# Ubuntu/Debian
sudo apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
echo deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main | sudo tee -a /etc/apt/sources.list.d/trivy.list
sudo apt-get update && sudo apt-get install trivy

# Scan Docker Hub official images
trivy image nginx:1.24

# Scan locally built images
trivy image myapp:latest

# Scan filesystem (no image pull needed, great for local development)
trivy fs /path/to/your/project

trivy image --format json --output report.json nginx:1.24

#!/usr/bin/env python3
"""AI-powered container vulnerability analysis."""

import json
import os
import sys
from pathlib import Path

try:
    import openai
except ImportError:
    print("Please install openai: pip install openai")
    sys.exit(1)

def load_vulnerability_report(report_path: str) -> dict:
    """Load Trivy scan report."""
    with open(report_path) as f:
        return json.load(f)

def extract_critical_vulns(report: dict, severity_threshold: str = "HIGH") -> list:
    """Extract vulnerabilities above threshold."""
    critical = []
    for result in report.get("Results", []):
        for vuln in result.get("Vulnerabilities", []):
            if vuln.get("Severity", "") in ["CRITICAL", "HIGH"]:
                critical.append({
                    "vuln_id": vuln.get("VulnerabilityID"),
                    "package": vuln.get("PkgName"),
                    "severity": vuln.get("Severity"),
                    "installed_version": vuln.get("InstalledVersion"),
                    "fixed_version": vuln.get("FixedVersion", "N/A"),
                    "title": vuln.get("Title", ""),
                    "description": vuln.get("Description", ""),
                    "target": result.get("Target"),
                })
    return critical

def analyze_with_llm(vulns: list, api_key: str, base_url: str = None) -> dict:
    """Analyze vulnerability risk and generate fix recommendations using LLM."""
    client_kwargs = {"api_key": api_key}
    if base_url:
        client_kwargs["base_url"] = base_url

    client = openai.OpenAI(**client_kwargs)

    # Build vulnerability summary
    vuln_summary = "\n".join([
        f"[{v['severity']}] {v['vuln_id']} - {v['package']} ({v['installed_version']}) "
        f"→ Fix: {v['fixed_version']}\n  {v['title']}"
        for v in vulns[:20]  # Limit to avoid token overflow
    ])

    prompt = f"""You are a senior container security expert. Below is a vulnerability scan report for a Docker image. Please analyze the real risk level of each vulnerability and provide fix recommendations.

Vulnerability List:
{vuln_summary}

For each vulnerability, please answer:
1. **Risk Level**: Re-evaluate based on actual usage scenario (CRITICAL / HIGH / MEDIUM / LOW / INFO)
2. **Can Ignore**: Mark as ignorable if the vulnerability has no real impact on current business
3. **Fix Recommendation**: Specific executable fix steps
4. **Priority**: Sort by fix urgency

Return the analysis results in JSON format:
{{
  "analysis": [
    {{
      "vuln_id": "CVE-XXXX-XXXX",
      "risk_level": "HIGH",
      "can_ignore": false,
      "reason": "This vulnerability affects nginx's HTTP request parsing, and our service exposes HTTP ports",
      "fix_action": "Upgrade nginx to version 1.25.4 or higher",
      "dockerfile_fix": "FROM nginx:1.25.4-alpine",
      "priority": 1
    }}
  ],
  "summary": {{
    "total_vulns": 50,
    "critical_count": 3,
    "high_count": 12,
    "medium_count": 20,
    "low_count": 15,
    "actionable_vulns": 15,
    "ignored_vulns": 35
  }}
}}"""

    response = client.chat.completions.create(
        model="gpt-4o-mini",
        messages=[{"role": "user", "content": prompt}],
        temperature=0.3,
        max_tokens=4096,
    )

    analysis_text = response.choices[0].message.content
    # Extract JSON
    start = analysis_text.find("{")
    end = analysis_text.rfind("}") + 1
    if start >= 0 and end > start:
        return json.loads(analysis_text[start:end])
    return {"analysis": [], "summary": {}}

def main():
    if len(sys.argv) < 2:
        print("Usage: python3 analyze_vulnerabilities.py <trivy-report.json>")
        sys.exit(1)

    report_path = sys.argv[1]
    api_key = os.getenv("OPENAI_API_KEY") or os.getenv("ANTHROPIC_API_KEY")
    base_url = os.getenv("API_BASE_URL")

    if not api_key:
        print("Please set OPENAI_API_KEY or ANTHROPIC_API_KEY environment variable")
        sys.exit(1)

    print(f"📊 Loading vulnerability report: {report_path}")
    report = load_vulnerability_report(report_path)

    print("🔍 Extracting high-severity vulnerabilities...")
    vulns = extract_critical_vulns(report)
    print(f"   Found {len(vulns)} high/critical vulnerabilities")

    if not vulns:
        print("✅ No high-severity vulnerabilities found. Image is secure!")
        sys.exit(0)

    print("🤖 Calling AI to analyze vulnerability risk...")
    analysis = analyze_with_llm(vulns, api_key, base_url)

    print("\n" + "="*60)
    print("📋 AI Vulnerability Analysis Report")
    print("="*60)

    summary = analysis.get("summary", {})
    print(f"Total vulns: {summary.get('total_vulns', 'N/A')}")
    print(f"  🔴 Critical: {summary.get('critical_count', 0)}")
    print(f"  🟠 High:     {summary.get('high_count', 0)}")
    print(f"  🟡 Medium:   {summary.get('medium_count', 0)}")
    print(f"  🟢 Low:      {summary.get('low_count', 0)}")
    print(f"  ✅ Actionable: {summary.get('actionable_vulns', 0)}")
    print(f"  ⏭️  Ignored:   {summary.get('ignored_vulns', 0)}")

    print("\n🔧 Fix Recommendations:")
    actionable = [v for v in analysis.get("analysis", []) if not v.get("can_ignore", False)]
    for i, v in enumerate(actionable[:10], 1):
        print(f"  {i}. [{v.get('risk_level', 'N/A')}] {v['vuln_id']}")
        print(f"     Reason: {v.get('reason', 'N/A')}")
        print(f"     Fix: {v.get('fix_action', 'N/A')}")
        print(f"     Dockerfile: {v.get('dockerfile_fix', 'N/A')}")

    # Save analysis results
    output_path = report_path.replace(".json", "_analysis.json")
    with open(output_path, "w") as f:
        json.dump(analysis, f, indent=2, ensure_ascii=False)
    print(f"\n💾 Analysis report saved: {output_path}")

    # Determine if CI/CD should be blocked
    critical_count = summary.get("critical_count", 0)
    high_count = summary.get("high_count", 0)
    if critical_count > 0 or high_count > 5:
        print("\n🚨 Security gate triggered: Critical vulnerabilities detected. Deployment blocked!")
        sys.exit(2)
    else:
        print("\n✅ Security gate passed: Vulnerability risk is manageable. Continue deployment.")
        sys.exit(0)

if __name__ == "__main__":
    main()

# Start Ollama
docker run -d -p 11434:11434 --name ollama ollama/ollama

# Pull a model
ollama pull qwen2.5:7b

# Modify the script's API configuration
export API_BASE_URL=http://localhost:11434/v1
export OPENAI_API_KEY=sk-placeholder  # Ollama is OpenAI-compatible

# 1. Scan the image
trivy image --format json --output report.json myapp:latest

# 2. AI analysis
python3 analyze_vulnerabilities.py report.json

#!/usr/bin/env python3
"""AI-driven container image repair."""

import json
import subprocess
import sys
from pathlib import Path

def apply_repair(analysis_path: str, build_context: str = "."):
    """Rebuild secure image based on AI analysis results."""
    with open(analysis_path) as f:
        analysis = json.load(f)

    original_dockerfile = Path(f"{build_context}/Dockerfile").read_text()

    # Collect fix instructions
    fixes = []
    for v in analysis.get("analysis", []):
        if not v.get("can_ignore", False) and v.get("dockerfile_fix"):
            fixes.append(v["dockerfile_fix"])

    if not fixes:
        print("✅ No repair needed. Image is secure.")
        return

    # Generate repaired Dockerfile
    new_dockerfile = original_dockerfile

    # Simple image upgrade logic
    for fix in fixes:
        if fix.startswith("FROM "):
            new_dockerfile = fix + "\n" + "\n".join(
                line for line in original_dockerfile.split("\n")
                if not line.startswith("FROM ")
            )

    # Save repaired Dockerfile
    repair_dockerfile = Path(f"{build_context}/Dockerfile.repaired")
    repair_dockerfile.write_text(new_dockerfile)
    print(f"💾 Repaired Dockerfile saved: {repair_dockerfile}")

    # Build new image
    print("🔨 Rebuilding secure image...")
    result = subprocess.run(
        ["docker", "build", "-t", "myapp:secure", "-f", str(repair_dockerfile), build_context],
        capture_output=True, text=True
    )

    if result.returncode == 0:
        print("✅ Secure image built successfully: myapp:secure")
        print("   Suggestion: Re-run trivy scan to verify fix effectiveness")
    else:
        print(f"❌ Image build failed:\n{result.stderr}")
        sys.exit(1)

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python3 repair_image.py <analysis_report.json> [build_context]")
        sys.exit(1)
    apply_repair(sys.argv[1], sys.argv[2] if len(sys.argv) > 2 else ".")

# 1. Scan original image
trivy image --format json --output report.json myapp:latest

# 2. AI analysis
python3 analyze_vulnerabilities.py report.json

# 3. Auto-repair
python3 repair_image.py report_analysis.json

# 4. Verify fix effectiveness
trivy image --format json --output report_fixed.json myapp:secure
python3 analyze_vulnerabilities.py report_fixed.json

# .github/workflows/container-security.yml
name: Container Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:${{ github.sha }}'
          format: 'json'
          output: 'trivy-report.json'
          severity: 'CRITICAL,HIGH'
          exit-code: '0'  # Don't exit directly; AI analysis decides

      - name: AI vulnerability analysis
        run: |
          pip install openai
          export OPENAI_API_KEY=${{ secrets.OPENAI_API_KEY }}
          python3 analyze_vulnerabilities.py trivy-report.json
        env:
          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

      - name: Block deployment on critical vulnerabilities
        run: |
          python3 -c "
          import json
          with open('trivy-report_analysis.json') as f:
              data = json.load(f)
          summary = data.get('summary', {})
          if summary.get('critical_count', 0) > 0:
              print('🚨 CRITICAL vulnerabilities detected! Blocking deployment.')
              exit(1)
          print('✅ Security check passed.')
          "

# .gitlab-ci.yml
container-security-scan:
  stage: test
  image: alpine:latest
  before_script:
    - apk add --no-cache python3 py3-pip trivy
    - pip3 install openai
  script:
    - docker build -t myapp:$CI_COMMIT_SHA .
    - trivy image --format json --output report.json myapp:$CI_COMMIT_SHA
    - export OPENAI_API_KEY=$OPENAI_API_KEY
    - python3 analyze_vulnerabilities.py report.json
  rules:
    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
    - if: '$CI_COMMIT_BRANCH == "main"'

# Pull and run Ollama
docker run -d \
  --name ollama \
  -p 11434:11434 \
  -v ollama:/root/.ollama \
  ollama/ollama

# Pull a model suitable for security analysis
ollama pull qwen2.5:7b
# Or a smaller model (for resource-constrained VPS)
ollama pull qwen2.5:3b

# Set environment variables to point to local LLM
export API_BASE_URL=http://localhost:11434/v1
export OPENAI_API_KEY=sk-placeholder

# Run analysis (all data stays on VPS)
python3 analyze_vulnerabilities.py report.json

# Only send vulnerability summaries to reduce token consumption
def extract_vuln_summary(vulns: list) -> str:
    """Extract concise vulnerability summary."""
    lines = []
    for v in vulns[:10]:  # Analyze only the top 10
        lines.append(f"{v['vuln_id']}|{v['severity']}|{v['package']}|{v['installed_version']}|{v['fixed_version']}|{v['title'][:80]}")
    return "\n".join(lines)

# One-click security scan script
#!/bin/bash
# security_scan.sh

IMAGE_NAME="${1:-myapp:latest}"
BUILD_CONTEXT="${2:-.}"

echo "🔍 Scanning image: $IMAGE_NAME"
trivy image --format json --output report.json "$IMAGE_NAME"

echo "🤖 AI vulnerability analysis..."
python3 analyze_vulnerabilities.py report.json

echo "🔧 Auto-repairing..."
python3 repair_image.py report_analysis.json "$BUILD_CONTEXT"

echo "✅ Verifying fix effectiveness..."
trivy image --format json --output report_fixed.json myapp:secure
python3 analyze_vulnerabilities.py report_fixed.json

echo "🎉 Security scan complete!"