mirror of
https://github.com/prowler-cloud/prowler.git
synced 2026-07-23 12:31:54 +00:00
Andoni Alonso
51 lines
2.0 KiB
Plaintext
51 lines
2.0 KiB
Plaintext
---
|
|
title: "Image Authentication in Prowler"
|
|
---
|
|
|
|
Prowler's Image provider enables container image security scanning using [Trivy](https://trivy.dev/). No authentication is required for public images. Prowler supports the following authentication methods for private registries:
|
|
|
|
* [**Basic Authentication (Environment Variables)**](https://trivy.dev/latest/docs/advanced/private-registries/docker-hub/): `REGISTRY_USERNAME` and `REGISTRY_PASSWORD`
|
|
* [**Token-Based Authentication**](https://distribution.github.io/distribution/spec/auth/token/): `REGISTRY_TOKEN`
|
|
* [**Manual Docker Login**](https://docs.docker.com/reference/cli/docker/login/): Existing credentials in Docker's credential store
|
|
|
|
Prowler uses the first available method in this priority order.
|
|
|
|
## Basic Authentication (Environment Variables)
|
|
|
|
To authenticate with a username and password, set the `REGISTRY_USERNAME` and `REGISTRY_PASSWORD` environment variables. Prowler passes these credentials to Trivy, which handles authentication with the registry transparently:
|
|
|
|
```bash
|
|
export REGISTRY_USERNAME="myuser"
|
|
export REGISTRY_PASSWORD="mypassword"
|
|
|
|
prowler image -I myregistry.io/myapp:v1.0
|
|
```
|
|
|
|
Both variables must be set for this method to activate.
|
|
|
|
## Token-Based Authentication
|
|
|
|
To authenticate using a registry token (such as a bearer or OAuth2 token), set the `REGISTRY_TOKEN` environment variable. Prowler passes the token directly to Trivy:
|
|
|
|
```bash
|
|
export REGISTRY_TOKEN="my-registry-token"
|
|
|
|
prowler image -I myregistry.io/myapp:v1.0
|
|
```
|
|
|
|
This method is useful for registries that support token-based access without requiring a username and password.
|
|
|
|
## Manual Docker Login (Fallback)
|
|
|
|
If no environment variables are set, Prowler relies on existing credentials in Docker's credential store (`~/.docker/config.json`). To configure credentials manually before scanning:
|
|
|
|
```bash
|
|
docker login myregistry.io
|
|
|
|
prowler image -I myregistry.io/myapp:v1.0
|
|
```
|
|
|
|
<Note>
|
|
This method is available in Prowler CLI only. In Prowler Cloud, use basic authentication or token-based authentication instead.
|
|
</Note>
|