docs: update all documentation #688

ashnamehrotra · 2024-07-03T19:13:56Z

Describe the changes in this pull request using active verbs such as Add, Remove, Replace ...

Closes #687
Part of #522

sozercan · 2024-07-03T19:22:58Z

let's merge this into quick start instead of a separate page. we'll need to rearrange some parts there. we can call out scanners being optional and if users are interested in targeted updates.

Signed-off-by: ashnamehrotra <[email protected]>

sozercan · 2024-07-03T20:18:03Z

website/docs/quick-start.md

@@ -12,32 +12,18 @@ This sample illustrates how to patch containers using vulnerability reports with
    * The `docker` daemon runs a buildkit service in-process. If you are using this for your buildkit instance, Docker must have the [containerd image store feature](https://docs.docker.com/storage/containerd/) enabled.
    * If you are using a buildx instance, or using buildkitd directly, there is no need to enable the containerd image store. However, only images in a remote registry can be patched using these methods.
  * [docker](https://docs.docker.com/desktop/linux/install/#generic-installation-steps) daemon running and CLI installed & pathed.
-  * [trivy CLI](https://aquasecurity.github.io/trivy/latest/getting-started/installation/) installed & pathed.


should we keep this but under an optional section?

sozercan · 2024-07-03T20:19:06Z

website/docs/quick-start.md


-    You can also see the existing patchable vulnerabilities in table form on the shell with:
+Upgrading all packages may introduce compatibility issues or break existing functionality. Test the patched image to ensure stability.


Suggested change

Upgrading all packages may introduce compatibility issues or break existing functionality. Test the patched image to ensure stability.

Upgrading all packages may introduce compatibility issues or break existing functionality. Make sure to test the patched image to ensure stability. If you are interested in targeted updates for vulnerabilities only, please see [Patch with an optional scanner report](#patch-with-an-optional-scanner-report) section.

sozercan · 2024-07-03T20:22:35Z

website/docs/quick-start.md

+2. Scan the container image for patchable OS vulnerabilities, outputting the results to a JSON file:
+
+    ```bash
+    trivy image --vuln-type os --ignore-unfixed -f json -o nginx.1.21.6.json docker.io/library/nginx:1.21.6


Suggested change

trivy image --vuln-type os --ignore-unfixed -f json -o nginx.1.21.6.json docker.io/library/nginx:1.21.6

export IMAGE=docker.io/library/nginx:1.21.6

trivy image --vuln-type os --ignore-unfixed -f json -o $(basename $IMAGE).json $IMAGE

sozercan · 2024-07-03T20:22:46Z

website/docs/quick-start.md


    ```bash
-        copa patch -i docker.io/library/nginx:1.21.6
+    trivy image --vuln-type os --ignore-unfixed docker.io/library/nginx:1.21.6


Suggested change

trivy image --vuln-type os --ignore-unfixed docker.io/library/nginx:1.21.6

trivy image --vuln-type os --ignore-unfixed $IMAGE

sozercan · 2024-07-03T20:23:04Z

website/docs/quick-start.md

-    2024/01/22 23:32:54 [notice] 1#1: OS: Linux 6.2.0-1018-azure
-    2024/01/22 23:32:54 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
-    2024/01/22 23:32:54 [notice] 1#1: start worker processes
+    copa patch -r nginx.1.21.6.json -i docker.io/library/nginx:1.21.6


Suggested change

copa patch -r nginx.1.21.6.json -i docker.io/library/nginx:1.21.6

copa patch -r $(basename $IMAGE).json -i $IMAGE

sozercan · 2024-07-03T20:25:41Z

website/docs/quick-start.md


    ```bash
-    copa patch -r nginx.1.21.6.json -i docker.io/library/nginx:1.21.6
+    copa patch -i docker.io/library/nginx:1.21.6


Suggested change

copa patch -i docker.io/library/nginx:1.21.6

export IMAGE=docker.io/library/nginx:1.21.6

copa patch -i $IMAGE

sozercan · 2024-07-03T20:26:12Z

website/docs/quick-start.md

    ```bash
-    copa patch -r nginx.1.21.6.json -i docker.io/library/nginx:1.21.6@sha256:25dedae0aceb6b4fe5837a0acbacc6580453717f126a095aa05a3c6fcea14dd4
+    copa patch -i docker.io/library/nginx:1.21.6@sha256:25dedae0aceb6b4fe5837a0acbacc6580453717f126a095aa05a3c6fcea14dd4


Suggested change

copa patch -i docker.io/library/nginx:1.21.6@sha256:25dedae0aceb6b4fe5837a0acbacc6580453717f126a095aa05a3c6fcea14dd4

export IMAGE="docker.io/library/nginx:1.21.6@sha256:25dedae0aceb6b4fe5837a0acbacc6580453717f126a095aa05a3c6fcea14dd4"

copa patch -i $IMAGE

can we add this as a tip?

sozercan · 2024-07-03T20:27:24Z

website/docs/quick-start.md

-:::note
-The update all functionality allows you to address discrepancies that may arise between scanners and the packages they flag as vulnerable. It is important to note, however, that some upgrades can introduce dependency or compatibility conflicts.
-:::
+The following steps will update all outdated packages in an image to the latest available version:


Suggested change

The following steps will update all outdated packages in an image to the latest available version:

The following steps will update all outdated packages in an image to the latest available versions:

sozercan · 2024-07-03T20:29:34Z

website/docs/quick-start.md

+4. Scan the patched image and verify that the vulnerabilities have been patched:
+
+    ```bash
+    trivy image --vuln-type os --ignore-unfixed docker.io/library/nginx:1.21.6-patched


let's add an example/expected trivy output after this

sozercan · 2024-07-03T20:32:39Z

website/docs/quick-start.md

@@ -46,16 +32,16 @@ The update all functionality allows you to address discrepancies that may arise

    If an instance doesn't exist or that instance doesn't support all the features copa needs the next will be attempted. Please see [custom buildkit addresses](custom-address.md) for more information.

-    After setting up the buildkit instance, run the following command to patch the image:
+2. After setting up the buildkit instance, run the following Copa command to patch the supplied image:


let's keep the trivy sections here. so the flow would be

set up buildkit

trivy scan

copa patch

copa patch all

copa patch trivy report

trivy scan

Signed-off-by: ashnamehrotra <[email protected]>

…date-all-docs

Signed-off-by: ashnamehrotra <[email protected]>

sozercan

a few minor comments, otherwise LGTM

sozercan · 2024-07-04T02:45:51Z

website/docs/quick-start.md

@@ -12,72 +12,127 @@ This sample illustrates how to patch containers using vulnerability reports with
    * The `docker` daemon runs a buildkit service in-process. If you are using this for your buildkit instance, Docker must have the [containerd image store feature](https://docs.docker.com/storage/containerd/) enabled.
    * If you are using a buildx instance, or using buildkitd directly, there is no need to enable the containerd image store. However, only images in a remote registry can be patched using these methods.
  * [docker](https://docs.docker.com/desktop/linux/install/#generic-installation-steps) daemon running and CLI installed & pathed.
-  * [trivy CLI](https://aquasecurity.github.io/trivy/latest/getting-started/installation/) installed & pathed.
-    * Alternatively, see [scanner plugins](#scanner-plugins) for custom scanner support.


let's keep this too

sozercan · 2024-07-04T02:46:11Z

website/docs/quick-start.md

@@ -2,7 +2,7 @@
 title: Quick Start
 ---

-This sample illustrates how to patch containers using vulnerability reports with `copa`.
+This sample illustrates how to patch outdated containers with `copa`.


Suggested change

This sample illustrates how to patch outdated containers with `copa`.

This guide illustrates how to patch outdated containers with `copa`.

sozercan · 2024-07-04T02:49:28Z

website/docs/quick-start.md

+    2024-07-03T14:11:29.864-0700	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
+    2024-07-03T14:11:29.864-0700	INFO	Please see also https://aquasecurity.github.io/trivy/v0.44/docs/scanner/secret/#recommendation for faster secret detection
+    2024-07-03T14:11:32.197-0700	INFO	Detected OS: debian
+    2024-07-03T14:11:32.197-0700	INFO	Detecting Debian vulnerabilities...


let's delete the info lines for brevity

sozercan · 2024-07-04T02:49:44Z

website/docs/quick-start.md

+    2024-07-03T14:30:26.167-0700	INFO	If your scanning is slow, please try '--scanners vuln' to disable secret scanning
+    2024-07-03T14:30:26.167-0700	INFO	Please see also https://aquasecurity.github.io/trivy/v0.44/docs/scanner/secret/#recommendation for faster secret detection
+    2024-07-03T14:30:27.980-0700	INFO	Detected OS: debian
+    2024-07-03T14:30:27.980-0700	INFO	Detecting Debian vulnerabilities...


let's delete the info lines for brevity

sozercan · 2024-07-04T03:24:09Z

website/docs/quick-start.md

+3. Patch the supplied image with Copa:
+
+   ###### 3.1 Update all outdated packages


Suggested change

3. Patch the supplied image with Copa:

###### 3.1 Update all outdated packages

3. Patch the supplied image with Copa:

1. Update all outdated packages

nit: would this work?

sozercan

a few minor comments, otherwise LGTM

sozercan

a few minor comments, otherwise LGTM

Signed-off-by: ashnamehrotra <[email protected]>

ashnamehrotra requested review from jeremyrickard and sozercan as code owners July 3, 2024 19:13

modify quickstart to use update all flow as default, scanner as optional

e84b71c

Signed-off-by: ashnamehrotra <[email protected]>

ashnamehrotra force-pushed the update-all-docs branch from 0ea88d5 to e84b71c Compare July 3, 2024 20:14

sozercan requested changes Jul 3, 2024

View reviewed changes

ashnamehrotra added 7 commits July 3, 2024 14:10

suggested changes docs

a19e5d0

Signed-off-by: ashnamehrotra <[email protected]>

add trivy output

0171067

Signed-off-by: ashnamehrotra <[email protected]>

new flow of quickstart

4455b5a

Signed-off-by: ashnamehrotra <[email protected]>

remove separate page

8a9243c

Signed-off-by: ashnamehrotra <[email protected]>

Merge branch 'main' of github.com:project-copacetic/copacetic into up…

aa3cfe5

…date-all-docs

use ref

a7d78b4

Signed-off-by: ashnamehrotra <[email protected]>

formatting

16d4de2

Signed-off-by: ashnamehrotra <[email protected]>

sozercan approved these changes Jul 4, 2024

View reviewed changes

address comments

b058d9c

Signed-off-by: ashnamehrotra <[email protected]>

ashnamehrotra merged commit b1df0e9 into project-copacetic:main Jul 5, 2024
11 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs: update all documentation #688

docs: update all documentation #688

ashnamehrotra commented Jul 3, 2024

sozercan commented Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan Jul 3, 2024

sozercan left a comment

sozercan Jul 4, 2024

sozercan Jul 4, 2024

sozercan Jul 4, 2024

sozercan Jul 4, 2024

sozercan Jul 4, 2024

sozercan left a comment

sozercan left a comment


		You can also see the existing patchable vulnerabilities in table form on the shell with:
		Upgrading all packages may introduce compatibility issues or break existing functionality. Test the patched image to ensure stability.

	trivy image --vuln-type os --ignore-unfixed -f json -o nginx.1.21.6.json docker.io/library/nginx:1.21.6
	export IMAGE=docker.io/library/nginx:1.21.6
	trivy image --vuln-type os --ignore-unfixed -f json -o $(basename $IMAGE).json $IMAGE

	copa patch -r nginx.1.21.6.json -i docker.io/library/nginx:1.21.6
	copa patch -r $(basename $IMAGE).json -i $IMAGE

	copa patch -i docker.io/library/nginx:1.21.6
	export IMAGE=docker.io/library/nginx:1.21.6
	copa patch -i $IMAGE

	copa patch -i docker.io/library/nginx:1.21.6@sha256:25dedae0aceb6b4fe5837a0acbacc6580453717f126a095aa05a3c6fcea14dd4
	export IMAGE="docker.io/library/nginx:1.21.6@sha256:25dedae0aceb6b4fe5837a0acbacc6580453717f126a095aa05a3c6fcea14dd4"
	copa patch -i $IMAGE

	The following steps will update all outdated packages in an image to the latest available version:
	The following steps will update all outdated packages in an image to the latest available versions:

	This sample illustrates how to patch outdated containers with `copa`.
	This guide illustrates how to patch outdated containers with `copa`.

		3. Patch the supplied image with Copa:

		###### 3.1 Update all outdated packages

docs: update all documentation #688

docs: update all documentation #688

Conversation

ashnamehrotra commented Jul 3, 2024

sozercan commented Jul 3, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sozercan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sozercan left a comment

Choose a reason for hiding this comment

sozercan left a comment

Choose a reason for hiding this comment