Skip to main content
Version: v3.8 (deprecated)

Gitlab

This is an example of how to build and test a Dockerized web application on Gitlab. The image can later be pushed to any remote registry of choice.

Configure environment variables on Gitlab

The following environment variables must be set for the project on Gitlab via the project settings (i.e Project > Settings > CI/CD > Variables) page, before the project can be built successfully.

VariableDescription
DEEPFENCE_CONSOLE_URLDeepfence management console url
FAIL_CVE_COUNTFail the build if number of vulnerabilities found >= this value. Set -1 to pass regardless of vulnerabilities.
FAIL_CRITICAL_CVE_COUNTFail the build if number of critical vulnerabilities found >= this value. Set -1 to pass regardless of critical vulnerabilities.
FAIL_HIGH_CVE_COUNTFail the build if number of high vulnerabilities found >= this value. Set -1 to pass regardless of high vulnerabilities.
FAIL_MEDIUM_CVE_COUNTFail the build if number of medium vulnerabilities found >= this value. Set -1 to pass regardless of medium vulnerabilities.
FAIL_LOW_CVE_COUNTFail the build if number of low vulnerabilities found >= this value. Set -1 to pass regardless of low vulnerabilities.
FAIL_CVE_SCOREFail the build if cumulative CVE score is >= this value. Set -1 to pass regardless of cve score.

Sample Gitlab CI YAML

stages:
- test-docker-build

test-docker-build:
image: docker:latest
stage: test-docker-build
services:
- docker:dind
variables:
IMAGE_NAME: go-server-test:latest
DEEPFENCE_KEY: ""
DEEPFENCE_CONSOLE_URL: 127.0.0.1
FAIL_CVE_COUNT: 100
FAIL_CRITICAL_CVE_COUNT: 1000
FAIL_HIGH_CVE_COUNT: 10
FAIL_MEDIUM_CVE_COUNT: 1000
FAIL_LOW_CVE_COUNT: 1000
FAIL_CVE_SCORE: -1
script:
- docker build -t $IMAGE_NAME .
- docker pull quay.io/deepfenceio/deepfence_package_scanner:3.8.0
- docker run -i --rm --net=host --privileged=true -v /var/run/docker.sock:/var/run/docker.sock:rw quay.io/deepfenceio/deepfence_package_scanner:3.8.0 -source"$IMAGE_NAME" -console-url=$DEEPFENCE_CONSOLE_URL -deepfence-key=$DEEPFENCE_KEY -fail-on-count=$FAIL_CVE_COUNT -fail-on-critical-count=$FAIL_CRITICAL_CVE_COUNT -fail-on-high-count=$FAIL_HIGH_CVE_COUNT -fail-on-medium-count=$FAIL_MEDIUM_CVE_COUNT -fail-on-low-count=$FAIL_LOW_CVE_COUNT -fail-on-score=$FAIL_CVE_SCORE -scan-type="base,java,python,ruby,php,nodejs,js,dotnet"

References