How to Run Prisma Cloud TwistCLI tool in CI pipeline

Question

Hi, I am trying to add the prisma twistcli tool in bitbucket pipeline. I am getting the following error when my twistcli command is executed: Get "http://unix.sock/version": dial unix /var/run/docker.sock: connect: no such file or directory this is my command looks like: ./twistcli images scan --address --user --password I searched about this error and it is related to the docker.sock file which twistcli need in order to run the scan. hence I tried with adding the following line in my script: docker run -v /var/run/docker.sock:/var/run/docker.sock but when I use this the pipeline is stuck at : [notice] 1#1: start worker process 36 I also wanted to know that when I am running the same command with --containerized option it is running successfully but the image which I want to scan is not scanned by the twistcli. So what is actually the use of --containerized option and in this case which image is scanned by twistcli Kindly please help if someone is already implemented this solution

Theodora Boudale · Accepted Answer

Hi Anubhav and welcome to the community! The reason for the first error you mentioned is that the Pipelines environment does not use the default unix domain socket (or IPC socket) created /var/run/docker.sock to communicate with the docker daemon, but instead uses the tcp socket at tcp://127.0.0.1:2375. You could fix this error by using the --docker-address option as follows: ./twistcli images scan --address --user --password --docker-address tcp://localhost:2375 However, if you run this command in Pipelines build on Atlassian infrastructure, you may come across another error: authorization denied by plugin pipelines: --security-opt is not allowed I've seen this reported by other users because twistcli seems to need the docker option --security-opt, which is restricted in Pipelines: * https://support.atlassian.com/bitbucket-cloud/docs/run-docker-commands-in-bitbucket-pipelines/#Full-list-of-restricted-commands If you have a Linux machine where you can run builds, you could use a Linux Docker Runner instead for this step: * https://support.atlassian.com/bitbucket-cloud/docs/set-up-and-use-runners-for-linux/ And use a custom docker-in-docker image for the runner: * https://support.atlassian.com/bitbucket-cloud/docs/configure-your-runner-in-bitbucket-pipelines-yml/#Custom-docker-in-docker-image If you have a Linux Docker Runner with a custom dind image, you can use the restricted commands mentioned on the first link I shared (the restrictions won't apply). If you want to run the build on Atlassian's infrastructure, I've seen other users report they made it work the way described here: * https://pan.dev/prisma-cloud/docs/twistcli_gs/#build-time-invocation Regarding your question about the --containerized option, I don't know the answer. I would suggest reaching out to a forum specific to Prisma Cloud or to the product's support team for more info. Kind regards, Theodora