Discovering containerized applications

Edit online

Using Concert Workflows, you can run auto-discovery workflows to identify and ingest containerized applications running on virtual machines (VMs).

The discovery process uses two prebuilt workflows that you must import into your Concert Workflows instance:
  • Discover Container Image Metrics: Identifies and collects container image metrics on the target VM by using Docker inspection commands.
  • Scan Images: Runs Trivy and Syft scans on the discovered container images and ingests the image scan data and Software Bill of Materials (SBOMs) into Concert.
After configuring and running these workflows in your Concert Workflows instance, you can use it to:
  • Automatically discover containerized applications running on a target VM.
  • Generate and upload SBOMs for the discovered applications to your Concert instance.
  • Create or verify resilience profiles for the discovered applications, and generate posture assessments aligned with the defined non-functional requirements (NFRs) for docker_containers_profile.
  • Upload the resilience findings to the evidence locker (EL), and verify the upload status.
  • Expose the workflow for asynchronous execution to generate and manage scan files for each container image.

After running the workflow, you can view the discovered applications in Concert Inventory and review the associated resilience assessment results in the Resilience dimension.

Before you begin

Before running the discovery workflows, ensure that the following prerequisites are met:
  • The target VM is running and hosts the containerized applications that you want to discover.
    Note: The discovery workflows currently support only container images that use the <registry>/<repository>/<imageName>[:tag] structure. Images started without specifying a registry (for example, default Docker Hub images such as nginx, redis, postgres, or alpine) are not discovered.
  • The target VM has Docker or an equivalent container runtime installed. If Docker is not installed, run the following command: yum install podman-docker -y
  • You have SSH access to the target VM with root privileges.

Step 1: Import the prebuilt workflows

To enable containerized application discovery, import the required workflows directly within Concert Workflows.
  1. In Concert Workflows, go to the Workflows page.
  2. You can do one of the following:

For more information about importing Concert-specific workflows into Concert Workflows, see Creating workflows.

Step 2: Create the required authentications

Before you run the discovery workflow, make sure that you provide all required credentials in the Details section. These credentials allow Concert to authenticate with the target environment, hub services, and cluster endpoints.

  • Select an integration: Select an integration.
  • Enter the workflow details: Select the workflow details.
  • Env name: Enter the name of the Concert environment where the workflow will run. This must match the exact name of an environment already created or tracked under Environment inventory > Environments within your Concert instance.
  • Hub auth pliant: Enter the credential used to authenticate with the Concert hub.
  • Ssh auth: SSH key used for node or agent access, if required by your workflow.
  • User credential: Concert user identity under which the workflow runs.

You can now create authentications from the Authentications page or from within the workflow editor by opening a workflow and clicking the Auth button. Refer to Using authentications for instructions.

The workflow requires the following authentications to establish a valid connection with the external systems referenced in the configuration:

  • Create an authentication for the IBM Hub - Self (recommended) or IBM Concert API Key service to establish a connection with your Concert instance. If using the IBM Concert API Key option, you must provide additional details to create the authentication, including the protocol, host, instance ID, API key type (usually C_API_Key), and the API key secret. Refer to Authenticating from Concert Workflows to Concert.The screenshot of the UI shows how you can create authentication for the IBM Hub - Self service.

    Note: If you have already created an IBM Hub - Self or IBM Concert API Key for use with another application, you need not create another one. You can reuse this authentication across multiple workflows.
  • Create an authentication for the IBM Hub - Self for Pliant. This authentication is required to expose the workflow and enable interaction with the underlying Pliant automation blocks.
    The screenshot of the UI shows how you can create authentication for the hub_auth_pliant service.

  • Create an authentication for the SSH service for the VM from which images are pulled. The authentication configuration requires you to specify the Host, Port (default is 22), and Username associated with the VM. Optionally, you can also specify a Password and RSA private key details.


    The screenshot of the UI shows how you can create authentication for the SSH service.

Step 3: Expose the workflow for asynchronous execution

To make the workflows available for external invocation and discovery:
  1. Go to Workflows in your Concert Workflows instance.
    Figure 1. Go to Workflows
    Screenshot of Workflows in your Concert Workflows instance.
  2. Select each of the following workflows:
    • Discover Container Image Metrics
    • Scan Images
  3. For each workflow, click the More options (⋮) icon and select Expose externally.
    Figure 2. Expose externally
    Screenshot of more options, Expose externally.
  4. Select the Asynchronous execution checkbox.
  5. Click Expose to make the workflow available for Containerized applications discovery.
    Figure 3. Click Expose
    Screenshot of click expose.
  6. When exposing the Scan Images workflow, specify the Exposure path as /scan_images.
    Figure 4. Exposure path for Scan Images workflow
    Screenshot of the exposure path for the Scan Images workflow.

    Prerequisites

    • Ensure to pull the latest version of the ibm-concert-auto-mod.
      The ibm-concert-auto-mod should match your Concert version and tag the image as follows: 
        docker pull cp.icr.io/cp/concert/ibm-concert-auto-mod:v2.0.0-503-20250706.234002-main

  docker tag cp.icr.io/cp/concert/ibm-concert-auto-mod:v2.0.0-503-20250706.234002-main \
  cp.icr.io/cp/concert/ibm-concert-auto-mod:v1
    • Verify and update the scan output folder location.
      In the Scan Images workflow, update the fileSystem input variable to point to a valid directory on the VM.
      • On the VM, run pwd to identify the current working directory.
      • Append the scan-reports (for example, "folderLocation": "/root/scan-reports”) to this path and use the resulting value for folderLocation.
      Note:

      Ensure that the output folder exists for storing scan result files. You can specify the desired folder location in the variable type object fileSystem by updating the value of folderLocation.

      appropriate read and write permissions for the user running the Docker container.

Next steps

  1. Go to the Concert home page.
  2. Click Discover your data.
  3. Select Containerized applications.
  4. Select the Discover Container Image Metrics workflow.
  5. Provide the required input values:
    • Concert C API key: Create an authentication of type Concert API key that includes the API key. For more information, see Generating an API key.
    • Environment name: Specify the environment where you want to run the discovery.
    • Hub auth pliant: Select the hub_auth_pliant authentication created earlier.
    • SSH auth: Select the SSH authentication for the target VM.
  6. Click Next to start the discovery process.

After the workflow completes, you can view the discovered applications and their resilience assessments in Concert. For details, see Discovering applications and clusters.

Advanced settings and filters

Concert auto-discovery uses Trivy and Syft to scan images and their layers for resilience. The Trivy tool, enabled by default, performs scans on images and application components, and then returns a common vulnerabilities and exposure (CVE) assessment.

Advanced settings give you the option to have Trivy bypass vulnerability scans after the initial scan has been validated, which is useful when an application cannot be detected or when there are multiple versions.

To disable or override the app version for Trivy during auto-discovery:
  1. Go to the Concert home page.
  2. Click Discover your data.
  3. Enter and validate the name and credentials of the VM or cluster you want to scan.
  4. Click the Advanced settings & filters menu, and toggle off the Trivy scan.
  5. Click Next.
  6. On the Discover page, choose a frequency, and select the namespaces you want to scan.
  7. Click Next to continue the discovery process.