[{"_1":2,"_172":-5,"_173":-5},"loaderData",{"_3":4,"_13":14,"_21":22,"_148":149},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11,"_20":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_23":24,"_25":-5,"_26":11,"_27":11,"_28":29,"_30":31,"_32":-5,"_33":11,"_34":35,"_91":-5,"_92":93,"_139":-5,"_140":11,"_141":17,"_142":11,"_143":-5,"_144":11,"_145":-5,"_146":147},"canonicalUrl","https://hub.docker.com/r/nunut/devops-jenkins-secure/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","nunut","reponame","devops-jenkins-secure","cloudBuildSource","isAutobuildsAvailable","repo",{"_36":37,"_46":47,"_49":50,"_51":52,"_53":11,"_54":55,"_56":57,"_58":59,"_39":31,"_28":29,"_61":62,"_63":48,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":65,"_72":73,"_74":11,"_75":29,"_76":77,"_82":11,"_83":84,"_88":29,"_89":90},"categories",[38,43],{"_39":40,"_41":42},"name","Security","slug","security",{"_39":44,"_41":45},"Developer tools","developer-tools","content_types",[48],"image","date_registered","2025-06-01T11:18:01.182357Z","description","DevOps Jenkins Secure Scan\n+ node js \n+ python\n+Trivy\n+Hadolint\n+Gitleaks\n","is_private","last_updated","2025-06-01T11:41:58.182455Z","last_modified","2025-06-02T04:50:37.994754Z","media_types",[60],"application/vnd.oci.image.index.v1+json","pull_count",202,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","DevOps Jenkins Secure Scan + node js + python +Trivy +Hadolint +Gitleaks + Bandit\nWho need ? (Someone need to testing DevOps pipeline for CI/CD and Security/Soucecode scan and has problem can't apt-get install node js + python +Trivy +Hadolint +Gitleaks + Bandit\n\n\\\nWho Needs This Jenkins + Docker DevSecOps Stack?\\\n✅ 1. DevSecOps Engineers / Security Champions\nWho want to run secure CI/CD pipelines inside a controlled container.\n\nNeed to scan code with Semgrep, Gitleaks, Bandit, Trivy, and Hadolint automatically.\n\nDon't want to install tools manually every time.\n\n✅ 2. Developers or QA Teams\nWho are learning or testing CI/CD pipelines locally or on Synology / Home NAS.\n\nWant an easy way to build/test Node.js, Python, or .NET apps in CI.\n\nFace issues like:\n\n❌ apt-get doesn't work inside limited Docker envs\n\n❌ Can't install dev tools due to security or network policies\n\n✅ 3. Teams Using Synology or Other Docker Hosts\nNeed a portable and secure Jenkins setup (like your ZIP file).\n\nWant to avoid complex manual setup on Docker GUI.\n\nWant to reuse the same pipeline logic across test/dev/prod.\n\n✅ 4. Security Auditors / Compliance Teams\nNeed a way to quickly spin up secure pipelines that include:\n\nSAST (Static App Security Testing)\n\nSecret detection\n\nDockerfile linting\n\nWithout depending on external services or large installs.\n\n❗ Pain Points It Solves\n❌ apt-get blocked in restricted containers (Synology / minimal base image)\n\n❌ Missing wget, pip, node, or go dependencies\n\n❌ Permission issues with /var/run/docker.sock\n\n❌ Time-consuming setup for CI tools in Dev environments)\n\n///////////////////////////////////////////////////////////////////////////\n---\n🔐 Secure, Automated, Scalable\nThis repository delivers a comprehensive DevSecOps CI/CD solution powered by Docker, focused on integrating security scanning and automation tools into your software development lifecycle. It is optimized for projects using Node.js and Python, and is designed to be extensible, reproducible, and production-ready.\n\n✅ Key Features\n🧩 Jenkins in a Container\nFully containerized Jenkins server pre-configured for secure pipeline execution with optional plugins and SSH credential bindings.\n\n🕵️ Trivy Integration\nAutomatic scanning of Docker images and project dependencies for vulnerabilities using Aqua Trivy.\n\n📏 Hadolint (Dockerfile Linter)\nEnforces Dockerfile best practices with real-time linting and developer-friendly feedback.\n\n🔍 Gitleaks for Secret Detection\nScans your Git history and working directory for exposed secrets (API keys, tokens, credentials).\n\n🧪 Bandit for Python Security Analysis\nStatic code analysis tool to find common security issues in Python codebases.\n\n🚀 Node.js & Python Support\nIncludes runtime environments and libraries for Node.js and Python-based applications.\n\n📈 HTML Reports + Dashboard Ready\nGenerates visual reports (HTML) for all scans — easy to integrate into Jenkins or static dashboards.\n\n🛠️ Use Cases\nSecure CI/CD pipelines for full-stack JavaScript or Python applications\n\nAutomated compliance checks in containerized environments\n\nEducational sandbox for learning modern DevSecOps tooling\n\nInternal development platform for startups and teams embracing security-first culture\n\n.\n├── docker-compose.yml # Multi-service setup for Jenkins, scanning tools\\\n├── Jenkinsfile # Secure CI/CD pipeline with integrated scans\\\n├── Dockerfile # Custom build including CLI tools\\\n├── scripts/ \\\n│ ├── run_trivy.sh # Trivy scan script\\\n│ ├── run_bandit.sh # Python security check\\\n│ └── run_gitleaks.sh # Gitleaks scanner\\\n├── reports/ # Auto-generated scan reports (HTML, JSON)\\\n├── node_app/ # Sample Node.js app\\\n└── python_app/ # Sample Python app\\\n\\\n\n📌 Getting Started\nClone this repository\n\nRun docker-compose up to bring up Jenkins and toolchain\n\nAccess Jenkins on http://localhost:8080\n\nRun pipelines or scans via Jenkins or CLI\n\n🤝 Contributing\nContributions are welcome! Whether it's improving security scans, adding a new linter, or optimizing the Docker build — your input helps build a better DevSecOps toolkit.\n\n\ndocker-compose.yml using for docker in docker \n\nservices:\\\n jenkins:\\\n build: .\\\n container_name: secure-jenkins\\\n user: root\\\n privileged: true \\\n ports:\\\n - \"8080:8080\"\\\n - \"50000:50000\"\\\n volumes:\\\n - jenkins_home:/var/jenkins_home\\\n - /var/run/docker.sock:/var/run/docker.sock\\\n restart: always\n\nSample pipeline\\\nhttps://scontent.futp2-1.fna.fbcdn.net/v/t39.30808-6/503122716_10162628590504518_7338773539284586350_n.jpg?_nc_cat=100&ccb=1-7&_nc_sid=127cfc&_nc_ohc=Fxdo8JLPt_EQ7kNvwGAwJoy&_nc_oc=AdkAgk6wf_7vsIWirXUvBTUZ02k_T8TC_uS1OUZKBQtfMRl0NhVS-YAjwh6Hdr0C5Zo&_nc_zt=23&_nc_ht=scontent.futp2-1.fna&_nc_gid=CByPxnrlUbTBkAh3JyaeGg&oh=00_AfLocAo5QsiFejjKDkKxq75qejCreGhzKPlKRy_2svCwBQ&oe=6842E254\"\n\n\nSample Jenkins pipeline script\n\npipeline {\n agent any\n tools {\n dotnetsdk 'dotnet-6.0' #Change to system config\n }\n\n environment {\n SONAR_TOKEN = credentials('sonarqube-token') // Jenkins Credential\n SONAR_HOST = 'http://192.168.1.55:9000' #Change to SVN Server\n }\n\n stages {\n\n stage('Checkout SVN') {\n steps {\n checkout([\n $class: 'SubversionSCM',\n locations: [[\n remote: 'http://192.168.1.55:8088/svn/ChatGPT-RD/apra-a-tool/NetworkTool', #Change to SVN Project\n credentialsId: 'svn-credentials-id'\n ]],\n workspaceUpdater: [$class: 'UpdateUpdater']\n ])\n }\n }\n\n stage('Restore & Build') {\n steps {\n dir('NetworkTool') {\n sh 'dotnet restore'\n sh 'dotnet build -c Release'\n }\n }\n }\n\n stage('Security Scan: Trivy') {\n steps {\n sh '''\n trivy fs . --exit-code 0 --severity HIGH,CRITICAL --format table > trivy-report.txt || true\n '''\n }\n }\n\n stage('Security Scan: Semgrep') {\n steps {\n sh '''\n semgrep scan --config=auto --json > semgrep-report.json || true\n '''\n }\n }\n\n stage('Security Scan: Bandit (Python)') {\n steps {\n sh '''\n bandit -r . -f json -o bandit-report.json || true\n '''\n }\n }\n\n stage('Security Scan: Gitleaks') {\n steps {\n sh '''\n gitleaks detect --no-git --source . --report-format json --report-path gitleaks-report.json || true\n '''\n }\n }\n\n stage('SonarQube Analysis') {\n steps {\n withSonarQubeEnv('MySonarQube') {\n dir('NetworkTool') {\n sh '''\n export PATH=\"$HOME/.dotnet/tools:$PATH\"\n dotnet-sonarscanner begin /k:networktool /d:sonar.host.url=$SONAR_HOST /d:sonar.login=$SONAR_TOKEN \\\n /d:sonar.scm.disabled=true \\\n /d:sonar.scm.provider=svn \\\n /d:sonar.scm.username=Username-change \\\n /d:sonar.scm.password.secured=password-change\\\n /d:sonar.exclusions=\"**/bin/**,**/obj/**\"\n dotnet build\n dotnet-sonarscanner end /d:sonar.login=$SONAR_TOKEN\n '''\n }\n }\n }\n }\n\n stage('Generate HTML Report') {\n steps {\n sh 'python3 generate_report.py'\n }\n }\n\n }\n\n post {\n always {\n archiveArtifacts artifacts: '**/*.json, **/*.txt, publish/**', allowEmptyArchive: true\n archiveArtifacts artifacts: 'summary-report.html', allowEmptyArchive: true\n }\n success {\n echo '✅ Build and Security Scans completed successfully.'\n }\n failure {\n echo '❌ Build or scan failed.'\n }\n }\n}\n\n\n\nDon't forget setup credential of jenkins\n\n\nSample html report\\\nhttps://scontent.futp2-1.fna.fbcdn.net/v/t39.30808-6/503647594_10162630660184518_3870202015242389812_n.jpg?stp=dst-jpg_p280x280_tt6&_nc_cat=106&ccb=1-7&_nc_sid=127cfc&_nc_ohc=2_fVU_ewn1gQ7kNvwG4b1JJ&_nc_oc=AdkhmdHiJi9vjhRgu7_MTmsh0lCJJlaD3VAOOKCertcHeLKA1PIk6Dx0hmMBJL5Sd3Q&_nc_zt=23&_nc_ht=scontent.futp2-1.fna&_nc_gid=uGZekrrmztO-kxIoXHHItg&oh=00_AfIL00T13mDK9KQZWUrhGSo7X952zSCX_OoBinVBru1fsA&oe=6842EE5A\n\nSample generate_report.py\\\n/--------------------------------------------------\n//*\nimport json, os, html\n\ndef read_file(path):\n if os.path.exists(path):\n with open(path, encoding=\"utf-8\") as f:\n return f.read()\n return \"\"\n\ndef html_escape(text):\n return html.escape(text)\n\ndef section(title, link, content):\n return f\"\"\"\n

{title} ðŸ“„ View Full Report

\n {content}\n

\n \"\"\"\n\nhtml_out = \"\"\"\n\n\n\n \n Security Scan Summary\n \n\n\n

ðŸ”’ Combined Security Scan Report

\n\"\"\"\n\n# Section: Trivy\ntrivy_raw = read_file(\"trivy-report.txt\")\nif trivy_raw:\n html_out += section(\"Trivy Report\", \"trivy-report.txt\", f\"

{html_escape(trivy_raw)}

\")\n\n# Section: Semgrep\nsemgrep_json = read_file(\"semgrep-report.json\")\nif semgrep_json:\n data = json.loads(semgrep_json)\n rows = \"\"\n for item in data.get(\"results\", []):\n rows += f\"\"\"\n \n {item['check_id']}\n {item['path']}:{item['start']['line']}\n {html_escape(item['extra'].get('message', ''))}\n \n \"\"\"\n table = f\"\"\"\n \n \n {rows}\n

Rule	Location	Message

\n \"\"\"\n html_out += section(\"Semgrep Findings\", \"semgrep-report.json\", table)\n\n# Section: Bandit\nbandit_json = read_file(\"bandit-report.json\")\nif bandit_json:\n data = json.loads(bandit_json)\n rows = \"\"\n for issue in data.get(\"results\", []):\n rows += f\"\"\"\n \n {issue['filename']}:{issue['line_number']}\n {html_escape(issue['issue_text'])}\n {issue.get('severity')}\n \n \"\"\"\n table = f\"\"\"\n \n \n {rows}\n

Location	Issue	Severity

\n \"\"\"\n html_out += section(\"Bandit Findings\", \"bandit-report.json\", table)\n\n# Section: Gitleaks\ngitleaks_json = read_file(\"gitleaks-report.json\")\nif gitleaks_json:\n leaks = json.loads(gitleaks_json)\n rows = \"\"\n for leak in leaks:\n rows += f\"\"\"\n \n {leak.get('file')}:{leak.get('line')}\n {leak.get('rule')}\n {html_escape(leak.get('secret', '')[:10])}...\n \n \"\"\"\n table = f\"\"\"\n \n \n {rows}\n

Location	Rule	Leaked (Partial)

\n \"\"\"\n html_out += section(\"Gitleaks Leaks\", \"gitleaks-report.json\", table)\n\nhtml_out += \"\"\n\nwith open(\"summary-report.html\", \"w\", encoding=\"utf-8\") as f:\n f.write(html_out)\n\n*/","has_starred","hub_user","immutable_tags_settings",{"_78":11,"_79":80},"enabled","rules",[81],".*","is_automated","permissions",{"_85":17,"_86":11,"_87":11},"read","write","admin","user","storage_size",1738609421,"orgData","recentTags",[94],{"_95":48,"_96":97,"_98":99,"_100":101,"_102":103,"_104":105,"_54":128,"_129":97,"_130":29,"_131":60,"_39":132,"_133":134,"_135":113,"_136":128,"_137":69,"_138":17},"content_type","creator",26040646,"digest","sha256:dfc502506f02ee384476791e9e7615e312e8eac311e5a42008fdeb9b78d80564","full_size",1738586664,"id",908963477,"images",[106,122],{"_107":108,"_98":109,"_110":111,"_112":113,"_114":115,"_116":117,"_118":111,"_119":-5,"_120":101,"_66":69,"_121":-5},"architecture","amd64","sha256:8c17f42caafe5ecd94fd96b1c53b3cf970f347dcd6deb53594225a27fe7e8bff","features","","last_pulled","2026-09-24T09:31:41.39599782Z","last_pushed","2025-06-01T11:17:59.968458871Z","os","linux","os_features","os_version","size","variant",{"_107":123,"_98":124,"_110":111,"_112":125,"_114":126,"_116":123,"_118":111,"_119":-5,"_120":127,"_66":69,"_121":-5},"unknown","sha256:3b85516a9fabdd01078be6cf777959876620b23f759c9f54d67f4cd3bd819081","2026-09-18T06:31:03.653684488Z","2025-06-01T11:17:59.942620543Z",1039,"2025-06-01T11:41:57.032265Z","last_updater","last_updater_username","media_type","latest","repository",27573899,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_34":150,"_159":160,"_146":170,"_171":11},{"_36":151,"_46":154,"_49":50,"_51":52,"_53":11,"_54":55,"_56":57,"_58":155,"_39":31,"_28":29,"_61":62,"_63":48,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":65,"_72":73,"_74":11,"_75":29,"_76":156,"_82":11,"_83":158,"_88":29,"_89":90},[152,153],{"_39":40,"_41":42},{"_39":44,"_41":45},[48],[60],{"_78":11,"_79":157},[81],{"_85":17,"_86":11,"_87":11},"tags",{"_161":67,"_162":-5,"_163":-5,"_164":165},"count","next","previous","results",[166],{"_95":48,"_96":97,"_98":99,"_100":101,"_102":103,"_104":167,"_54":128,"_129":97,"_130":29,"_131":60,"_39":132,"_133":134,"_135":113,"_136":128,"_137":69,"_138":17},[168,169],{"_107":108,"_98":109,"_110":111,"_112":113,"_114":115,"_116":117,"_118":111,"_119":-5,"_120":101,"_66":69,"_121":-5},{"_107":123,"_98":124,"_110":111,"_112":125,"_114":126,"_116":123,"_118":111,"_119":-5,"_120":127,"_66":69,"_121":-5},[],"canDeleteTags","actionData","errors"]

nunut/devops-jenkins-secure

Tags for nunut/devops-jenkins-secure