Vulnerabilities

ComputeSphere checks the image each service runs for known vulnerabilities. A service's Security tab lists what it found and which have a fix. On SphereOps, the Security card lists the services with a critical or high vulnerability that has a fix.

What's checked

• The image that a web service, private service, background worker or cron job runs now. Static sites, databases, caches and queues aren't checked.
• Images built on ComputeSphere, and images from the public registries we mirror. An image from a private registry, or from a public registry we don't mirror, isn't checked, and the tab says so.
• A new deploy's image is checked once it runs. Results are checked again as new vulnerabilities are published.

A service's Security tab

Open the service, then Security:

• Last checked says when, and Built on names the base image.
• Counts by severity: Critical, High, Medium, Low and Unknown. Critical and High also say how many have a fix.
• One row per vulnerability: Severity, Vulnerability (linked to its advisory), Package with the installed version, Where (Base image or Your app's dependencies) and Fix (Fixed in 1.2.3 for the base image, Update to 1.2.3 for your app, or No fix yet).

Narrow the list with All, Base image or Your app, tick With a fix only, or search by vulnerability or package.

When ComputeSphere chose the base image (a build without a Dockerfile), the tab says We chose this service's base image. A rebuild starts from the base image we use now. Rebuild the service to pick up the base-image fixes.

A Node.js version past its end of life, or older than the release with the current security fixes, shows findings on the package node, each at the severity the Node.js security release gives it.

The tab says	What it means
We haven't checked this image yet.	The image is new to the check.
We couldn't check this image. We'll try again.	A check failed and runs again.
We can't check this image. We check images built on ComputeSphere and images from the public registries we mirror.	The image comes from a private registry or one we don't mirror.
This service hasn't run an image yet. We check it after its first deploy.	Nothing has deployed yet.
No known vulnerabilities in this image.	The check found none.

SphereOps: services to fix first

The Security card on SphereOps lists every service with a critical or high vulnerability that has a fix, criticals first, like 2 critical · 1 high with a fix. Click a row to open that service's Security tab. With six services or more, search by service, project or environment.

You see the services in projects you can read.

From the API

curl --request GET \
  --url "https://api.computesphere.com/v2/deployments/DEPLOYMENT_ID/vulnerabilities?severity=critical,high&fixable=true" \
  --header "Authorization: Bearer YOUR_API_TOKEN"

Filter with severity, origin (base or app), fixable and q; page with page and page_size. GET /v2/accounts/{aid}/security/vulnerabilities gives the account's services with their counts. See the API reference.

Honest limits

• No notice yet. New vulnerabilities don't send a notification or an email; check the tab or SphereOps.
• It checks the image. Code your app downloads after it starts isn't in the image, so it isn't checked.
• Static sites, databases, caches and queues aren't checked.