Examples

Custom Policy

Kubernetes

See here.

The custom policy is defined in user.kubernetes.ID001 package. You need to pass the package prefix you want to evaluate through --namespaces option. In this case, the package prefix should be user, user.kuberntes, or user.kubernetes.ID001.

Dockerfile

See here.

The input will be a dictionary of stages.

Single Stage

Example

Dockerfile

  1. FROM foo
  2. COPY . /
  3. RUN echo hello

Rego Input

  1. {
  2.     "stages": {
  3.         "foo": [
  4.             {
  5.                 "Cmd": "from",
  6.                 "EndLine": 1,
  7.                 "Flags": [],
  8.                 "JSON": false,
  9.                 "Original": "FROM foo",
  10.                 "Stage": 0,
  11.                 "StartLine": 1,
  12.                 "SubCmd": "",
  13.                 "Value": [
  14.                     "foo"
  15.                 ]
  16.             },
  17.             {
  18.                 "Cmd": "copy",
  19.                 "EndLine": 2,
  20.                 "Flags": [],
  21.                 "JSON": false,
  22.                 "Original": "COPY . /",
  23.                 "Stage": 0,
  24.                 "StartLine": 2,
  25.                 "SubCmd": "",
  26.                 "Value": [
  27.                     ".",
  28.                     "/"
  29.                 ]
  30.             },
  31.             {
  32.                 "Cmd": "run",
  33.                 "EndLine": 3,
  34.                 "Flags": [],
  35.                 "JSON": false,
  36.                 "Original": "RUN echo hello",
  37.                 "Stage": 0,
  38.                 "StartLine": 3,
  39.                 "SubCmd": "",
  40.                 "Value": [
  41.                     "echo hello"
  42.                 ]
  43.             }
  44.         ]
  45.     }
  46. }

Multi Stage

Example

Dockerfile

  1. FROM golang:1.16 AS builder
  2. WORKDIR /go/src/github.com/alexellis/href-counter/
  3. RUN go get -d -v golang.org/x/net/html
  4. COPY app.go .
  5. RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .
  7. FROM alpine:latest
  8. RUN apk --no-cache add ca-certificates \
  9. && apk add --no-cache bash
  10. WORKDIR /root/
  11. COPY --from=builder /go/src/github.com/alexellis/href-counter/app .
  12. CMD ["./app"]

Rego Input

  1. {
  2.     "stages": {
  3.         "alpine:latest": [
  4.             {
  5.                 "Cmd": "from",
  6.                 "EndLine": 7,
  7.                 "Flags": [],
  8.                 "JSON": false,
  9.                 "Original": "FROM alpine:latest",
  10.                 "Stage": 1,
  11.                 "StartLine": 7,
  12.                 "SubCmd": "",
  13.                 "Value": [
  14.                     "alpine:latest"
  15.                 ]
  16.             },
  17.             {
  18.                 "Cmd": "run",
  19.                 "EndLine": 9,
  20.                 "Flags": [],
  21.                 "JSON": false,
  22.                 "Original": "RUN apk --no-cache add ca-certificates     \u0026\u0026 apk add --no-cache bash",
  23.                 "Stage": 1,
  24.                 "StartLine": 8,
  25.                 "SubCmd": "",
  26.                 "Value": [
  27.                     "apk --no-cache add ca-certificates     \u0026\u0026 apk add --no-cache bash"
  28.                 ]
  29.             },
  30.             {
  31.                 "Cmd": "workdir",
  32.                 "EndLine": 10,
  33.                 "Flags": [],
  34.                 "JSON": false,
  35.                 "Original": "WORKDIR /root/",
  36.                 "Stage": 1,
  37.                 "StartLine": 10,
  38.                 "SubCmd": "",
  39.                 "Value": [
  40.                     "/root/"
  41.                 ]
  42.             },
  43.             {
  44.                 "Cmd": "copy",
  45.                 "EndLine": 11,
  46.                 "Flags": [
  47.                     "--from=builder"
  48.                 ],
  49.                 "JSON": false,
  50.                 "Original": "COPY --from=builder /go/src/github.com/alexellis/href-counter/app .",
  51.                 "Stage": 1,
  52.                 "StartLine": 11,
  53.                 "SubCmd": "",
  54.                 "Value": [
  55.                     "/go/src/github.com/alexellis/href-counter/app",
  56.                     "."
  57.                 ]
  58.             },
  59.             {
  60.                 "Cmd": "cmd",
  61.                 "EndLine": 12,
  62.                 "Flags": [],
  63.                 "JSON": true,
  64.                 "Original": "CMD [\"./app\"]",
  65.                 "Stage": 1,
  66.                 "StartLine": 12,
  67.                 "SubCmd": "",
  68.                 "Value": [
  69.                     "./app"
  70.                 ]
  71.             }
  72.         ],
  73.         "golang:1.16 AS builder": [
  74.             {
  75.                 "Cmd": "from",
  76.                 "EndLine": 1,
  77.                 "Flags": [],
  78.                 "JSON": false,
  79.                 "Original": "FROM golang:1.16 AS builder",
  80.                 "Stage": 0,
  81.                 "StartLine": 1,
  82.                 "SubCmd": "",
  83.                 "Value": [
  84.                     "golang:1.16",
  85.                     "AS",
  86.                     "builder"
  87.                 ]
  88.             },
  89.             {
  90.                 "Cmd": "workdir",
  91.                 "EndLine": 2,
  92.                 "Flags": [],
  93.                 "JSON": false,
  94.                 "Original": "WORKDIR /go/src/github.com/alexellis/href-counter/",
  95.                 "Stage": 0,
  96.                 "StartLine": 2,
  97.                 "SubCmd": "",
  98.                 "Value": [
  99.                     "/go/src/github.com/alexellis/href-counter/"
  100.                 ]
  101.                 },
  102.             {
  103.                 "Cmd": "run",
  104.                 "EndLine": 3,
  105.                 "Flags": [],
  106.                 "JSON": false,
  107.                 "Original": "RUN go get -d -v golang.org/x/net/html",
  108.                 "Stage": 0,
  109.                 "StartLine": 3,
  110.                 "SubCmd": "",
  111.                 "Value": [
  112.                     "go get -d -v golang.org/x/net/html"
  113.                 ]
  114.             },
  115.             {
  116.                 "Cmd": "copy",
  117.                 "EndLine": 4,
  118.                 "Flags": [],
  119.                 "JSON": false,
  120.                 "Original": "COPY app.go .",
  121.                 "Stage": 0,
  122.                 "StartLine": 4,
  123.                 "SubCmd": "",
  124.                 "Value": [
  125.                     "app.go",
  126.                     "."
  127.                 ]
  128.             },
  129.             {
  130.                 "Cmd": "run",
  131.                 "EndLine": 5,
  132.                 "Flags": [],
  133.                 "JSON": false,
  134.                 "Original": "RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .",
  135.                 "Stage": 0,
  136.                 "StartLine": 5,
  137.                 "SubCmd": "",
  138.                 "Value": [
  139.                     "CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app ."
  140.                 ]
  141.             }
  142.         ]
  143.     }
  144. }

Docker Compose

See here.

Docker Compose uses YAML format for configurations. You can apply your Rego policies to docker-compose.yml.

HCL

See here.

Trivy parses HCL files and converts into structured data.

Warning

Terraform HCL files are not supported yet.

Terraform Plan

See here.

Use the command terraform show to convert the Terraform plan into JSON so that OPA can read the plan.

  1. $ terraform init
  2. $ terraform plan --out tfplan.binary
  3. $ terraform show -json tfplan.binary > tfplan.json

For more details, see also OPA document.

Serverless Framework

See here.

Server Framework uses YAML format for configurations. You can apply your Rego policies to serverless.yaml.

Custom Data

See here.

Combined Input

See here.

Go Testing

See here.