Best practices for scanning container images before deploying with Aspire

[sofie-sb]

Hi everyone,

We’re using Aspire to deploy our application to Azure through an Azure DevOps pipeline. Before each deployment, we’d like to scan our container images with Trivy for vulnerabilities and ensure that the exact images we scan are the ones deployed to Azure.

We’re considering two approaches:

1. Build images as local archives, scan them with Trivy, then push them to the container registry and deploy. For this, we’re looking at setting ContainerBuildOptions.Destination to Archive:

var project = builder.AddProject<Projects>("project-name")
    .WithContainerBuildOptions(options =>
    {
        options.Destination = ContainerImageDestination.Archive;
        options.ImageFormat = ContainerImageFormat.Docker;
    });

2. Build and push images to the container registry, then scan them in the registry before proceeding with deployment.

Is there a recommended approach for integrating image scanning into an Aspire deployment pipeline? In particular, how do you separate the build, scan, and deployment stages while ensuring that Aspire deploys the exact images that passed the scan?

We’d love to hear how others handle this and any lessons learned.

[DesolateYH]

Option 1 doesn't combine with aspire deploy: with Destination = Archive, Aspire skips the push for that resource and the image reference given to the Container App becomes the local .tar path.

Splitting into separate CLI runs doesn't guarantee it either. aspire do <step> runs the step plus its dependencies, and Container App provisioning depends on the push steps, so the deploy run rebuilds and re-pushes under a new aspire-deploy-<timestamp> tag.

What works is scanning inside the same run, between build and push. A failed step blocks its dependents, so no image is pushed and no Container App is updated:

#pragma warning disable ASPIREPIPELINES001
using System.Diagnostics;
using Aspire.Hosting.Pipelines;

builder.Pipeline.AddStep("scan-images", async ctx =>
{
    foreach (var r in ctx.Model.Resources.Where(r => r.RequiresImageBuildAndPush()))
    {
        // same local name the push step tags and pushes
        var image = r.TryGetContainerImageName(out var n) ? n : r.Name.ToLowerInvariant();
        using var p = Process.Start("trivy", ["image", "--exit-code", "1", "--severity", "HIGH,CRITICAL", image]);
        await p.WaitForExitAsync(ctx.CancellationToken);
        if (p.ExitCode != 0) throw new InvalidOperationException($"Trivy failed for {image}");
    }
}, dependsOn: WellKnownPipelineSteps.Build);

builder.Pipeline.AddPipelineConfiguration(ctx =>
{
    ctx.GetSteps(WellKnownPipelineTags.PushContainerImage).DependsOn("scan-images");
    return Task.CompletedTask;
});

Then run one aspire deploy in the Azure DevOps job, with Trivy on the agent's PATH. aspire do deploy --list-steps shows the resulting order. I wrote this against 13.6.2 and haven't compiled it.