KESL container

Kaspersky Endpoint Security distribution kit contains files for creating a container application ("KESL container") for embedding into external systems in order to scan container images from image repositories.

After deploying, activating and configuring the KESL container, the following functionality is available in it:

• Scanning images of the containers located in repositories.
• Transferring scanned images that do not contain infected objects to a trusted repository.

Interaction with the KESL container is performed using REST API. It is also possible to configure KESL container settings using Kaspersky Security Center.

KESL containers cannot be managed using the command line.

Deploying and activating KESL container

Distribution package description

The distribution package contains the following files:

• docker-service-<version>.tgz – Archive with files necessary to create the image
• kesl-<version>.rpm – Kaspersky Endpoint Security installation package
• klnagent.rpm – Kaspersky Security Center Network Agent installation package

The docker-service-<version>.tgz archive contains the following files:

• kesl-service – directory of the container application files.
• Dockerfile – file for building a docker image of a version below 18.06.
• Dockerfile.1809 – file for building a docker image of a version later than 18.05.
• build.sh.example – example of a script for building an image.
• run.sh.example – example of a script for launching a KESL container.
• kesl-service.config.example – example of a container application configuration file.
• klnagent.conf.example – example of a configuration file for connecting to Kaspersky Security Center.
• readme.md – quick reference.

KESL container deployment and activation

To prepare a KESL container for use:

1. Unpack the tar -xvf docker-service-<version>.tgz archive.
2. If you want to configure the KESL container settings using Kaspersky Security Center, do the following:
   1. In the klnagent.conf.example file, specify the values ​​of the Network Agent variables. For more information, refer to Kaspersky Security Center documentation (the "Installing Network Agent for Linux in silent mode (with an answer file)" section).
   2. Copy klnagent.conf.example to kesl-service/klnagent.conf.
3. Build the KESL container Docker image using the build.sh.example installation script:
   1. If you use a proxy server, specify the desired values ​​for the COMMON_AGRS variable.
   2. If necessary, change the name of the target kesl-service image to the desired one.
   3. Copy build.sh.example to build.sh and assign an executable file attribute to it.
   4. Run build.sh.
4. Make sure that the build completed successfully by executing the docker images -a command.

   The following command execution result is displayed:

   REPOSITORY TAG IMAGE ID CREATED SIZE

   kesl-service latest <hex> <creation time> <size>

5. Activate the KESL container in one of the following ways:
   • Using Kaspersky Security Center.
   • Using a configuration file.
   • Using an environment variable (see step 8).
6. Configure the KESL container.
7. Start the KESL container using the following command docker run --privileged --init -p < <KESL container_port>:<device_port> \

   -e <variable_1> -e <variable_2> ... -e <variable_n> \

   -v <mount point_1> -v <mount point_2> ... -v <mount point_n> \

   <image name>

   where:

   <KESL container port> is the port of the KESL container, which must be accessible by the network from outside the KESL container.

   <device_port> –is the port of the device where the KESL container is installed.

   You can see an example of the run command in the file run.sh.example.

8. If you want to activate the KESL container using an environment variable, do one of the following:
   • If you want to specify an activation code, add the following setting when starting the KESL container (see step 7): KRAS4D_ACTIVATION ='<activation code>':

     docker run ... -e KRAS4D_ACTIVATION='<activation code>'

   • If you want to apply the key file, add the following options when starting the KESL container (see step 7): KRAS4D_ACTIVATION ='<key file>' and KRAS4D_KEYPATH=/root/kesl-service/keys:

     docker run ... -e KRAS4D_ACTIVATION='<key file>' -e KRAS4D_KEYPATH=/root/kesl-service/keys -v <path to the directory with keys>:/root/kesl-service/keys

Page top

Configuring KESL container

KESL container settings are initialized in several ways:

• By default (unless otherwise specified).
• From the configuration file. In this case, the values ​​from the configuration file have a higher priority than the default values.
• The values can be passed ​​to the KESL container upon startup as environment variables. Environment variables have a higher priority than the settings from the configuration file.
• In the scan request body. The settings in the request body have the highest priority, but they are valid only within a single request.

KESL container settings

KESL container settings and their default values ​​are described in the following table.

KESL container settings

Page top

Environment variables

The following environment variables can be used to configure a KESL container:

• KRAS4D_PORT – port for listening to REST API.
• KRAS4D_LOGLEVEL – event severity level.
• KRAS4D_XAPIKEY – request authorization key.
• KRAS4D_ACTIVATION – activation code or key file name.
• KRAS4D_SCANOPTIONS – additional scan settings.
• KRAS4D_UPDATEOPTIONS – additional update settings.
• KRAS4D_FORCEUPDATE – update the application databases when KESL container starts.
• KRAS4D_SKIPIMAGEIFEXISTS – do not process the image if it already exists in the target repository.
• KRAS4D_GENERALTIMEOUT – maximum time to wait for application commands to run.
• KRAS4D_UPDTASKTIMEOUT – maximum time to wait for application database update tasks to run.
• KRAS4D_CFGNAME: name of the KESL container configuration file.

Configuration file

The KESL container configuration file uses the yaml format. To read the settings from the file, mount the /root/kesl-service/config/ path on the device where the KESL container is installed, and specify the name of the configuration file if it differs from the default one. Thus, you can specify individual configuration file for each set of KESL containers.

The table below shows the configuration file settings and the corresponding environment variables.

Correspondence between the settings and the environment variables

Page top

Available mount points

The following mount points are available for working with the KESL container:

• /root/kesl-service/data/scans.sqlite – path to the database file that contains scan results.
• /var/opt/kaspersky/kesl/common/updates – path to the application databases.
• /root/kesl-service/certificates – path to the directory that contains repository certificates.
• /root/kesl-service/keys – path to the directory that contains license keys.
• /var/log/kaspersky/ – path to the directory that contains event logs.
• /root/kesl-service/config/ – path to the configuration files.
• /var/lib/containers/vfs-storage – required mount point for the Podman utility to work correctly.

Working with REST API

Interaction with the KESL container is implemented using the REST API.

Using the REST API, you can submit the following requests:

• Scan a file or multiple files. For this purpose, submit a scan request (POST).

  Example: POST http://<server>:<port>/scans One or multiple files.

• Scan a Docker image or multiple Docker images. For this purpose, submit a scan request (POST).

  Example: POST http://<server>:<port>/scans Link to the Docker images to scan.

• Scan a Docker image or multiple Docker images with additional settings. For this purpose, submit a scan request (POST).

  Example: POST http://<server>:<port>/scans JSON of a certain type.

• Get a list of scan sessions. For this purpose, send a request for information on scan sessions (GET).

  Example: GET http://<server>:<port>/scans

• Get information on a scan session. For this purpose, send a request for information on scan sessions (GET).

  Example: GET http://<server>:<port>/scans/<unique scan session identifier>

• Add a registry certificate without reloading the KESL container. For this purpose, submit a request for adding a registry certificate (POST).

  Example: POST http://<server>:<port>/addcert

Page top