Prisma Cloud (twistcli) container scanning from BitBucket Pipeline - is this possible?

[patrick feerick]

We are migrating from Jenkins CI to BBC pipeline and are blocked by this. Prisma provide a tool (twistcli) which we install in our image, however it tries to run Docker using the --security-opt argument and this is blocked by BBC.

Since Prisma is a relatively common tool I'm hoping someone else has already got around this?

[Mark C]

Hi @patrick feerick,

Thank you for reaching out to the community.

The Docker command with the --security-opt is indeed not allowed when you run it on Pipelines cloud infrastructure. - Here's the full list of restricted commands

Alternatively, you can explore Bitbucket Cloud Pipelines runners which will allow you to have more control as it runs on your self-hosted machine.

Hope it helps and do let me know if you have further questions.

Regards,
Mark C

[patrick feerick]

Thank @Mark C  I guess that is an option, although the need for server management does not at first glance make it look too attractive. AFAIK bbc-pipeline equivalents (on Azure, Github) seem to be supporting Prisma. You would have thought they were as similarly constrained vs Docker.

Paddy

[anubhav_sharma]

Hi @patrick feerick I am also trying to implement twistcli in CI pipeline.

Could you please help me how you have enabled it?

[patrick feerick]

Hi Anubhav,

We gave up on attempting to run twistcli in BBC because of the above restrictions. I haven't attempted since then but doubt those restrictions have gone away.