Why I Prefer Podman 5.0 Over Docker 26 for DevSecOps Pipelines Using Trivy and Snyk

#!/bin/bash
# Podman 5.0 + Trivy DevSecOps Scan Script
# Requires: podman >=5.0.0, trivy >=0.50.0
# Usage: ./podman-trivy-scan.sh 

set -euo pipefail
trap 'echo "Error occurred at line $LINENO. Rolling back."; exit 1' ERR

# Configuration
REGISTRY="us-east1-docker.pkg.dev"
PROJECT_ID="prod-sec-pipeline-2024"
IMAGE_TAG="${1:?Error: Image tag is required. Usage: $0 }"
TRIVY_SEVERITY="HIGH,CRITICAL"
SCAN_REPORT_DIR="./scan-reports"
MAX_SCAN_RETRIES=3

# Validate dependencies
validate_deps() {
  echo "Validating dependencies..."
  if ! command -v podman &> /dev/null; then
    echo "Error: Podman 5.0+ is not installed."
    exit 1
  fi
  podman_version=$(podman --version | awk '{print $3}')
  if [[ "$(printf '%s\n' "5.0.0" "$podman_version" | sort -V | head -n1)" != "5.0.0" ]]; then
    echo "Error: Podman version must be >=5.0.0. Found: $podman_version"
    exit 1
  fi
  if ! command -v trivy &> /dev/null; then
    echo "Error: Trivy is not installed. Install from https://github.com/aquasecurity/trivy"
    exit 1
  fi
}

# Authenticate to registry (rootless, no daemon required)
auth_registry() {
  echo "Authenticating to $REGISTRY..."
  if ! podman login --username "${REGISTRY_USER:?Set REGISTRY_USER}" --password "${REGISTRY_PASSWORD:?Set REGISTRY_PASSWORD}" "$REGISTRY" &> /dev/null; then
    echo "Error: Registry authentication failed."
    exit 1
  fi
}

# Build image with Podman (rootless, no daemon)
build_image() {
  echo "Building image $IMAGE_TAG with Podman 5.0..."
  if ! podman build --pull-always --tag "$REGISTRY/$PROJECT_ID/$IMAGE_TAG:latest" --file ./Dockerfile 2>&1 | tee build.log; then
    echo "Error: Image build failed. Check build.log for details."
    exit 1
  fi
}

# Push image to registry
push_image() {
  echo "Pushing image to registry..."
  if ! podman push "$REGISTRY/$PROJECT_ID/$IMAGE_TAG:latest"; then
    echo "Error: Image push failed."
    exit 1
  fi
}

# Run Trivy scan with retries
run_trivy_scan() {
  echo "Running Trivy scan for $IMAGE_TAG..."
  mkdir -p "$SCAN_REPORT_DIR"
  local retry_count=0
  while [[ $retry_count -lt $MAX_SCAN_RETRIES ]]; do
    if trivy image --severity "$TRIVY_SEVERITY" --format json --output "$SCAN_REPORT_DIR/trivy-$IMAGE_TAG-$(date +%s).json" "$REGISTRY/$PROJECT_ID/$IMAGE_TAG:latest"; then
      echo "Trivy scan completed successfully."
      return 0
    else
      ((retry_count++))
      echo "Trivy scan failed. Retry $retry_count/$MAX_SCAN_RETRIES..."
      sleep 2
    fi
  done
  echo "Error: Trivy scan failed after $MAX_SCAN_RETRIES attempts."
  exit 1
}

# Main execution flow
validate_deps
auth_registry
build_image
push_image
run_trivy_scan

echo "Podman 5.0 + Trivy scan pipeline completed successfully for $IMAGE_TAG."

#!/usr/bin/env python3
"""
Podman 5.0 + Snyk Container Scan Integration
Requires: podman >=5.0.0, snyk >=1.1290.0, requests >=2.31.0
Usage: python3 podman-snyk-scan.py --image  --snyk-token 
"""

import argparse
import json
import logging
import os
import subprocess
import sys
import time
from pathlib import Path

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format="%(asctime)s - %(levelname)s - %(message)s"
)
logger = logging.getLogger(__name__)

# Configuration
SNYK_SEVERITY_THRESHOLD = "high"
SCAN_TIMEOUT = 300  # 5 minutes
REPORT_DIR = Path("./snyk-reports")

def validate_dependencies():
    """Check if required tools are installed and meet version requirements."""
    logger.info("Validating dependencies...")
    # Check Podman version
    try:
        podman_version_output = subprocess.run(
            ["podman", "--version"],
            capture_output=True,
            text=True,
            check=True
        ).stdout.strip()
        podman_version = podman_version_output.split()[-1]
        if tuple(map(int, podman_version.split("."))) < (5, 0, 0):
            logger.error(f"Podman version must be >=5.0.0. Found: {podman_version}")
            sys.exit(1)
    except subprocess.CalledProcessError:
        logger.error("Podman is not installed or not in PATH.")
        sys.exit(1)
    # Check Snyk
    try:
        subprocess.run(
            ["snyk", "--version"],
            capture_output=True,
            check=True
        )
    except subprocess.CalledProcessError:
        logger.error("Snyk CLI is not installed. Install from https://github.com/snyk/snyk")
        sys.exit(1)

def authenticate_snyk(snyk_token: str):
    """Authenticate Snyk with the provided API token."""
    logger.info("Authenticating Snyk...")
    try:
        subprocess.run(
            ["snyk", "auth", snyk_token],
            capture_output=True,
            text=True,
            check=True
        )
        logger.info("Snyk authentication successful.")
    except subprocess.CalledProcessError as e:
        logger.error(f"Snyk authentication failed: {e.stderr}")
        sys.exit(1)

def scan_image_with_snyk(image_tag: str):
    """Run Snyk container scan on the specified image."""
    logger.info(f"Scanning image {image_tag} with Snyk...")
    REPORT_DIR.mkdir(exist_ok=True)
    report_path = REPORT_DIR / f"snyk-{image_tag.replace('/', '_')}-{int(time.time())}.json"

    try:
        scan_result = subprocess.run(
            [
                "snyk", "container", "test",
                image_tag,
                "--severity-threshold", SNYK_SEVERITY_THRESHOLD,
                "--json",
                "--output", str(report_path)
            ],
            capture_output=True,
            text=True,
            timeout=SCAN_TIMEOUT
        )
        # Snyk returns non-zero exit code if vulnerabilities are found, which is expected
        if scan_result.returncode not in (0, 1):
            logger.error(f"Snyk scan failed: {scan_result.stderr}")
            sys.exit(1)
        # Parse report
        with open(report_path, "r") as f:
            report_data = json.load(f)
        vuln_count = len(report_data.get("vulnerabilities", []))
        logger.info(f"Scan complete. Found {vuln_count} vulnerabilities (severity >= {SNYK_SEVERITY_THRESHOLD}).")
        return report_data
    except subprocess.TimeoutExpired:
        logger.error(f"Snyk scan timed out after {SCAN_TIMEOUT} seconds.")
        sys.exit(1)
    except json.JSONDecodeError:
        logger.error("Failed to parse Snyk report JSON.")
        sys.exit(1)

def compare_with_docker(image_tag: str):
    """Run equivalent scan with Docker 26 for comparison (optional)."""
    logger.info("Running Docker 26 comparison scan (requires Docker installed)...")
    try:
        docker_scan = subprocess.run(
            ["docker", "scan", image_tag, "--severity", "high", "--json"],
            capture_output=True,
            text=True,
            timeout=SCAN_TIMEOUT
        )
        logger.info("Docker 26 scan completed. Comparison report saved to docker-scan.json")
        with open("docker-scan.json", "w") as f:
            f.write(docker_scan.stdout)
    except FileNotFoundError:
        logger.warning("Docker not installed. Skipping comparison.")
    except Exception as e:
        logger.warning(f"Docker comparison failed: {str(e)}")

def main():
    parser = argparse.ArgumentParser(description="Podman 5.0 + Snyk Container Scan")
    parser.add_argument("--image", required=True, help="Container image tag to scan")
    parser.add_argument("--snyk-token", required=True, help="Snyk API token")
    args = parser.parse_args()

    validate_dependencies()
    authenticate_snyk(args.snyk_token)
    scan_result = scan_image_with_snyk(args.image)
    compare_with_docker(args.image)

    # Output summary
    print("\n=== Scan Summary ===")
    print(f"Image: {args.image}")
    print(f"Vulnerabilities found: {len(scan_result.get('vulnerabilities', []))}")
    print(f"Report saved to: {REPORT_DIR}")

if __name__ == "__main__":
    main()

#!/bin/bash
# Benchmark: Podman 5.0 vs Docker 26 Scan Performance
# Requires: podman >=5.0.0, docker >=26.0.0, trivy >=0.50.0, snyk >=1.1290.0
# Usage: ./benchmark-scan-times.sh  

set -euo pipefail
trap 'echo "Benchmark error at line $LINENO. Cleaning up."; exit 1' ERR

# Configuration
IMAGE_TAG="${1:?Error: Image tag required. Usage: $0  }"
NUM_RUNS="${2:-100}"
TRIVY_SEVERITY="CRITICAL"
SNYK_SEVERITY="high"
RESULTS_DIR="./benchmark-results"
PODMAN_SCAN_LOG="$RESULTS_DIR/podman-scan-times.log"
DOCKER_SCAN_LOG="$RESULTS_DIR/docker-scan-times.log"
SUMMARY_REPORT="$RESULTS_DIR/benchmark-summary.md"

# Initialize results directory
mkdir -p "$RESULTS_DIR"
> "$PODMAN_SCAN_LOG"
> "$DOCKER_SCAN_LOG"

# Validate dependencies
validate_deps() {
  echo "Validating dependencies for benchmark..."
  for cmd in podman docker trivy snyk; do
    if ! command -v "$cmd" &> /dev/null; then
      echo "Error: $cmd is not installed."
      exit 1
    fi
  done
  # Check Podman version
  podman_ver=$(podman --version | awk '{print $3}')
  if [[ "$(printf '%s\n' "5.0.0" "$podman_ver" | sort -V | head -n1)" != "5.0.0" ]]; then
    echo "Error: Podman must be >=5.0.0. Found: $podman_ver"
    exit 1
  fi
  # Check Docker version
  docker_ver=$(docker --version | awk '{print $3}' | tr -d ',')
  if [[ "$(printf '%s\n' "26.0.0" "$docker_ver" | sort -V | head -n1)" != "26.0.0" ]]; then
    echo "Error: Docker must be >=26.0.0. Found: $docker_ver"
    exit 1
  fi
}

# Run Podman 5.0 Trivy scans
run_podman_benchmark() {
  echo "Running $NUM_RUNS Podman 5.0 Trivy scans..."
  for ((i=1; i<=NUM_RUNS; i++)); do
    echo "Podman scan run $i/$NUM_RUNS..."
    start_time=$(date +%s%3N)  # Milliseconds
    if trivy image --severity "$TRIVY_SEVERITY" --quiet "$IMAGE_TAG" &> /dev/null; then
      end_time=$(date +%s%3N)
      elapsed=$((end_time - start_time))
      echo "$elapsed" >> "$PODMAN_SCAN_LOG"
    else
      echo "Error: Podman scan run $i failed."
      exit 1
    fi
  done
}

# Run Docker 26 Trivy scans
run_docker_benchmark() {
  echo "Running $NUM_RUNS Docker 26 Trivy scans..."
  for ((i=1; i<=NUM_RUNS; i++)); do
    echo "Docker scan run $i/$NUM_RUNS..."
    start_time=$(date +%s%3N)
    if docker scan "$IMAGE_TAG" --severity "$TRIVY_SEVERITY" --quiet &> /dev/null; then
      end_time=$(date +%s%3N)
      elapsed=$((end_time - start_time))
      echo "$elapsed" >> "$DOCKER_SCAN_LOG"
    else
      echo "Error: Docker scan run $i failed."
      exit 1
    fi
  done
}

# Calculate statistics
calculate_stats() {
  echo "Calculating benchmark statistics..."
  # Podman stats
  podman_avg=$(awk '{sum+=$1} END {print sum/NR}' "$PODMAN_SCAN_LOG")
  podman_min=$(sort -n "$PODMAN_SCAN_LOG" | head -n1)
  podman_max=$(sort -n "$PODMAN_SCAN_LOG" | tail -n1)
  # Docker stats
  docker_avg=$(awk '{sum+=$1} END {print sum/NR}' "$DOCKER_SCAN_LOG")
  docker_min=$(sort -n "$DOCKER_SCAN_LOG" | head -n1)
  docker_max=$(sort -n "$DOCKER_SCAN_LOG" | tail -n1)
  # Calculate improvement
  improvement=$(echo "scale=2; (($docker_avg - $podman_avg)/$docker_avg)*100" | bc)
  # Write summary report
  cat > "$SUMMARY_REPORT" << EOF
# Podman 5.0 vs Docker 26 Scan Benchmark Results
## Configuration
- Image: $IMAGE_TAG
- Number of runs: $NUM_RUNS
- Scan tool: Trivy (severity: $TRIVY_SEVERITY)
- Podman version: $(podman --version | awk '{print $3}')
- Docker version: $(docker --version | awk '{print $3}')

## Results
| Metric                | Podman 5.0 | Docker 26 |
|-----------------------|------------|-----------|
| Average scan time (ms) | $podman_avg | $docker_avg |
| Min scan time (ms)     | $podman_min | $docker_min |
| Max scan time (ms)     | $podman_max | $docker_max |
| Improvement            | -          | ${improvement}% faster |

## Conclusion
Podman 5.0 scans are on average ${improvement}% faster than Docker 26 for critical vulnerability scans.
EOF
  echo "Summary report saved to $SUMMARY_REPORT"
  cat "$SUMMARY_REPORT"
}

# Main execution
validate_deps
run_podman_benchmark
run_docker_benchmark
calculate_stats

echo "Benchmark completed successfully."