Hello everyone! I am excited to share some updates regarding container statistics. We now have a page where we display the statistics for all our containers. You can find it at https://voxpupuli.org/container_statistics/.
It is built from https://github.com/voxpupuli/container_statistics and is updated every 24 hours.
Getting the Downloads
For the download count, it scrapes the package HTML pages for the containers. Sadly, this does not work with GraphQL or the API, so we have to use the HTML pages for now. GraphQL and the API do expose a download count, but it is only for GitHub’s legacy container system and not for ghcr.io ¯_(ツ)_/¯. If someone has an idea for a better way to get the download count from ghcr.io, please let me know. The API is not very talkative about this :/
Getting the CVEs
For CVEs, we run two scanners: the wildly popular Trivy scanner and Grype from Anchore. Both are run against the latest version of each container, and the results are displayed on the statistics page. For Grype, we downplay the nvd/cpe entries, as they tend to be false positives. They are still displayed, but specifically marked as nvd/cpe entries, so you can filter them out if you want to.
How the statistics are generated
The statistics can be generated by running the bin/container-statistics script in the container_statistics repository.
It needs a configuration file, which is located in the config directory.
---
containers:
- name: openvoxproject/openbolt
registry: ghcr.io
tags:
- latest
- name: openvoxproject/openvoxagent
registry: ghcr.io
tags:
- latest
We run it in GitHub Actions and push the results to the gh-pages branch, which is then displayed on the statistics page. Scanning is also done in GitHub Actions. The whole process is automated and runs every 24 hours, so the statistics are always up to date. See the GitHub Actions workflow in the container_statistics repository (.github/workflows/container-statistics.yml) for more details.
You can run it locally and generate the statistics yourself. You will need to have the scanners installed and available in your path.
CLI Commands
bin/container-statistics –download-report
This will display the downloads for all containers in a table format. This will live-scrape the HTML pages for the containers, so it might take a while to run.
bin/container-statistics --download-report
CONTAINER TOTAL DOWNLOADS
------------------------------------ ---------------
ghcr.io/openvoxproject/openbolt 1,504
ghcr.io/openvoxproject/openvoxagent 11,814
ghcr.io/openvoxproject/openvoxdb 157,774
ghcr.io/openvoxproject/openvoxserver 151,344
ghcr.io/voxpupuli/commitlint 756
ghcr.io/voxpupuli/onceover 4,248
ghcr.io/voxpupuli/r10k-webhook 7,738
ghcr.io/voxpupuli/r10k 22,548
ghcr.io/voxpupuli/renovate 5,551
ghcr.io/voxpupuli/semantic-release 7,870
ghcr.io/voxpupuli/voxbox 131,841
bin/container-statistics –cve-report
This will display the CVEs for all containers in a table format. It depends on the scanners being installed and having been run at least once, so that the results are available in the cache.
bin/container-statistics --cve-report
CONTAINER CRITICAL HIGH MEDIUM LOW UNKNOWN TOTAL
-------------------------------------------------- -------- ---- ------ --- ------- -----
ghcr.io/openvoxproject/openbolt:latest 1 4 2 1 - 8
ghcr.io/openvoxproject/openvoxagent:latest - 7 58 7 2 74
ghcr.io/openvoxproject/openvoxdb:latest - 6 79 9 2 96
ghcr.io/openvoxproject/openvoxdb:latest-alpine - 1 - - - 1
ghcr.io/openvoxproject/openvoxserver:latest 2 49 634 100 4 789
ghcr.io/openvoxproject/openvoxserver:latest-alpine - 1 - - - 1
ghcr.io/voxpupuli/commitlint:latest 1 6 5 2 - 14
ghcr.io/voxpupuli/onceover:latest 1 4 2 1 - 8
ghcr.io/voxpupuli/r10k-webhook:latest 3 41 35 2 7 88
ghcr.io/voxpupuli/r10k:latest - 8 5 - 1 14
ghcr.io/voxpupuli/renovate:latest - 1 - - - 1
ghcr.io/voxpupuli/semantic-release:latest 1 6 8 2 - 17
ghcr.io/voxpupuli/voxbox:latest - - - - - -