecs/detect-images.sh:72:19: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
ecs/detect-images.sh:72:28: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
kubernetes/detect-images.sh:19:8: note: Prefer double quoting even when variables don't contain special characters. [SC2248]
kubernetes/detect-images.sh:19:8: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
kubernetes/detect-images.sh:27:17: note: Double quote to prevent globbing and word splitting. [SC2086]
kubernetes/detect-images.sh:27:17: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
kubernetes/detect-images.sh:28:23: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
kubernetes/detect-images.sh:29:17: note: Double quote to prevent globbing and word splitting. [SC2086]
kubernetes/detect-images.sh:29:17: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
kubernetes/detect-images.sh:30:23: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
kubernetes/detect-images.sh:34:11: note: Use -n instead of ! -z. [SC2236]
kubernetes/detect-images.sh:34:17: warning: Expanding an array without an index only gives the first element. [SC2128]
kubernetes/detect-images.sh:34:17: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
kubernetes/detect-images.sh:36:15: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
kubernetes/detect-images.sh:47:11: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:8:16: note: Double quote to prevent globbing and word splitting. [SC2086]
source/detect-images.sh:8:16: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:8:40: note: Double quote to prevent globbing and word splitting. [SC2086]
source/detect-images.sh:8:40: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:11:11: warning: Prefer mapfile or read -a to split command output (or quote to avoid splitting). [SC2207]
source/detect-images.sh:11:18: note: Double quote to prevent globbing and word splitting. [SC2086]
source/detect-images.sh:14:25: note: Double quote to prevent globbing and word splitting. [SC2086]
source/detect-images.sh:14:25: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:14:50: warning: Quote the grep pattern so the shell won't interpret it. [SC2062]
source/detect-images.sh:15:16: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:16:15: note: Double quote to prevent globbing and word splitting. [SC2086]
source/detect-images.sh:16:15: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:17:13: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:17:25: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:18:15: note: Double quote to prevent globbing and word splitting. [SC2086]
source/detect-images.sh:18:15: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:19:13: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:19:25: note: Prefer putting braces around variable references even when not strictly required. [SC2250]
source/detect-images.sh:26:17: note: Prefer putting braces around variable references even when not strictly required. [SC2250]

as you can see there is quite a bit of things to do though, so that is why I figured I would open an issue, as your CONTRIBUTING.md states:

3. You open an issue to discuss any significant work - we would hate for your time to be wasted.

In the future you can actually have shellcheck hook into vscode, so you get inline syntax highlighting as you are writing shell scripts.

Also, if you have more shell scripts that are scattered throughout a directory ( not as nice as just being able to do */*.sh ), I created a script for finding all shell scripts and run shellcheck against everything it can find: https://github.com/elreydetoda/packer-kali_linux/blob/2fc384919fa31d3c992faf29efcb341c4c5d29bc/scripts/circleci-shellcheck-command.sh

I haven't given it much docs, but to get the same output as I used above you could do this:
circleci-shellcheck-command.sh 'style|all|gcc'

Support for other registries other than docker.io

I'd like to be able to identify containers that are running in my cluster that come from other registries. Some examples would be quay.io, Google Container Registry, and Azure Container Registry.