Prioritization setup: Associating Snyk Open Source, Code, and Container Projects

After you have set up risk-based prioritization, Snyk can set up the required linking for the chosen application.

To prioritize your Snyk Code and Snyk Open Source vulnerabilities, Snyk needs to understand the relationships between those imported Snyk Projects and the Container Project. Snyk uses the relationships between these Projects as a proxy to understand the composition of the container image.

The container image is the build artifact that is deployed and running on your Kubernetes cluster, so Snyk can map your application from its source code to its deployed state by understanding the following:

  • The link between the Source Code and Open Source Dependencies and the image.

  • What images are deployed to Kubernetes and how they are configured.

Add Snyk Project tags to all the Projects used by your application, to link these Projects together and allow Snyk to represent the whole of the application that you are testing.

To associate two Projects together, add the exact same tag to both Projects. For example, add the same tag to your Snyk Open Source Projects and Snyk Container Project if they are related to each other.

See the examples at the end of this section.

Requirements for Project tags

  • The same tag must be applied to the container image and Code or Open Source Projects,

  • The tag must follow the specified format,

  • The Projects do not have to be in the same Snyk Organization to be mapped but MUST be in the same Snyk Group,

Examples of Project tags

Single repo to a single image

In this example, there is a single repository containing your package.json which is built into an image called image-A.

To map these associations, you would have the following tags set up:

LocationAssetSnyk Project LocationTag(s)Notes

github.com/my-team/front-end

package.json

Snyk Org: my-team

Project name: package.json

component=pkg:github/my-team/front-end@main

The same tag is applied to both sides

Built container image called image-A

Snyk Org: my-team

Project name: image-A

component=pkg:github/my-team/front-end@main

Multiple repos to a single image

For this scenario, there are two contributing repositories.

There is a front-end repository containing the package.json scanned by Snyk Open Source and a back-end repository containing go code scanned by Snyk Code.

To map these associations, you would have the following tags set up:

LocationAssetSnyk Project LocationTag(s)Notes

github.com/my-team/front-end

package.json

Snyk Org: my-team

Project name: package.json

component=pkg:github/my-team/front-end@main

github.com/my-team/back-end

Go source code

Snyk Org: my-team

Project name: Code

component=pkg:github/my-team/back-end@main

Built container image called image-A

Snyk Org: my-team

Project name: image-A

component=pkg:github/my-team/front-end@main

component=pkg:github/my-team/back-end@main

The image has two tags applied, as there are two upstream dependencies which have different tags.

You can apply multiple tags to an image.

Monorepo to many images

In this example, the application team is using a monorepo approach. The contents of the repository are built into different container images as they may be run separately.

Here we need to further differentiate the tags by scoping them more accurately.

LocationAssetSnyk Project LocationTag(s)

github.com/my-team/service

package.json

Snyk Org: my-team

Project name: package.json

component=pkg:github/my-team/service/front-end@main

The tag is further scoped by specifying /front-end at the end

Built container image called my-app-frontend:latest

Snyk Org: my-team

Project name: my-app-frontend:latest

component=pkg:github/my-team/service/front-end@main

LocationAssetSnyk Project LocationTag(s)Notes

github.com/my-team/service

Go source code

Snyk Org: my-team

Project name: Code

component=pkg:github/my-team/service/back-end@main

The tag is further scoped by specifying /back-end at the end

Built container image called my-app-backend:latest

Snyk Org: my-team

Project name: my-app-backend:latest

component=pkg:github/my-team/service/back-end@main

Tags application

Project Tags can be applied as follows:

ProductMethodProject Source

Snyk Code

  • API

For projects created by

  • Git Import

Snyk Open Source

  • API

  • UI

  • CLI

For projects created by

  • Git Import

  • CLI Monitor

Snyk Container

  • API

  • UI

  • CLI

For projects created by

  • Git Import

  • CLI Monitor

  • Container Registry Integration

Snyk recommends applying the tags through the API because the process can be automated using the API.

UI example for Project tags

CLI Example

snyk monitor --project-tags=component=pkg:github/my-team/back-end@main

API Example

See the Project Update documentation.

Example:

 "tags": [
    {
      "key": "component",
      "value": "pkg:github/my-team/back-end@main"
    }
  ],

To ensure you have set up your Kubernetes Connector properly, navigate to the Set up Insights tab on the Insights page and check the Image composition section to view the data Insights has access to.

Last updated

More information

Snyk privacy policy

© 2023 Snyk Limited | All product and company names and logos are trademarks of their respective owners.