ANCHORE,(1)

NAME
anchore, - manual page for anchore, version 0.9.0

SYNOPSIS
anchore gate [OPTIONS]

DESCRIPTION

    Run gate analysis on the specified images with the specified options or else edits the policy that is effective for a specific image or all images. Anchore gates are a set of checks against the image, image's dockerfile and other data sources (e.g. CVEs). The default gate policy file is found in $anchore/conf/anchore_gate.policy, where $anchore = $HOME/.anchore (default) or /etc/anchore depending on installation.

    Image IDs can be specified as hash ids, repo names (e.g. centos), or tags (e.g. centos:latest).

    See the policy file for the set of available gates and their triggers.

    The output of each gate is one of: * GO - Check is ok, no trigger fired * STOP - Trigger found something. Policy says to output a stop * WARN - Emit a warning to flag this as something to follow-up on.

    The gate results are only output to the user, so their meaning is entirely up to the user. A typical use would be to not push any container image to production if it has any 'STOP' gate results. But, how to use the gate output is entirely up to the user.

    Editing Gate Policies:

    Anchore has a global gate policy document, but this can be overridden for each individual image if desired by running '--editpolicy' for the desired image. The policy file opened for editing will be specific to the image. A gate policy file is composed of lines of the following format:

    <Gate Name>:<Trigger Name>:<Result if triggered>

    Gate Policy Example:

    ``DOCKERFILECHECK:NOFROM:STOP`` specifies a check against an image's dockerfile (if available) such that if the 'NOFROM' trigger evaluates to true then the gate action will be 'STOP'

    Usage Examples:

    View gate output for the 'node:latest' image: 'anchore gate --image node:latest'

    View gate output for all images: 'anchore gate'

    Edit the gate policy for 'nginx:latest': 'anchore gate --image nginx:latest --editpolicy'

OPTIONS

--force
    Force gates to run even if they already have.

--image <imageid>
    Process specified image ID. Cannot be combined with --imagefile

--imagefile <file>
    Process image IDs listed in specified file. Cannot be combined with --image

--include-allanchore
    Include all images known by anchore

--editpolicy
    Edit the gate policies for specified image(s).

--whitelist
    Edit evaluated gate triggers and optionally whitelist them.

--extended-help
    Show extended help content, similar to manpage, and exit.

--help
    Show this message and exit.