🛡️ Container-Vulnerability-Patching

An automated solution to detect, patch, and summarize vulnerabilities in Docker container images using Trivy, Python, and Google Gemini AI.

📖 Overview

This repository provides an automated pipeline to secure container images. It handles the entire lifecycle: scanning a base image for Common Vulnerabilities and Exposures (CVEs), identifying packages with available fixes, generating a patched Dockerfile, rebuilding the image, and using Google Gemini AI to provide actionable, human-readable security summaries.

✨ Key Features

• Automated Scanning: Fully integrates with Trivy to detect vulnerabilities in Alpine, Ubuntu, and Debian-based images.
• Intelligent Patching: Specifically targets "patchable" vulnerabilities (those with a FixedVersion) to ensure build stability.
• Dynamic Dockerfile Generation: Automatically creates a Dockerfile.patched with precise package upgrades (e.g., apk add --upgrade or apt-get install --only-upgrade).
• AI Summarization: Leverages the Google Gemini (GenAI) API to transform technical CVE data into plain-English summaries for developers and security teams.
• CI/CD Integration: Includes a production-ready cloudbuild.yaml for Google Cloud Build pipelines.

🏗️ Implementation Workflow

1. Scan: Trivy performs a deep scan of the base image and produces a JSON vulnerability report.
2. Analyze: Python scripts parse the report to isolate packages where a direct fix is available.
3. Patch: The system generates a new Dockerfile that inherits from your base image and executes the necessary security updates.
4. Rebuild: The Docker engine builds a new, hardened version of the image.
5. Summarize: Gemini AI processes the post-patch scan results to highlight any remaining risks and priority actions.

📂 Project Structure

File	Description
auto_patch.py	Local execution script for the full scan-patch-rebuild-rescan cycle.
auto_patch_cloud.py	Cloud-optimized script for report parsing and Dockerfile generation.
summarize_vulns.py	AI integration script using Google Gemini for human-readable summaries.
cloudbuild.yaml	Pipeline configuration for Google Cloud Build.
Dockerfile.patched	The dynamically generated Dockerfile containing security patches.

🚀 Getting Started

Prerequisites

• Python 3.10+
• Docker engine
• Trivy scanner
• Google Gemini API Key (for AI summaries)

Installation

1. Clone the repository:

   git clone [https://github.com/arjunrd07/container-vulnerability-patching.git](https://github.com/arjunrd07/container-vulnerability-patching.git)
   cd container-vulnerability-patching