Demo

.github/dependabot.yml

@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"

.github/workflows/gke.yml

@@ -56,7 +56,8 @@ jobs:
         pcc_console_url: ${{ secrets.PCC_CONSOLE_URL }}
         pcc_user: ${{ secrets.PCC_USER }}
         pcc_pass: ${{ secrets.PCC_PASS }}
-        image_name: gcr.io/${{ secrets.GKE_PROJECT }}/${{ secrets.IMAGE }}:${{ github.sha }}  
+        image_name: gcr.io/${{ secrets.GKE_PROJECT }}/${{ secrets.IMAGE }}:${{ github.sha }}
+        project: "GKE Demo"
   # Push the Docker image to Google Container Registry
     - name: Publish
       run: |-
@@ -68,4 +69,4 @@ jobs:
         cat kustomization.yaml
         kustomize build . | kubectl apply -f -
         kubectl get pods -o wide
-
+

Dockerfile

@@ -1,9 +1,15 @@
-FROM ubuntu:latest
-COPY wild.py /
+# Pull the minimal Ubuntu image
+FROM us-central1-docker.pkg.dev/panw-utd-public-cloud/utd-demo-images/utd-cnsp/ubuntu:malware
+
+# Nginx already present in base image. Just copy the Nginx config
+COPY default /etc/nginx/sites-available/default
+
+# Install a vulnerable package
 RUN apt update -y
 RUN apt install python3-pip git curl wget node-hawk node-minimist -y
-RUN pip3 --no-cache-dir install --upgrade awscli boto3
-RUN pip3 install gitpython azure-identity azure-storage-blob
-RUN curl -sL https://aka.ms/InstallAzureCLIDeb | bash   
-EXPOSE 8080 
-ENTRYPOINT [ "python3", "wild.py"]
+
+# Expose the port for access
+EXPOSE 80/tcp
+
+# Run the Nginx server
+CMD /opt/entrypoint.sh && /usr/sbin/nginx -g daemon off

default

@@ -0,0 +1,12 @@
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    root /usr/share/nginx/html;
+    index index.html index.htm;
+
+    server_name _;
+    location / {
+        try_files $uri $uri/ =404;
+    }
+}

requirements.txt

@@ -1,28 +1,29 @@
-backports-abc==0.5
-certifi==2017.4.17
-chardet==3.0.4
-click==6.7
-Faker==0.7.17
-Flask==0.12.2
-Flask-SQLAlchemy==2.2
-gevent==1.2.2
-greenlet==0.4.12
-grequests==0.3.0
-idna==2.5
-ipaddress==1.0.18
-itsdangerous==0.24
-Jinja2==2.9.6
-lxml==4.2.1
-MarkupSafe==1.0
-MySQL-python==1.2.5
-PyJWT==1.5.2
-python-dateutil==2.6.0
-python-docx==0.8.5
-PyYAML==3.12
-requests==2.18.1
-singledispatch==3.4.0.3
-six==1.10.0
-SQLAlchemy==1.1.11
-tornado==4.5.1
-urllib3==1.21.1
-Werkzeug==0.14.1
+
+backports-abc==0.5
+certifi==2017.4.17
+chardet==3.0.4
+click==6.7
+Faker==0.7.17
+Flask==0.12.2
+Flask-SQLAlchemy==2.2
+gevent==1.2.2
+greenlet==0.4.12
+grequests==0.3.0
+idna==2.5
+ipaddress==1.0.18
+itsdangerous==0.24
+Jinja2==2.9.6
+lxml==4.2.1
+MarkupSafe==1.0
+MySQL-python==1.2.5
+PyJWT==1.5.2
+python-dateutil==2.6.0
+python-docx==0.8.5
+PyYAML==3.12
+requests==2.18.1
+singledispatch==3.4.0.3
+six==1.10.0
+SQLAlchemy==1.1.11
+tornado==4.5.1
+urllib3==1.21.1
+Werkzeug==0.14.1