@orionscanner/cli 0.1.0

package/src/orion/engine/container/engine.py

@@ -0,0 +1,546 @@
+"""Container/security config analysis engine - analyzes Dockerfiles, docker-compose, Kubernetes, Helm."""
+import re
+import yaml
+import json
+from pathlib import Path
+from typing import Dict, List, Optional, Any, Set
+from dataclasses import dataclass
+
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+@dataclass
+class ContainerFinding:
+    severity: str
+    title: str
+    description: str
+    location: str
+    metadata: dict
+
+
+class ContainerEngine:
+    name = "container"
+    version = "1.0.0"
+
+    CONTAINER_FILES = {
+        "dockerfile": ["Dockerfile", "Dockerfile.*", "*.dockerfile"],
+        "docker_compose": ["docker-compose.yml", "docker-compose.yaml", "docker-compose.*.yml", "docker-compose.*.yaml"],
+        "dockerignore": [".dockerignore"],
+        "kubernetes": ["kubernetes/*.yaml", "kubernetes/*.yml", "k8s/*.yaml", "k8s/*.yml", "manifests/*.yaml", "manifests/*.yml"],
+        "helm": ["helm/**/values.yaml", "helm/**/values.yml", "charts/**/values.yaml", "charts/**/values.yml"],
+    }
+
+    SECRET_PATTERNS = [
+        (re.compile(r'(password|passwd|pwd)\s*[:=]\s*["\']?[^"\'\s]{8,}'), "password"),
+        (re.compile(r'(api[_-]?key|apikey|secret[_-]?key|access[_-]?token)\s*[:=]\s*["\']?[^"\'\s]{16,}'), "api_key"),
+        (re.compile(r'AKIA[0-9A-Z]{16}'), "aws_access_key"),
+        (re.compile(r'-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----'), "private_key"),
+        (re.compile(r'(jdbc|mongodb|redis|mysql|postgres)://[^:\s]+:[^@\s]+@'), "connection_string"),
+    ]
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=128)
+
+    def _should_exclude(self, filepath: str, config: EngineConfig) -> bool:
+        path = Path(filepath)
+        if config.toggles.get("exclude"):
+            for pattern in config.toggles["exclude"]:
+                if path.match(pattern) or any(p.match(pattern) for p in path.parents):
+                    return True
+        return False
+
+    def _detect_file_type(self, filepath: str) -> Optional[str]:
+        path = Path(filepath)
+        name = path.name.lower()
+
+        if name == "dockerfile" or name.startswith("dockerfile.") or name.endswith(".dockerfile"):
+            return "dockerfile"
+        if name.startswith("docker-compose") and (name.endswith(".yml") or name.endswith(".yaml")):
+            return "docker_compose"
+        if name == ".dockerignore":
+            return "dockerignore"
+        if "kubernetes" in path.parts or "k8s" in path.parts or "manifests" in path.parts:
+            if name.endswith((".yaml", ".yml")):
+                return "kubernetes"
+        if "helm" in path.parts or "charts" in path.parts:
+            if name in ("values.yaml", "values.yml"):
+                return "helm"
+        return None
+
+    def _scan_secrets(self, content: str, filepath: str) -> List[ContainerFinding]:
+        findings = []
+        lines = content.splitlines()
+        for i, line in enumerate(lines, 1):
+            for pattern, secret_type in self.SECRET_PATTERNS:
+                if pattern.search(line):
+                    findings.append(ContainerFinding(
+                        severity="critical",
+                        title=f"Hardcoded {secret_type} in {Path(filepath).name}",
+                        description=f"Potential {secret_type} found in container config",
+                        location=f"{filepath}:{i}",
+                        metadata={"rule": f"secret_{secret_type}", "file": filepath, "line": i, "type": secret_type},
+                    ))
+        return findings
+
+    def _analyze_dockerfile(self, content: str, filepath: str) -> List[ContainerFinding]:
+        findings = []
+        lines = content.splitlines()
+        has_user = False
+        has_healthcheck = False
+        from_latest = False
+        copy_dot = False
+        has_add_url = False
+
+        for i, line in enumerate(lines, 1):
+            stripped = line.strip()
+            upper = stripped.upper()
+
+            # Check for USER instruction
+            if upper.startswith("USER "):
+                user = stripped[5:].strip()
+                if user == "root" or user == "0":
+                    findings.append(ContainerFinding(
+                        severity="high",
+                        title="Container runs as root",
+                        description="Dockerfile specifies USER root - containers should run as non-root user",
+                        location=f"{filepath}:{i}",
+                        metadata={"rule": "user_root", "file": filepath, "line": i},
+                    ))
+                has_user = True
+
+            # Check for FROM latest or no tag
+            if upper.startswith("FROM "):
+                from_part = stripped[5:].strip()
+                if ":latest" in from_part or (":" not in from_part and "@" not in from_part and not from_part.startswith("--")):
+                    findings.append(ContainerFinding(
+                        severity="medium",
+                        title="Base image uses 'latest' tag or no tag",
+                        description="Using 'latest' or no tag makes builds non-reproducible",
+                        location=f"{filepath}:{i}",
+                        metadata={"rule": "from_latest", "file": filepath, "line": i, "image": from_part},
+                    ))
+                    from_latest = True
+
+            # Check for COPY . .
+            if upper.startswith("COPY ") and ". ." in stripped:
+                findings.append(ContainerFinding(
+                    severity="medium",
+                    title="COPY . . copies entire build context",
+                    description="COPY . . copies all files including secrets, tests, etc. - use explicit paths",
+                    location=f"{filepath}:{i}",
+                    metadata={"rule": "copy_dot_dot", "file": filepath, "line": i},
+                ))
+                copy_dot = True
+
+            # Check for ADD from URL
+            if upper.startswith("ADD ") and ("http://" in stripped or "https://" in stripped):
+                findings.append(ContainerFinding(
+                    severity="high",
+                    title="ADD with remote URL",
+                    description="ADD with URL can introduce supply chain risks - use COPY or RUN with explicit download",
+                    location=f"{filepath}:{i}",
+                    metadata={"rule": "add_remote_url", "file": filepath, "line": i},
+                ))
+                has_add_url = True
+
+            # Check for secrets in ENV/ARG
+            if upper.startswith("ENV ") or upper.startswith("ARG "):
+                for pattern, secret_type in self.SECRET_PATTERNS:
+                    if pattern.search(stripped):
+                        findings.append(ContainerFinding(
+                            severity="critical",
+                            title=f"Secret in {upper.split()[0]} instruction",
+                            description=f"Potential {secret_type} in {upper.split()[0]} - use build secrets or runtime env",
+                            location=f"{filepath}:{i}",
+                            metadata={"rule": f"secret_in_{upper.split()[0].lower()}", "file": filepath, "line": i, "type": secret_type},
+                        ))
+
+            # Check for HEALTHCHECK
+            if upper.startswith("HEALTHCHECK"):
+                has_healthcheck = True
+
+        # Missing USER
+        if not has_user:
+            findings.append(ContainerFinding(
+                severity="high",
+                title="Missing USER instruction",
+                description="Container will run as root by default - add USER instruction",
+                location=filepath,
+                metadata={"rule": "missing_user", "file": filepath},
+            ))
+
+        # Missing HEALTHCHECK
+        if not has_healthcheck:
+            findings.append(ContainerFinding(
+                severity="medium",
+                title="Missing HEALTHCHECK",
+                description="No health check defined - container orchestration cannot verify health",
+                location=filepath,
+                metadata={"rule": "missing_healthcheck", "file": filepath},
+            ))
+
+        return findings
+
+    def _analyze_docker_compose(self, content: str, filepath: str) -> List[ContainerFinding]:
+        findings = []
+        try:
+            compose = yaml.safe_load(content)
+            if not compose or "services" not in compose:
+                return findings
+
+            for service_name, service_config in compose.get("services", {}).items():
+                if not isinstance(service_config, dict):
+                    continue
+
+                # privileged
+                if service_config.get("privileged"):
+                    findings.append(ContainerFinding(
+                        severity="critical",
+                        title=f"Service '{service_name}' runs in privileged mode",
+                        description="Privileged containers have full access to host - major security risk",
+                        location=f"{filepath}:services.{service_name}.privileged",
+                        metadata={"rule": "privileged", "file": filepath, "service": service_name},
+                    ))
+
+                # cap_add: ALL
+                cap_add = service_config.get("cap_add", [])
+                if isinstance(cap_add, list) and "ALL" in cap_add:
+                    findings.append(ContainerFinding(
+                        severity="high",
+                        title=f"Service '{service_name}' adds ALL capabilities",
+                        description="Adding ALL capabilities defeats container isolation",
+                        location=f"{filepath}:services.{service_name}.cap_add",
+                        metadata={"rule": "cap_add_all", "file": filepath, "service": service_name},
+                    ))
+
+                # network_mode: host
+                if service_config.get("network_mode") == "host":
+                    findings.append(ContainerFinding(
+                        severity="high",
+                        title=f"Service '{service_name}' uses host network",
+                        description="Host network mode gives container full access to host network stack",
+                        location=f"{filepath}:services.{service_name}.network_mode",
+                        metadata={"rule": "network_mode_host", "file": filepath, "service": service_name},
+                    ))
+
+                # pid_mode: host
+                if service_config.get("pid_mode") == "host":
+                    findings.append(ContainerFinding(
+                        severity="high",
+                        title=f"Service '{service_name}' uses host PID namespace",
+                        description="Host PID mode allows container to see all host processes",
+                        location=f"{filepath}:services.{service_name}.pid_mode",
+                        metadata={"rule": "pid_mode_host", "file": filepath, "service": service_name},
+                    ))
+
+                # ipc_mode: host
+                if service_config.get("ipc_mode") == "host":
+                    findings.append(ContainerFinding(
+                        severity="high",
+                        title=f"Service '{service_name}' uses host IPC namespace",
+                        description="Host IPC mode allows container to share IPC with host",
+                        location=f"{filepath}:services.{service_name}.ipc_mode",
+                        metadata={"rule": "ipc_mode_host", "file": filepath, "service": service_name},
+                    ))
+
+                # read_only
+                if not service_config.get("read_only"):
+                    findings.append(ContainerFinding(
+                        severity="medium",
+                        title=f"Service '{service_name}' missing read_only: true",
+                        description="Container filesystem should be read-only for security",
+                        location=f"{filepath}:services.{service_name}.read_only",
+                        metadata={"rule": "missing_read_only", "file": filepath, "service": service_name},
+                    ))
+
+                # resource limits
+                deploy = service_config.get("deploy", {})
+                resources = deploy.get("resources", {})
+                limits = resources.get("limits", {})
+                if not limits:
+                    findings.append(ContainerFinding(
+                        severity="medium",
+                        title=f"Service '{service_name}' missing resource limits",
+                        description="Containers should have CPU/memory limits to prevent DoS",
+                        location=f"{filepath}:services.{service_name}.deploy.resources.limits",
+                        metadata={"rule": "missing_resource_limits", "file": filepath, "service": service_name},
+                    ))
+
+                # secrets in environment
+                env = service_config.get("environment", {})
+                if isinstance(env, dict):
+                    for key, value in env.items():
+                        for pattern, secret_type in self.SECRET_PATTERNS:
+                            if isinstance(value, str) and pattern.search(value):
+                                findings.append(ContainerFinding(
+                                    severity="critical",
+                                    title=f"Secret in environment variable for service '{service_name}'",
+                                    description=f"Potential {secret_type} in environment variable '{key}'",
+                                    location=f"{filepath}:services.{service_name}.environment.{key}",
+                                    metadata={"rule": f"secret_in_env", "file": filepath, "service": service_name, "env_var": key, "type": secret_type},
+                                ))
+
+        except yaml.YAMLError:
+            pass
+        return findings
+
+    def _analyze_kubernetes(self, content: str, filepath: str) -> List[ContainerFinding]:
+        findings = []
+        try:
+            docs = list(yaml.safe_load_all(content))
+            for doc in docs:
+                if not doc or not isinstance(doc, dict):
+                    continue
+
+                kind = doc.get("kind", "")
+                metadata = doc.get("metadata", {})
+                name = metadata.get("name", "unknown")
+                namespace = metadata.get("namespace", "default")
+
+                # Check Pod security context
+                spec = doc.get("spec", {})
+                template_spec = spec.get("template", {}).get("spec", spec)
+
+                # allowPrivilegeEscalation
+                containers = template_spec.get("containers", [])
+                for container in containers:
+                    if not isinstance(container, dict):
+                        continue
+                    container_name = container.get("name", "unknown")
+                    security_context = container.get("securityContext", {})
+
+                    if security_context.get("allowPrivilegeEscalation") is True:
+                        findings.append(ContainerFinding(
+                            severity="high",
+                            title=f"Container '{container_name}' allows privilege escalation",
+                            description="allowPrivilegeEscalation: true allows processes to gain more privileges",
+                            location=f"{filepath}:{kind}/{name}.spec.containers[{container_name}].securityContext.allowPrivilegeEscalation",
+                            metadata={"rule": "allow_privilege_escalation", "file": filepath, "kind": kind, "name": name, "container": container_name},
+                        ))
+
+                    if security_context.get("runAsRoot") is True:
+                        findings.append(ContainerFinding(
+                            severity="high",
+                            title=f"Container '{container_name}' runs as root",
+                            description="runAsRoot: true allows container to run as root user",
+                            location=f"{filepath}:{kind}/{name}.spec.containers[{container_name}].securityContext.runAsRoot",
+                            metadata={"rule": "run_as_root", "file": filepath, "kind": kind, "name": name, "container": container_name},
+                        ))
+
+                    if security_context.get("privileged") is True:
+                        findings.append(ContainerFinding(
+                            severity="critical",
+                            title=f"Container '{container_name}' is privileged",
+                            description="Privileged containers have full access to host",
+                            location=f"{filepath}:{kind}/{name}.spec.containers[{container_name}].securityContext.privileged",
+                            metadata={"rule": "privileged_container", "file": filepath, "kind": kind, "name": name, "container": container_name},
+                        ))
+
+                    # capabilities
+                    caps = security_context.get("capabilities", {})
+                    if isinstance(caps, dict):
+                        add_caps = caps.get("add", [])
+                        if "ALL" in add_caps:
+                            findings.append(ContainerFinding(
+                                severity="high",
+                                title=f"Container '{container_name}' adds ALL capabilities",
+                                description="Adding ALL capabilities defeats container isolation",
+                                location=f"{filepath}:{kind}/{name}.spec.containers[{container_name}].securityContext.capabilities.add",
+                                metadata={"rule": "cap_add_all_k8s", "file": filepath, "kind": kind, "name": name, "container": container_name},
+                            ))
+
+                # Host network/PID/IPC
+                if template_spec.get("hostNetwork"):
+                    findings.append(ContainerFinding(
+                        severity="high",
+                        title=f"{kind} '{name}' uses hostNetwork",
+                        description="hostNetwork: true gives pod access to host network stack",
+                        location=f"{filepath}:{kind}/{name}.spec.hostNetwork",
+                        metadata={"rule": "host_network", "file": filepath, "kind": kind, "name": name},
+                    ))
+
+                if template_spec.get("hostPID"):
+                    findings.append(ContainerFinding(
+                        severity="high",
+                        title=f"{kind} '{name}' uses hostPID",
+                        description="hostPID: true gives pod access to host process namespace",
+                        location=f"{filepath}:{kind}/{name}.spec.hostPID",
+                        metadata={"rule": "host_pid", "file": filepath, "kind": kind, "name": name},
+                    ))
+
+                if template_spec.get("hostIPC"):
+                    findings.append(ContainerFinding(
+                        severity="high",
+                        title=f"{kind} '{name}' uses hostIPC",
+                        description="hostIPC: true gives pod access to host IPC namespace",
+                        location=f"{filepath}:{kind}/{name}.spec.hostIPC",
+                        metadata={"rule": "host_ipc", "file": filepath, "kind": kind, "name": name},
+                    ))
+
+                # Resource limits
+                for container in containers:
+                    resources = container.get("resources", {})
+                    limits = resources.get("limits", {})
+                    if not limits:
+                        findings.append(ContainerFinding(
+                            severity="medium",
+                            title=f"Container '{container.get('name', 'unknown')}' missing resource limits",
+                            description="Containers should have CPU/memory limits",
+                            location=f"{filepath}:{kind}/{name}.spec.containers[{container.get('name', 'unknown')}].resources.limits",
+                            metadata={"rule": "missing_resource_limits_k8s", "file": filepath, "kind": kind, "name": name, "container": container.get("name")},
+                        ))
+
+                # Secrets in configmaps/secrets (check for hardcoded values)
+                if kind in ("ConfigMap", "Secret"):
+                    data = doc.get("data", {})
+                    string_data = doc.get("stringData", {})
+                    all_data = {**data, **string_data}
+                    for key, value in all_data.items():
+                        if isinstance(value, str):
+                            for pattern, secret_type in self.SECRET_PATTERNS:
+                                if pattern.search(value):
+                                    findings.append(ContainerFinding(
+                                        severity="critical" if kind == "Secret" else "high",
+                                        title=f"Hardcoded {secret_type} in {kind} '{name}'",
+                                        description=f"Potential {secret_type} in {kind} data key '{key}'",
+                                        location=f"{filepath}:{kind}/{name}.data.{key}",
+                                        metadata={"rule": f"secret_in_{kind.lower()}", "file": filepath, "kind": kind, "name": name, "key": key, "type": secret_type},
+                                    ))
+
+        except yaml.YAMLError:
+            pass
+        return findings
+
+    def _analyze_helm_values(self, content: str, filepath: str) -> List[ContainerFinding]:
+        findings = []
+        try:
+            values = yaml.safe_load(content)
+            if not values or not isinstance(values, dict):
+                return findings
+
+            # Check for hardcoded secrets in values
+            def check_dict(d: dict, prefix: str = ""):
+                for key, value in d.items():
+                    full_key = f"{prefix}.{key}" if prefix else key
+                    if isinstance(value, str):
+                        for pattern, secret_type in self.SECRET_PATTERNS:
+                            if pattern.search(value):
+                                findings.append(ContainerFinding(
+                                    severity="critical",
+                                    title=f"Hardcoded {secret_type} in Helm values",
+                                    description=f"Potential {secret_type} in values.{full_key}",
+                                    location=f"{filepath}:{full_key}",
+                                    metadata={"rule": "secret_in_helm_values", "file": filepath, "key": full_key, "type": secret_type},
+                                ))
+                    elif isinstance(value, dict):
+                        check_dict(value, full_key)
+
+            check_dict(values)
+
+        except yaml.YAMLError:
+            pass
+        return findings
+
+    def _analyze_dockerignore(self, content: str, filepath: str) -> List[ContainerFinding]:
+        findings = []
+        lines = content.splitlines()
+        has_git = False
+        has_env = False
+        has_secrets = False
+
+        for line in lines:
+            stripped = line.strip()
+            if not stripped or stripped.startswith("#"):
+                continue
+            if ".git" in stripped:
+                has_git = True
+            if ".env" in stripped or "*.env" in stripped:
+                has_env = True
+            if any(s in stripped.lower() for s in ["secret", "key", "password", "token", "credential"]):
+                has_secrets = True
+
+        if not has_git:
+            findings.append(ContainerFinding(
+                severity="low",
+                title=".dockerignore missing .git exclusion",
+                description="Should exclude .git directory from build context",
+                location=filepath,
+                metadata={"rule": "dockerignore_missing_git", "file": filepath},
+            ))
+
+        if not has_env:
+            findings.append(ContainerFinding(
+                severity="medium",
+                title=".dockerignore missing .env exclusion",
+                description="Should exclude .env files from build context to prevent secret leakage",
+                location=filepath,
+                metadata={"rule": "dockerignore_missing_env", "file": filepath},
+            ))
+
+        return findings
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        filepath = ir.metadata.get("path", "unknown")
+
+        if self._should_exclude(filepath, config):
+            return EngineResult(engine=self.name, ok=True, metrics={"skipped": "excluded"})
+
+        file_type = self._detect_file_type(filepath)
+        if not file_type:
+            return EngineResult(engine=self.name, ok=True, metrics={"skipped": "not_container_file"})
+
+        try:
+            content = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            content = str(ir.content)
+
+        all_findings = []
+
+        # Scan for secrets in all file types
+        all_findings.extend(self._scan_secrets(content, filepath))
+
+        # Type-specific analysis
+        if file_type == "dockerfile":
+            all_findings.extend(self._analyze_dockerfile(content, filepath))
+        elif file_type == "docker_compose":
+            all_findings.extend(self._analyze_docker_compose(content, filepath))
+        elif file_type == "kubernetes":
+            all_findings.extend(self._analyze_kubernetes(content, filepath))
+        elif file_type == "helm":
+            all_findings.extend(self._analyze_helm_values(content, filepath))
+        elif file_type == "dockerignore":
+            all_findings.extend(self._analyze_dockerignore(content, filepath))
+
+        # Convert to Finding objects
+        findings = []
+        for f in all_findings:
+            # Only keep findings with confidence >= 0.85 (as per requirements)
+            # All our rules have high confidence
+            findings.append(Finding(
+                engine=self.name,
+                severity=f.severity,
+                title=f.title,
+                description=f.description,
+                location=f.location,
+                metadata=f.metadata,
+            ))
+
+        return EngineResult(
+            engine=self.name,
+            findings=findings,
+            ok=True,
+            metrics={
+                "file_type": file_type,
+                "file": filepath,
+                "findings_count": len(findings),
+            },
+        )
+
+
+Engine = ContainerEngine