title: Adding Container-Scanning to CI in GitLab
body: <p>So im trying to set up Container scanning in gitlab, i tried many ways but none seems to work, what im missing? </p>
  
  <p>My gitlab version is: <code>GitLab Community Edition 12.9.4</code></p>
  
  <p>The gitlab-runner in the machine is: <code>Version: 12.10.2</code> </p>
  
  <p>This is my .gitlab-ci.yml</p>
  
  <pre><code>variables:
    vulnerable_tag: vulnerable
    non_vulnerable_tag: non_vulnerable
    IMAGE_NAME: test
    CLAIR_OUTPUT: High 
  
  stages:
      - build
      - test
  
  build:
    image: docker
    stage: build
    variables:
      IMAGE_NAME: test
      IMAGE_TAG: $CI_REGISTRY_IMAGE/$CI_COMMIT_REF_SLUG:$CI_COMMIT_SHA
    script:
      - uname -a
      - docker build -t $IMAGE_NAME .
      - docker run -d -p 80:80 $IMAGE_NAME 
      - docker ps
      - curl localhost
      - mkdir output
      - echo $IMAGE_NAME"/"$CI_COMMIT_REF_SLUG":"$CI_COMMIT_SHA &gt;&gt; output/file.txt
    tags:
      - testingtag
  #  artifacts:
  #    paths: 
  #      - output/
  
  stop_container:
    stage: test
    script:
      - docker stop $(docker ps -q)
  </code></pre>
  
  <p>Is a simple nginx container that just shows a plain index.hmtl</p>
  
  <p>What i've tried (everything inside the .gitlab-ci.yml) that didnt work</p>
  
  <pre><code>include:
    - template: Container-Scanning.gitlab-ci.yml 
  </code></pre>
  
  <p>This is what the documents says and how it should works, but it throws an error <code>This GitLab CI configuration is invalid: Included file `Container-Scanning.gitlab-ci.yml` is empty or does not exist!</code> </p>
  
  <pre><code>include:
   - remote: 'https://gitlab.com/gitlab-org/gitlab/-/raw/master/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml'
  </code></pre>
  
  <p>This throws no error, but does nothing. (the link is the same <code>Container-Scanning.gitlab-ci.yml</code> but in plaintext)</p>
  
  <p>And for last, adding the content of Container-Scanning.gitlab-ci.yml as a job</p>
  
  <pre><code># Read more about this feature here: https://docs.gitlab.com/ee/user/application_security/container_scanning/
  
  variables:
    # Setting this variable will affect all Security templates
    # (SAST, Dependency Scanning, ...)
    SECURE_ANALYZERS_PREFIX: "registry.gitlab.com/gitlab-org/security-products/analyzers"
  
    CS_MAJOR_VERSION: 2
  
  container_scanning:
    stage: test
    image: $SECURE_ANALYZERS_PREFIX/klar:$CS_MAJOR_VERSION
    variables:
      # By default, use the latest clair vulnerabilities database, however, allow it to be overridden here with a specific image
      # to enable container scanning to run offline, or to provide a consistent list of vulnerabilities for integration testing purposes
      CLAIR_DB_IMAGE_TAG: "latest"
      CLAIR_DB_IMAGE: "$SECURE_ANALYZERS_PREFIX/clair-vulnerabilities-db:$CLAIR_DB_IMAGE_TAG"
      # Override the GIT_STRATEGY variable in your `.gitlab-ci.yml` file and set it to `fetch` if you want to provide a `clair-whitelist.yml`
      # file. See https://docs.gitlab.com/ee/user/application_security/container_scanning/index.html#overriding-the-container-scanning-template
      # for details
      GIT_STRATEGY: none
    allow_failure: true
    services:
      - name: $CLAIR_DB_IMAGE
        alias: clair-vulnerabilities-db
    script:
      - /analyzer run
    artifacts:
      reports:
        container_scanning: gl-container-scanning-report.json
    dependencies: []
    rules:
      - if: $CONTAINER_SCANNING_DISABLED
        when: never
      - if: $CI_COMMIT_BRANCH &amp;&amp;
            $GITLAB_FEATURES =~ /\bcontainer_scanning\b/
  </code></pre>
  
  <p>The CI just skip this job as it didnt exist</p>