Setting up a Maven project for container images

Go to the Jenkins top page.

Create a new project.

Click
New Item
.
In
Item
name, enter a name for your project.
Select
Maven project
.
Click
OK
.

Add a build step.

Scroll down to the

Pre steps

section.

In the

Add pre-build step

drop-down list, select

Execute shell

.



In the

Command

text box, enter the following:

echo "Creating Dockerfile..."
echo "FROM imiell/bad-dockerfile:latest" > Dockerfile
echo 'docker build --no-cache -t test/test-image:0.1 .' > build_image.sh
chmod +x build_image.sh

echo "Creating POM file..."
cat > pom.xml << EOF
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>groupId</groupId>
  <artifactId>artifactid</artifactId>
  <version>1.0-SNAPSHOT</version>
  <packaging>jar</packaging>
  <name>projectName</name>
  <properties>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
  </properties>
  <build>

    <plugins>
      <plugin>
        <artifactId>exec-maven-plugin</artifactId>
        <groupId>org.codehaus.mojo</groupId>
        <executions>
          <execution>
            <id>Build Image</id>
            <phase>generate-sources</phase>
            <goals>
              <goal>exec</goal>
            </goals>
            <configuration>
              <executable>build_image.sh</executable>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>
</project>
EOF

Add a build step that scans the container image(s) for vulnerabilities.

In the
Add build step
drop-down list, select
Scan Prisma Cloud Images
.
In the
Image
field, select the image to scan by specifying the repository and tag.
Use pattern matching expressions. For example, enter test/test-image*.
If the image you want to scan is created outside of this build, or if you want to scan the image every build, even if the build might not generate an new image, then click
Advanced
, and select
Ignore image creation time
.

Add a post-build action so that image scan results in Jenkins directly.

This post-build step depends on a file generated by the previous scan build step, which holds the scan results. This step specifically makes the results available for review in the Jenkins build tool. Note that the previous scan step already published the results in Console, and they’re ready to be reviewed there.

Scroll down to
Post-build Actions
.
In the
Add post-build action
drop-down menu, select
Publish Prisma Cloud analysis results
.
In the
Scan Result Files
field, accept the default.
Scan result files aren’t deleted by the publish step. They stay in the workspace.

Click

Save

.

Click

Build Now

.

After the build completes, examine the results. Scan reports are available in the following locations:

Prisma Cloud Console: Log into Console, and go to

Monitor > Vulnerabilities > Images > CI

.

Jenkins: Drill down into the build job, then click

Image Vulnerabilities

to see a detailed report.