Trying to run OWASP ZAP Docker Build in the headless mode described here:
docker run -u zap -p 8080:8080 -i owasp/zap2docker-stable zap.sh -daemon -host 0.0.0.0 -port 8080
But can't figure out how to adapt that to a gitlab-ci.yaml. On gitlab 9.4 and think a service command should do it, but haven't got it to work. Tried:
security_test:
image: python:2.7
stage: test
services:
- name: owasp/zap2docker-stable
alias: zap
command: ["docker run -u zap -p 8080:8080 -i owasp_zap zap.sh -port 8080 -host 0.0.0.0 -config api.key=$ZAP_API_KEY -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true -config scanner.strength=INSANE"]
script:
- export PYTHONPATH=$PWD/backend/lib:$PYTHONPATH
- pip install -r qa/security/requirements.txt
- BASE_URL="https://example.com" ZAP="http://owasp__zap2docker-stable:8080" ZAP_API_KEY=$ZAP_API_KEY python qa/security/zap_scanner.py
This gets this error:
ERROR: Preparation failed: Error response from daemon: invalid header field value "oci runtime error: container_linux.go:247: starting container process caused \"exec: \\\"docker run -u zap -p 8080:8080 -i owasp_zap zap.sh -port 8080 -host 0.0.0.0 -config api.key=$ZAP_API_KEY -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true -config scanner.strength=INSANE\\\": executable file not found in $PATH\"\n"
...
Also ran docker inspect on it running locally and it shows the past as
"env": [
...
"ZAP_PATH=/zap/zap.sh",
...
So I changed command to
command: ["zap.sh -port 8080 -host 0.0.0.0 -config api.key=$ZAP_API_KEY -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true -config scanner.strength=INSANE"]
But still get the error:
ERROR: Preparation failed: Error response from daemon: invalid header field value "oci runtime error: container_linux.go:247: starting container process caused \"exec: \\\"/zap/zap zap.sh -port 8080 -host 0.0.0.0 -config api.key=$ZAP_API_KEY -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true -config scanner.strength=INSANE\\\": stat /zap/zap zap.sh -port 8080 -host 0.0.0.0 -config api.key=$ZAP_API_KEY -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true -config scanner.strength=INSANE: no such file or directory\"\n"
...
This seems to be the install file. I'm trying to use custom setting and an api key so not looking for answers like just use default settings or zap baseline.
