Deploy using Docker Compose
In this topic, you’ll learn how to use Docker Compose to get up and running with a stand-alone Anchore Enterprise deployment.
Note
Docker Compose is only recommended for testing (e.g. demo or proof-of-concept) or small deployments (less than 100 images). For all other usage patterns, customers should use a Helm-based deployment on K8s which enables easier scaling, modular deployment and fine-grained configuration.This document is intended to serve as a quickstart guide. Before moving further with Anchore Enterprise, it is highly recommended to read the Overview sections to gain a deeper understanding of fundamentals, concepts, and proper usage.
Quicklinks
(Optional) Prometheus Configuration File for Monitoring. See Enabling Prometheus Monitoring
(Optional) Swagger UI Nginx Proxy to browse the API with a Swagger UI. See Enabling Swagger UI
Before You Start
The following instructions assume you are using a system running Docker v1.12 or higher, and a version of Docker Compose that supports at least v2 of the docker compose configuration format.
- A stand-alone deployment requires at least 16GB of RAM, and enough disk space available to support the largest container images or source repositories that you intend to analyze. It is recommended to consider three times the largest source repository or container image size. For small testing, like basic Linux distro images or database images, between 20GB and 40GB of disk space should be sufficient.
- To access Anchore Enterprise, you need a valid
license.yamlfile that has been issued to you by Anchore. If you do not have a license yet, visit the Anchore Contact page to request one.
Getting Started
Follow the steps below to get up and running!
Step 1: Check access to images
You’ll need authenticated access to the anchore/enterprise and anchore/enterprise-ui repositories on DockerHub. Anchore Customer Success will provide a Dockerhub PAT (Personal Access Token) for access to images. Login with your Docker PAT to push and pull images from Docker Hub:
# docker login -u <your_dockerhub_pat_user> -p <your_dockerhub_pat>
Step 2: Configure & run
Download the Docker Compose File into a working directory where you have also placed the license.yaml file you got from Anchore.
# curl https://docs.anchore.com/current/docs/deployment/docker_compose/docker-compose.yaml > docker-compose.yaml
# cp <path/to/your/license.yaml> ./license.yaml
Edit the compose file to set all instances of ANCHORE_ADMIN_PASSWORD to a strong password of your choice.
- ANCHORE_ADMIN_PASSWORD=yourstrongpassword
Note
The admin password value must be the same across all services defined in the compose file.Then start your environment from your working directory:
# docker compose up -d
Step 3: Install AnchoreCTL
Next, we’ll install the lightweight Anchore Enterprise client tool, quickly test using the version operation, and set up a few environment variables to allow it to interact with your quickstart deployment using the admin password you defined in the previous step.
# curl -sSfL https://anchorectl-releases.anchore.io/anchorectl/install.sh | sh -s -- -b /usr/local/bin v5.13.0
# ./anchorectl version
Application: anchorectl
Version: 5.13.0
SyftVersion: v0.97.1
BuildDate: 2023-11-21T22:09:54Z
GitCommit: f7604438b45f7161c11145999897d4ae3efcb0c8
GitDescription: v5.13.0
Platform: linux/amd64
GoVersion: go1.21.1
Compiler: gc
# export ANCHORECTL_URL="http://localhost:8228"
# export ANCHORECTL_USERNAME="admin"
# export ANCHORECTL_PASSWORD="yourstrongpassword"
NOTE: for this quickstart, we’re installing the tool in your local directory ./ and will be using environment variables throughout. To more permanently install and configure anchorectl to remove the need for setting environment variables and putting the tool in a globally accessible path, see Installing AnchoreCTL.
Step 4: Verify service availability
After a few minutes (depending on system speed) Anchore Enterprise and Anchore UI services should be up and running, ready to use. You can verify the containers are running with docker compose, as shown in the following example.
# docker compose ps
Name Command State Ports
-------------------------------------------------------------------------------------------------------
anchorequickstart_analyzer_1 /docker-entrypoint.sh anch ... Up (healthy) 8228/tcp
anchorequickstart_anchore-db_1 docker-entrypoint.sh postgres Up 5432/tcp
anchorequickstart_api_1 /docker-entrypoint.sh anch ... Up (healthy) 0.0.0.0:8228->8228/tcp
anchorequickstart_catalog_1 /docker-entrypoint.sh anch ... Up (healthy) 8228/tcp
anchorequickstart_data-syncer_1 /docker-entrypoint.sh anch ... Up (healthy) 0.0.0.0:8778->8228/tcp
anchorequickstart_notifications_1 /docker-entrypoint.sh anch ... Up (healthy) 0.0.0.0:8668->8228/tcp
anchorequickstart_policy-engine_1 /docker-entrypoint.sh anch ... Up (healthy) 8228/tcp
anchorequickstart_queue_1 /docker-entrypoint.sh anch ... Up (healthy) 8228/tcp
anchorequickstart_reports_1 /docker-entrypoint.sh anch ... Up (healthy) 0.0.0.0:8558->8228/tcp
anchorequickstart_reports_worker_1 /docker-entrypoint.sh anch ... Up (healthy) 0.0.0.0:55427->8228/tcp
anchorequickstart_ui-redis_1 docker-entrypoint.sh redis ... Up 6379/tcp
anchorequickstart_ui_1 /docker-entrypoint.sh node ... Up 0.0.0.0:3000->3000/tcp
You can then run a command to get the status of the Anchore Enterprise services:
# ./anchorectl system status
✔ Status system
┌─────────────────┬────────────────────┬─────────────────────────────┬──────┬────────────────┬────────────┬──────────────┐
│ SERVICE │ HOST ID │ URL │ UP │ STATUS MESSAGE │ DB VERSION │ CODE VERSION │
├─────────────────┼────────────────────┼─────────────────────────────┼──────┼────────────────┼────────────┼──────────────┤
│ analyzer │ anchore-quickstart │ http://analyzer:8228 │ true │ available │ 5130 │ 5.13.0 │
│ policy_engine │ anchore-quickstart │ http://policy-engine:8228 │ true │ available │ 5130 │ 5.13.0 │
│ apiext │ anchore-quickstart │ http://api:8228 │ true │ available │ 5130 │ 5.13.0 │
│ reports │ anchore-quickstart │ http://reports:8228 │ true │ available │ 5130 │ 5.13.0 │
│ reports_worker │ anchore-quickstart │ http://reports-worker:8228 │ true │ available │ 5130 │ 5.13.0 │
│ data_syncer │ anchore-quickstart │ http://data-syncer:8228 │ true │ available | 5130 │ 5.13.0 │
│ simplequeue │ anchore-quickstart │ http://queue:8228 │ true │ available │ 5130 │ 5.13.0 │
│ notifications │ anchore-quickstart │ http://notifications:8228 │ true │ available │ 5130 │ 5.13.0 │
│ catalog │ anchore-quickstart │ http://catalog:8228 │ true │ available │ 5130 │ 5.13.0 │
└─────────────────┴────────────────────┴─────────────────────────────┴──────┴────────────────┴────────────┴──────────────┘
Note: The first time you run Anchore Enterprise, vulnerability data will sync to the system in a few minutes.
For the best experience, wait until the core vulnerability data feeds have completed before proceeding.
You can check the status of your feed sync using AnchoreCTL:
# ./anchorectl feed list
✔ List feed
┌────────────────────────────────────────────┬────────────────────┬─────────┬──────────────────────┬──────────────┐
│ FEED │ GROUP │ ENABLED │ LAST UPDATED │ RECORD COUNT │
├────────────────────────────────────────────┼────────────────────┼─────────┼──────────────────────┼──────────────┤
│ ClamAV Malware Database │ clamav_db │ true │ 2024-09-30T18:06:05Z │ 1 │
│ Vulnerabilities │ github:composer │ true │ 2024-09-30T18:12:03Z │ 4040 │
│ Vulnerabilities │ github:dart │ true │ 2024-09-30T18:12:03Z │ 8 │
│ Vulnerabilities │ github:gem │ true │ 2024-09-30T18:12:03Z │ 817 │
│ Vulnerabilities │ github:go │ true │ 2024-09-30T18:12:03Z │ 1879 │
│ Vulnerabilities │ github:java │ true │ 2024-09-30T18:12:03Z │ 5060 │
│ Vulnerabilities │ github:npm │ true │ 2024-09-30T18:12:03Z │ 15619 │
│ Vulnerabilities │ github:nuget │ true │ 2024-09-30T18:12:03Z │ 624 │
│ Vulnerabilities │ github:python │ true │ 2024-09-30T18:12:03Z │ 3229 │
│ Vulnerabilities │ github:rust │ true │ 2024-09-30T18:12:03Z │ 804 │
│ Vulnerabilities │ github:swift │ true │ 2024-09-30T18:12:03Z │ 32 │
│ Vulnerabilities │ msrc:10378 │ true │ 2024-09-30T18:12:16Z │ 2668 │
│ Vulnerabilities │ msrc:10379 │ true │ 2024-09-30T18:12:16Z │ 2645 │
│ Vulnerabilities │ msrc:10481 │ true │ 2024-09-30T18:12:16Z │ 1951 │
│ Vulnerabilities │ msrc:10482 │ true │ 2024-09-30T18:12:16Z │ 2028 │
│ Vulnerabilities │ msrc:10483 │ true │ 2024-09-30T18:12:16Z │ 2822 │
│ Vulnerabilities │ msrc:10484 │ true │ 2024-09-30T18:12:16Z │ 1934 │
│ Vulnerabilities │ msrc:10543 │ true │ 2024-09-30T18:12:16Z │ 2796 │
│ Vulnerabilities │ msrc:10729 │ true │ 2024-09-30T18:12:16Z │ 2908 │
│ Vulnerabilities │ msrc:10735 │ true │ 2024-09-30T18:12:16Z │ 3006 │
│ Vulnerabilities │ msrc:10788 │ true │ 2024-09-30T18:12:16Z │ 466 │
│ Vulnerabilities │ msrc:10789 │ true │ 2024-09-30T18:12:16Z │ 437 │
│ Vulnerabilities │ msrc:10816 │ true │ 2024-09-30T18:12:16Z │ 3328 │
│ Vulnerabilities │ msrc:10852 │ true │ 2024-09-30T18:12:16Z │ 3043 │
│ Vulnerabilities │ msrc:10853 │ true │ 2024-09-30T18:12:16Z │ 3167 │
│ Vulnerabilities │ msrc:10855 │ true │ 2024-09-30T18:12:16Z │ 3300 │
│ Vulnerabilities │ msrc:10951 │ true │ 2024-09-30T18:12:16Z │ 716 │
│ Vulnerabilities │ msrc:10952 │ true │ 2024-09-30T18:12:16Z │ 766 │
│ Vulnerabilities │ msrc:11453 │ true │ 2024-09-30T18:12:16Z │ 1240 │
│ Vulnerabilities │ msrc:11454 │ true │ 2024-09-30T18:12:16Z │ 1290 │
│ Vulnerabilities │ msrc:11466 │ true │ 2024-09-30T18:12:16Z │ 395 │
│ Vulnerabilities │ msrc:11497 │ true │ 2024-09-30T18:12:16Z │ 1454 │
│ Vulnerabilities │ msrc:11498 │ true │ 2024-09-30T18:12:16Z │ 1514 │
│ Vulnerabilities │ msrc:11499 │ true │ 2024-09-30T18:12:16Z │ 981 │
│ Vulnerabilities │ msrc:11563 │ true │ 2024-09-30T18:12:16Z │ 1344 │
│ Vulnerabilities │ msrc:11568 │ true │ 2024-09-30T18:12:16Z │ 2993 │
│ Vulnerabilities │ msrc:11569 │ true │ 2024-09-30T18:12:16Z │ 3095 │
│ Vulnerabilities │ msrc:11570 │ true │ 2024-09-30T18:12:16Z │ 2900 │
│ Vulnerabilities │ msrc:11571 │ true │ 2024-09-30T18:12:16Z │ 3266 │
│ Vulnerabilities │ msrc:11572 │ true │ 2024-09-30T18:12:16Z │ 3238 │
│ Vulnerabilities │ msrc:11583 │ true │ 2024-09-30T18:12:16Z │ 1038 │
│ Vulnerabilities │ msrc:11644 │ true │ 2024-09-30T18:12:16Z │ 1054 │
│ Vulnerabilities │ msrc:11645 │ true │ 2024-09-30T18:12:16Z │ 1089 │
│ Vulnerabilities │ msrc:11646 │ true │ 2024-09-30T18:12:16Z │ 1055 │
│ Vulnerabilities │ msrc:11647 │ true │ 2024-09-30T18:12:16Z │ 1074 │
│ Vulnerabilities │ msrc:11712 │ true │ 2024-09-30T18:12:16Z │ 1442 │
│ Vulnerabilities │ msrc:11713 │ true │ 2024-09-30T18:12:16Z │ 1491 │
│ Vulnerabilities │ msrc:11714 │ true │ 2024-09-30T18:12:16Z │ 1447 │
│ Vulnerabilities │ msrc:11715 │ true │ 2024-09-30T18:12:16Z │ 999 │
│ Vulnerabilities │ msrc:11766 │ true │ 2024-09-30T18:12:16Z │ 912 │
│ Vulnerabilities │ msrc:11767 │ true │ 2024-09-30T18:12:16Z │ 915 │
│ Vulnerabilities │ msrc:11768 │ true │ 2024-09-30T18:12:16Z │ 940 │
│ Vulnerabilities │ msrc:11769 │ true │ 2024-09-30T18:12:16Z │ 934 │
│ Vulnerabilities │ msrc:11800 │ true │ 2024-09-30T18:12:16Z │ 382 │
│ Vulnerabilities │ msrc:11801 │ true │ 2024-09-30T18:12:16Z │ 1277 │
│ Vulnerabilities │ msrc:11802 │ true │ 2024-09-30T18:12:16Z │ 1277 │
│ Vulnerabilities │ msrc:11803 │ true │ 2024-09-30T18:12:16Z │ 981 │
│ Vulnerabilities │ msrc:11896 │ true │ 2024-09-30T18:12:16Z │ 792 │
│ Vulnerabilities │ msrc:11897 │ true │ 2024-09-30T18:12:16Z │ 762 │
│ Vulnerabilities │ msrc:11898 │ true │ 2024-09-30T18:12:16Z │ 763 │
│ Vulnerabilities │ msrc:11923 │ true │ 2024-09-30T18:12:16Z │ 1733 │
│ Vulnerabilities │ msrc:11924 │ true │ 2024-09-30T18:12:16Z │ 1726 │
│ Vulnerabilities │ msrc:11926 │ true │ 2024-09-30T18:12:16Z │ 1536 │
│ Vulnerabilities │ msrc:11927 │ true │ 2024-09-30T18:12:16Z │ 1503 │
│ Vulnerabilities │ msrc:11929 │ true │ 2024-09-30T18:12:16Z │ 1433 │
│ Vulnerabilities │ msrc:11930 │ true │ 2024-09-30T18:12:16Z │ 1429 │
│ Vulnerabilities │ msrc:11931 │ true │ 2024-09-30T18:12:16Z │ 1474 │
│ Vulnerabilities │ msrc:12085 │ true │ 2024-09-30T18:12:16Z │ 1044 │
│ Vulnerabilities │ msrc:12086 │ true │ 2024-09-30T18:12:16Z │ 1053 │
│ Vulnerabilities │ msrc:12097 │ true │ 2024-09-30T18:12:16Z │ 964 │
│ Vulnerabilities │ msrc:12098 │ true │ 2024-09-30T18:12:16Z │ 939 │
│ Vulnerabilities │ msrc:12099 │ true │ 2024-09-30T18:12:16Z │ 943 │
│ Vulnerabilities │ nvd │ true │ 2024-09-30T18:12:10Z │ 264156 │
│ Vulnerabilities │ alpine:3.10 │ true │ 2024-09-30T18:11:54Z │ 2321 │
│ Vulnerabilities │ alpine:3.11 │ true │ 2024-09-30T18:11:54Z │ 2659 │
│ Vulnerabilities │ alpine:3.12 │ true │ 2024-09-30T18:11:54Z │ 3193 │
│ Vulnerabilities │ alpine:3.13 │ true │ 2024-09-30T18:11:54Z │ 3684 │
│ Vulnerabilities │ alpine:3.14 │ true │ 2024-09-30T18:11:54Z │ 4265 │
│ Vulnerabilities │ alpine:3.15 │ true │ 2024-09-30T18:11:54Z │ 4815 │
│ Vulnerabilities │ alpine:3.16 │ true │ 2024-09-30T18:11:54Z │ 5271 │
│ Vulnerabilities │ alpine:3.17 │ true │ 2024-09-30T18:11:54Z │ 5630 │
│ Vulnerabilities │ alpine:3.18 │ true │ 2024-09-30T18:11:54Z │ 6144 │
│ Vulnerabilities │ alpine:3.19 │ true │ 2024-09-30T18:11:54Z │ 6348 │
│ Vulnerabilities │ alpine:3.2 │ true │ 2024-09-30T18:11:54Z │ 305 │
│ Vulnerabilities │ alpine:3.20 │ true │ 2024-09-30T18:11:54Z │ 6444 │
│ Vulnerabilities │ alpine:3.3 │ true │ 2024-09-30T18:11:54Z │ 470 │
│ Vulnerabilities │ alpine:3.4 │ true │ 2024-09-30T18:11:54Z │ 679 │
│ Vulnerabilities │ alpine:3.5 │ true │ 2024-09-30T18:11:54Z │ 902 │
│ Vulnerabilities │ alpine:3.6 │ true │ 2024-09-30T18:11:54Z │ 1075 │
│ Vulnerabilities │ alpine:3.7 │ true │ 2024-09-30T18:11:54Z │ 1461 │
│ Vulnerabilities │ alpine:3.8 │ true │ 2024-09-30T18:11:54Z │ 1671 │
│ Vulnerabilities │ alpine:3.9 │ true │ 2024-09-30T18:11:54Z │ 1955 │
│ Vulnerabilities │ alpine:edge │ true │ 2024-09-30T18:11:54Z │ 6467 │
│ Vulnerabilities │ amzn:2 │ true │ 2024-09-30T18:11:48Z │ 2280 │
│ Vulnerabilities │ amzn:2022 │ true │ 2024-09-30T18:11:48Z │ 276 │
│ Vulnerabilities │ amzn:2023 │ true │ 2024-09-30T18:11:48Z │ 736 │
│ Vulnerabilities │ chainguard:rolling │ true │ 2024-09-30T18:12:02Z │ 4487 │
│ Vulnerabilities │ debian:10 │ true │ 2024-09-30T18:11:55Z │ 32021 │
│ Vulnerabilities │ debian:11 │ true │ 2024-09-30T18:11:55Z │ 33574 │
│ Vulnerabilities │ debian:12 │ true │ 2024-09-30T18:11:55Z │ 32529 │
│ Vulnerabilities │ debian:13 │ true │ 2024-09-30T18:11:55Z │ 31702 │
│ Vulnerabilities │ debian:7 │ true │ 2024-09-30T18:11:55Z │ 20455 │
│ Vulnerabilities │ debian:8 │ true │ 2024-09-30T18:11:55Z │ 24058 │
│ Vulnerabilities │ debian:9 │ true │ 2024-09-30T18:11:55Z │ 28240 │
│ Vulnerabilities │ debian:unstable │ true │ 2024-09-30T18:11:55Z │ 35992 │
│ Vulnerabilities │ mariner:1.0 │ true │ 2024-09-30T18:12:11Z │ 2092 │
│ Vulnerabilities │ mariner:2.0 │ true │ 2024-09-30T18:12:11Z │ 2627 │
│ Vulnerabilities │ ol:5 │ true │ 2024-09-30T18:12:01Z │ 1255 │
│ Vulnerabilities │ ol:6 │ true │ 2024-09-30T18:12:01Z │ 1709 │
│ Vulnerabilities │ ol:7 │ true │ 2024-09-30T18:12:01Z │ 2199 │
│ Vulnerabilities │ ol:8 │ true │ 2024-09-30T18:12:01Z │ 1910 │
│ Vulnerabilities │ ol:9 │ true │ 2024-09-30T18:12:01Z │ 874 │
│ Vulnerabilities │ rhel:5 │ true │ 2024-09-30T18:12:06Z │ 7193 │
│ Vulnerabilities │ rhel:6 │ true │ 2024-09-30T18:12:06Z │ 11129 │
│ Vulnerabilities │ rhel:7 │ true │ 2024-09-30T18:12:06Z │ 11376 │
│ Vulnerabilities │ rhel:8 │ true │ 2024-09-30T18:12:06Z │ 7007 │
│ Vulnerabilities │ rhel:9 │ true │ 2024-09-30T18:12:06Z │ 4040 │
│ Vulnerabilities │ sles:11 │ true │ 2024-09-30T18:12:19Z │ 594 │
│ Vulnerabilities │ sles:11.1 │ true │ 2024-09-30T18:12:19Z │ 6125 │
│ Vulnerabilities │ sles:11.2 │ true │ 2024-09-30T18:12:19Z │ 3291 │
│ Vulnerabilities │ sles:11.3 │ true │ 2024-09-30T18:12:19Z │ 7081 │
│ Vulnerabilities │ sles:11.4 │ true │ 2024-09-30T18:12:19Z │ 6583 │
│ Vulnerabilities │ sles:12 │ true │ 2024-09-30T18:12:19Z │ 6018 │
│ Vulnerabilities │ sles:12.1 │ true │ 2024-09-30T18:12:19Z │ 6205 │
│ Vulnerabilities │ sles:12.2 │ true │ 2024-09-30T18:12:19Z │ 8339 │
│ Vulnerabilities │ sles:12.3 │ true │ 2024-09-30T18:12:19Z │ 10396 │
│ Vulnerabilities │ sles:12.4 │ true │ 2024-09-30T18:12:19Z │ 10215 │
│ Vulnerabilities │ sles:12.5 │ true │ 2024-09-30T18:12:19Z │ 12444 │
│ Vulnerabilities │ sles:15 │ true │ 2024-09-30T18:12:19Z │ 8737 │
│ Vulnerabilities │ sles:15.1 │ true │ 2024-09-30T18:12:19Z │ 9245 │
│ Vulnerabilities │ sles:15.2 │ true │ 2024-09-30T18:12:19Z │ 9573 │
│ Vulnerabilities │ sles:15.3 │ true │ 2024-09-30T18:12:19Z │ 10074 │
│ Vulnerabilities │ sles:15.4 │ true │ 2024-09-30T18:12:19Z │ 10438 │
│ Vulnerabilities │ sles:15.5 │ true │ 2024-09-30T18:12:19Z │ 10882 │
│ Vulnerabilities │ sles:15.6 │ true │ 2024-09-30T18:12:19Z │ 3778 │
│ Vulnerabilities │ ubuntu:12.04 │ true │ 2024-09-30T18:12:37Z │ 14934 │
│ Vulnerabilities │ ubuntu:12.10 │ true │ 2024-09-30T18:12:37Z │ 5641 │
│ Vulnerabilities │ ubuntu:13.04 │ true │ 2024-09-30T18:12:37Z │ 4117 │
│ Vulnerabilities │ ubuntu:14.04 │ true │ 2024-09-30T18:12:37Z │ 37919 │
│ Vulnerabilities │ ubuntu:14.10 │ true │ 2024-09-30T18:12:37Z │ 4437 │
│ Vulnerabilities │ ubuntu:15.04 │ true │ 2024-09-30T18:12:37Z │ 6220 │
│ Vulnerabilities │ ubuntu:15.10 │ true │ 2024-09-30T18:12:37Z │ 6489 │
│ Vulnerabilities │ ubuntu:16.04 │ true │ 2024-09-30T18:12:37Z │ 35057 │
│ Vulnerabilities │ ubuntu:16.10 │ true │ 2024-09-30T18:12:37Z │ 8607 │
│ Vulnerabilities │ ubuntu:17.04 │ true │ 2024-09-30T18:12:37Z │ 9095 │
│ Vulnerabilities │ ubuntu:17.10 │ true │ 2024-09-30T18:12:37Z │ 7908 │
│ Vulnerabilities │ ubuntu:18.04 │ true │ 2024-09-30T18:12:37Z │ 29591 │
│ Vulnerabilities │ ubuntu:18.10 │ true │ 2024-09-30T18:12:37Z │ 8460 │
│ Vulnerabilities │ ubuntu:19.04 │ true │ 2024-09-30T18:12:37Z │ 8742 │
│ Vulnerabilities │ ubuntu:19.10 │ true │ 2024-09-30T18:12:37Z │ 8496 │
│ Vulnerabilities │ ubuntu:20.04 │ true │ 2024-09-30T18:12:37Z │ 25673 │
│ Vulnerabilities │ ubuntu:20.10 │ true │ 2024-09-30T18:12:37Z │ 10112 │
│ Vulnerabilities │ ubuntu:21.04 │ true │ 2024-09-30T18:12:37Z │ 11365 │
│ Vulnerabilities │ ubuntu:21.10 │ true │ 2024-09-30T18:12:37Z │ 12635 │
│ Vulnerabilities │ ubuntu:22.04 │ true │ 2024-09-30T18:12:37Z │ 24135 │
│ Vulnerabilities │ ubuntu:22.10 │ true │ 2024-09-30T18:12:37Z │ 14483 │
│ Vulnerabilities │ ubuntu:23.04 │ true │ 2024-09-30T18:12:37Z │ 15562 │
│ Vulnerabilities │ ubuntu:23.10 │ true │ 2024-09-30T18:12:37Z │ 18433 │
│ Vulnerabilities │ ubuntu:24.04 │ true │ 2024-09-30T18:12:37Z │ 20148 │
│ Vulnerabilities │ wolfi:rolling │ true │ 2024-09-30T18:11:56Z │ 2906 │
│ Vulnerabilities │ anchore:exclusions │ true │ 2024-09-30T18:11:56Z │ 12851 │
│ CISA KEV (Known Exploited Vulnerabilities) │ kev_db │ true │ 2024-09-30T18:07:21Z │ 1185 │
| Exploit Prediction Scoring System Database │ epss_db │ true │ 2024-11-18T18:04:12Z │ 266565 │
└────────────────────────────────────────────┴────────────────────┴─────────┴──────────────────────┴──────────────┘
As soon as you see RecordCount values set for all vulnerability groups, the system is fully populated and ready to present vulnerability results. Note that data syncs are incremental, so the next time you start up Anchore Enterprise it will be ready immediately. The AnchoreCTL includes a useful utility that will block until the feeds have completed a successful sync:
# ./anchorectl system wait
✔ API available system
✔ Services available [10 up] system
✔ Vulnerabilities feed ready system
Step 5: Start using Anchore
To get started, you can add a few images to Anchore Enterprise using AnchoreCTL. Once complete, you can also run an additional AnchoreCTL command to monitor the analysis state of the added images, waiting until the images move into an ‘analyzed’ state.
# ./anchorectl image add docker.io/library/alpine:latest
✔ Added Image docker.io/library/alpine:latest
Image:
status: not-analyzed (active)
tag: docker.io/library/alpine:latest
digest: sha256:1304f174557314a7ed9eddb4eab12fed12cb0cd9809e4c28f29af86979a3c870
id: 9c6f0724472873bb50a2ae67a9e7adcb57673a183cea8b06eb778dca859181b5
# ./anchorectl image add docker.io/library/nginx:latest
✔ Added Image docker.io/library/nginx:latest
Image:
status: not-analyzed (active)
tag: docker.io/library/nginx:latest
digest: sha256:89020cd33be2767f3f894484b8dd77bc2e5a1ccc864350b92c53262213257dfc
id: 2b7d6430f78d432f89109b29d88d4c36c868cdbf15dc31d2132ceaa02b993763
distro: debian@11 (amd64)
layers: 6
# ./anchorectl image list
✔ Fetched images
┌───────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────┬──────────────┬────────┐
│ TAG │ DIGEST │ ANALYSIS │ STATUS │
├───────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────┼──────────────┼────────┤
│ docker.io/library/alpine:latest │ sha256:1304f174557314a7ed9eddb4eab12fed12cb0cd9809e4c28f29af86979a3c870 │ analyzed │ active │
│ docker.io/library/nginx:latest │ sha256:89020cd33be2767f3f894484b8dd77bc2e5a1ccc864350b92c53262213257dfc │ not_analyzed │ active │
└───────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────┴──────────────┴────────┘
# ./anchorectl image add docker.io/library/nginx:latest --force --wait
⠏ Adding Image docker.io/library/nginx:latest
⠼ Analyzing Image [analyzing] docker.io/library/nginx:latest
...
...
✔ Analyzed Image docker.io/library/nginx:latest
Image:
status: analyzed (active)
tags: docker.io/library/nginx:latest
digest: sha256:89020cd33be2767f3f894484b8dd77bc2e5a1ccc864350b92c53262213257dfc
id: 2b7d6430f78d432f89109b29d88d4c36c868cdbf15dc31d2132ceaa02b993763
distro: debian@11 (amd64)
layers: 6
# ./anchorectl image list
✔ Fetched images
┌───────────────────────────────────────────────────────┬─────────────────────────────────────────────────────────────────────────┬──────────┬────────┐
│ TAG │ DIGEST │ ANALYSIS │ STATUS │
├───────────────────────────────────────────────────────┼─────────────────────────────────────────────────────────────────────────┼──────────┼────────┤
│ docker.io/library/alpine:latest │ sha256:1304f174557314a7ed9eddb4eab12fed12cb0cd9809e4c28f29af86979a3c870 │ analyzed │ active │
│ docker.io/library/nginx:latest │ sha256:89020cd33be2767f3f894484b8dd77bc2e5a1ccc864350b92c53262213257dfc │ analyzed │ active │
└───────────────────────────────────────────────────────┴─────────────────────────────────────────────────────────────────────────┴──────────┴────────┘
Now that some images are in place, you can point your browser at the Anchore Enterprise UI by directing it to http://localhost:3000/.
Enter the username admin and the password you defined in the compose file to log in. These are some of the features you can use in the browser:
- Navigate images
- Inspect image contents
- Perform security scans
- Review compliance policy evaluations
- Edit compliance policies with a complete policy editor UI
- Manage accounts, users, and RBAC assignments
- Review system events
Next Steps
Now that you have Anchore Enterprise running, you can begin to learn more about Anchore capabilities, architecture, concepts, and more.
- To learn more about Anchore Enterprise, see Overview
- To learn more about Anchore capabilities, see Capabilities
- To learn more about Anchore architecture, see Architecture
- To learn more about Anchore concepts, see Concepts
- To learn more about other deployment methods, see Deployment
- To learn more about using Anchore, start with Vulnerability Management
Optional: Enabling Prometheus Monitoring
Uncomment the following section at the bottom of the docker-compose.yaml file:
# # Uncomment this section to add a prometheus instance to gather metrics. This is mostly for quickstart to demonstrate prometheus metrics exported # prometheus: # image: docker.io/prom/prometheus:latest # depends_on: # - api # volumes: # - ./anchore-prometheus.yml:/etc/prometheus/prometheus.yml:z # logging: # driver: "json-file" # options: # max-size: 100m # ports: # - "9090:9090" #For each service entry in the docker-compose.yaml, change the following to enable metrics in the API for each service
ANCHORE_ENABLE_METRICS=falseto
ANCHORE_ENABLE_METRICS=trueDownload the example prometheus configuration into the same directory as the docker-compose.yaml file, with name anchore-prometheus.yml:
curl https://docs.anchore.com/current/docs/deployment/anchore-prometheus.yml > anchore-prometheus.yml docker compose up -dResult: You should see a new container started and can access prometheus via your browser on
http://localhost:9090.
Optional: Enabling Swagger UI
Uncomment the following section at the bottom of the docker-compose.yaml file:
# # Uncomment this section to run a swagger UI service, for inspecting and interacting with the system API via a browser (http://localhost:8080 by default, change if needed in both sections below) # swagger-ui-nginx: # image: docker.io/nginx:latest # depends_on: # - api # - swagger-ui # ports: # - "8080:8080" # volumes: # - ./anchore-swaggerui-nginx.conf:/etc/nginx/nginx.conf:z # logging: # driver: "json-file" # options: # max-size: 100m # swagger-ui: # image: docker.io/swaggerapi/swagger-ui # environment: # - URL=http://localhost:8080/v2/openapi.json # logging: # driver: "json-file" # options: # max-size: 100mDownload the nginx configuration into the same directory as the docker-compose.yaml file, with name anchore-swaggerui-nginx.conf:
curl https://docs.anchore.com/current/docs/deployment/anchore-swaggerui-nginx.conf > anchore-swaggerui-nginx.conf docker compose up -dResult: You should see a new container started, and have access Swagger UI via your browser on
http://localhost:8080.