Before you scan container images for security risks, you must add image repositories to Security Center. This topic describes how to add image repositories to Security Center.
Image limitations
Security Center supports the following container image repositories:
Alibaba Cloud Container Registry (ACR): Enterprise Edition and Personal Edition.
Security Center synchronizes image data from both ACR Enterprise Edition and Personal Edition, but only supports security scanning for ACR Enterprise Edition images.
Third-party image repositories (private image repositories): Harbor, Quay, and GitLab.
Prerequisites
The container image scan feature is enabled. For more information, see Purchase Security Center or Enable container image scan.
Add Alibaba Cloud Container Registry image repositories
ACR Personal Edition instances have no restrictions and can be added to Security Center after creation. To add ACR Enterprise Edition image repositories to Security Center, you only need to add a VPC to the ACR Enterprise Edition instance. For more information, see Configure VPC access control.
Security Center supports the following methods to synchronize image data from ACR Enterprise Edition and Personal Edition:
Automatic synchronization: Security Center synchronizes image data from ACR daily in the early morning by default.
Manual synchronization of latest assets: For more information, see Synchronize assets.
Add a third-party image repository (private image repository)
If your container image repository has an access control policy configured, make sure you have added the IPAM pool IP addresses for the region of your image repository to the access control whitelist.
If your third-party image service is deployed in a hybrid cloud setup (on-premises IDC + cloud VPC), you must configure traffic forwarding rules. Designate an ECS instance and forward its traffic to the IDC server where the third-party image service is hosted.
Example: Forward traffic from Port A on the ECS instance to Port B on the IDC server at 192.168.XX.XX.
CentOS 7 commands:
Using firewall-cmd:
firewall-cmd --permanent --add-forward-port=port=<Port A>:proto=tcp:toaddr=<192.168.XX.XX>:toport=<Port B>Using iptables:
Enable port forwarding.
echo "1" > /proc/sys/net/ipv4/ip_forwardConfigure port forwarding.
iptables -t nat -A PREROUTING -p tcp --dport <Port A> -j DNAT --to-destination <192.168.XX.XX>:<Port B>
Windows command:
netsh interface portproxy add v4tov4 listenport=<Port A> listenaddress=* connectaddress=<192.168.XX.XX> connectport=<Port B> protocol=tcp
Log on to Security Center console.
In the left-side navigation pane, choose . In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.
On the Container page, click the Image tab, locate the Add Third-party Image Repository section, and click Add.
In the Add Image Repository panel, configure the parameters for your private repository, and then click OK.
Parameter Description Repository Type Select the type of private repository based on where your container images are stored. Valid values: harbor, quay, gitlab. Version Select the version of the third-party image repository. Valid values: Version: Select this version if the image repository version is 1.X.X. V2: Select this version if the image repository version is 2.X.X or later. If you select Repository Type as gitlab, V1 is selected by default and cannot be changed. Communication Type Select the communication protocol between Security Center and the third-party image repository. Valid values: http, https. Network Type Select the network type of the third-party image repository. Valid values: Public, VPC. RegionId Select the region where the third-party image repository is located. IP Enter the IP address and port number of the third-party image repository. If you configured traffic forwarding rules for the third-party image repository, enter the IP address and port number of the ECS instance with forwarding rules configured. Port Domain Name Enter the domain name of the third-party image repository. Speed Limit Select the maximum number of images that can be synced per hour. Default value: 10. If too many images are synced per hour, your normal business operations may be affected. Proceed with caution. Important: Unlimited Username Enter the username with administrator permissions used to access the third-party image repository. Password Enter the password for accessing the third-party image repository. Quay Namespace Information (Quay only) In the Image Repository Organization text box, enter the name of the image repository organization. In the Auth_token text box, enter the Auth_token of the image repository organization. Click Add to add multiple image repository organizations. GitLab Group Information (GitLab only) In the Group Information text box, enter the group name. In the Logon-free Configuration text box, enter the Access_token for the group. Click Add to add multiple image repository groups.
After you add the third-party image repository, on the Protection Configuration > Container Protection > Container Image Scan page, click Scan Settings in the upper-right corner. In the Scan Settings panel, view the information about the connected image repositories.
Image repository connection error codes
| Code | Message | Solution |
|---|---|---|
| FailedToVerifyUsernameOrPwd | Username or password is invalid. | Check whether the username and password are correct. |
| RegistryVersionError | The version of the image repository is invalid. | Check whether the selected version (V1 or V2) matches your registry version. |
| UserDoesNotHaveAdminRole | You do not have administrative rights. | Log in to the Harbor server and grant the account administrative rights. |
| NetworkConnectError | The network connection timed out. | Check network connectivity and verify that port 80 or port 443 is open. |
What to do next
After you add image repositories to Security Center, you can view information about images protected by Security Center in Asset Center. For more information, see View container security status.
You must also perform an image security scan to detect risks in your images through Security Center. For more information, see Configure and run image security scans.