Pre-built Docker Base Images for Repo Integrations

Overview

With the pre-built Docker images for self-hosted Repo Integrations, Mend.io allows you to avoid the need to fully build your own images. This will speed up the time to adopt or upgrade the Repo Integration, and generally provide a better user experience in that regard.

Mend.io distributes its Repo Integrations in the form of Dockerfiles. As a customer of the repo integration, you are typically required to build three images:

• App/Controller

• Scanner

• Remediate

The Scanner and Remediate images in particular can be multiple gigabytes in size and present a challenge to build, primarily if any of the public sites for package managers are even partially unavailable, in which case you might be blocked from building the image.

While some companies may prefer to customize Mend.io’s Dockerfiles and build them from scratch, others may prefer a “prebuilt” approach, where the Open Source part of Mend.io’s images (e.g., languages and package managers) are available prebuilt so that the building part will consist of downloading the majority from Docker Hub and building the rest online.

Getting it done

The pre-built solution splits each service’s Dockerfile into two parts:

1. Base image (public): Contains the shared, open-source installations: languages, package managers, and other third-party tooling the scanner needs to support different file types. Base images contain no Mend.io code or data. Their Dockerfiles are published at https://github.com/mend/docker-base-images so you can review exactly what they contain, and the built images are published to Docker Hub: https://hub.docker.com/u/mend

2. Final Dockerfile (in your distribution): A much shorter Dockerfile tied to the Mend.io service itself. Instead of installing everything from scratch, it builds FROM the relevant public base image. These final Dockerfiles are included in the Repo Integration distribution package you receive from Mend.io; there is nothing to download separately.

The pre-built SCA and SAST scanner components are also included in the distribution package. Building with the pre-built Dockerfiles does not require reaching out to public package-manager or language download sites; the only external pull is the base image from Docker Hub.

If you prefer full control over package versions, the standard (non-pre-built) distribution still provides the combined Dockerfiles you can customize and build from scratch.

Limitations

• Pre-built Dockerfiles are currently available for the GitHub Enterprise App only.

  

  
  

• Some tools are intentionally excluded from the pre-built images (for example, Helm and Checkov). If you need them, use the standard distribution and build from the full Dockerfiles.