How to integrate OWASP ZAP into GCP Cloud Build CI/CD - docker

Question

I am trying to run the OWASP ZAP baseline SCAN in my Cloud Build pipeline.
https://www.zaproxy.org/docs/docker/baseline-scan/#usage
I have found tutorials on how to do it this in Github, in Azure, and others but nothing in Cloud Build. Is there a better option for OWASP security testing?
This is what I have in my cloudRun.yaml file:
steps:
- name: 'gcr.io/cloud-builders/docker'
id: 'ZAP Proxy vulnerability scan'
entrypoint: '/bin/sh'
args: ['scripts/ZAP_OWASP_Run.sh','${PROJECT_ID}']
And this is what I have in the ZAP_OWASP_Run.sh:
docker run -v $(pwd):/zap/wrk/:rw --user root -t owasp/zap2docker-stable zap-baseline.py -t https://myWebsite.com -T 5
I had to add --user root because I was getting an error about permissions being denied.
This is kind of working but when I tried to add a config file to ignore certain warnings it broke again. I have had to hack this together that I started thinking I am going about this in the completely wrong way so I came to ask here.
Edit 1:
When I run the docker command without --user root I get the following error:
2023-01-23 23:22:34,992 Unable to copy yaml file to /zap/wrk/zap.yaml [Errno 13] Permission denied: '/zap/wrk/zap.yaml'
When I try to pass in a config file:
docker run -v $(pwd):/zap/wrk/:rw --user root -t owasp/zap2docker-stable zap-baseline.py -t https://radformation.com -T 5 -c zapAlerts.config
I get the following error:
2023-01-24 00:19:09,957 Failed to load config file /zap/wrk/zapAlerts.config not enough values to unpack (expected 3, got 1)
EDIT 2: I got it working by first generating the config file locally and editing it, I tried to copy it from an online source originally.
My main question is, am I even doing this correctly? It feels very hacky. Is there a better way to ensure my website is OWASP compliant in GCP?

Answer 1

Docker perms can be a complete pain. It looks like ZAP cannot update the directory mapped to /zap/wrk/ - this will cause you lots of problems.
Try running docker run -v $(pwd):/zap/wrk/:rw -t owasp/zap2docker-stable touch /zap/wrk/test.txt - if that fails then its definitely a 'local' perm problem - once you get that simple case working then ZAP should run fine.
The Failed to load config file /zap/wrk/zapAlerts.config not enough values to unpack (expected 3, got 1) error message means the file is in the wrong format. How did you create it?
FYI we have a Diagnosing Docker Problems page here: https://www.zaproxy.org/docs/docker/diagnosing-problems/