Calculate attack surface reduction percentage for pairs of container images.

calculate_attack_surface_reduction.py

"""Calculate attack surface reduction percentage for pairs of container images.

This script calculates the number of packages present in each image and then
calculates the reduction in "attack surface."

Note: Must install syft (https://github.com/anchore/syft) to use.

Author: John Speed Meyers (jsmeyers@chainguard.dev)
"""

import json
import subprocess

# chainguard image goes first in each image pair,
# the comparison image goes second
IMAGE_PAIR_LIST = [
    ["distroless.dev/php:latest", "php:latest"],
    ["distroless.dev/go:latest", "golang:latest"],
    ["distroless.dev/nginx:latest", "nginx:latest"],
]

for image_pair in IMAGE_PAIR_LIST:

    chainguard_image = image_pair[0]
    comparison_image = image_pair[1]
    chainguard_image_pkg_cnt = 0
    comparison_image_pkg_cnt = 0

    for image in [chainguard_image, comparison_image]:

        output_filename = f"data/{image}-syft.json"
        result = subprocess.run(
            ["syft", "packages", image, "-o", "syft-json", "--file", output_filename],
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT,
            check=True,
        )

        with open(output_filename, "r") as file:
            scan_results = json.load(file)
            if image == chainguard_image:
                chainguard_image_pkg_cnt = len(scan_results["artifacts"])
            else:
                comparison_image_pkg_cnt = len(scan_results["artifacts"])

    attack_surface_reduction_percentage = 100 - (
        (chainguard_image_pkg_cnt / comparison_image_pkg_cnt) * 100
    )
    # round to one significant digit to avoid unnecessary precision
    attack_surface_reduction_percentage = round(
        attack_surface_reduction_percentage, 1
    )

    print(
        f"Comparison image [{comparison_image}] package count: {comparison_image_pkg_cnt}"
    )
    print(
        f"Chainguard image [{chainguard_image}] package count: {chainguard_image_pkg_cnt}"
    )
    print(f"Attack surface reduction: {attack_surface_reduction_percentage}%\n")