postqsoftwarelabs/postqcodescanner repository overview

⁠PostQ Code Scanner CLI Container

PostQ Code Scanner finds cryptographic usage in source repositories and generates deterministic reports for crypto findings, operation groups, compliance signals, and remediation review.

This container packages the command-line scanner with Java 21 and OpenGrep. It is intended for non-interactive scans in CI jobs, developer workstations, and controlled security review workflows.

⁠Current Release Status

This image is currently distributed as a beta image. Use the explicit beta tag:

postqsoftwarelabs/postqcodescanner:0.1.0-Beta

Do not use the local development image name postq-code-scanner-cli:latest in customer installation or execution instructions.

⁠Product Links

⁠Quick Run

docker run --rm \
  -v "$PWD:/repo:ro" \
  -v "$PWD/reports:/reports:rw" \
  postqsoftwarelabs/postqcodescanner:0.1.0-Beta \
  --license-accepted

Use podman run with the same arguments when Podman is your container runtime.

--license-accepted is required for scan execution. Without it, the container exits before running the scanner.

⁠Required Mounts

⁠Common Environment Variables

⁠Read License And Notices

docker run --rm postqsoftwarelabs/postqcodescanner:0.1.0-Beta --license
docker run --rm postqsoftwarelabs/postqcodescanner:0.1.0-Beta --notices

These commands print the PostQ license and third-party notices. They do not run a scan.

⁠Image Security

The image is built from Red Hat UBI OpenJDK 21 images pinned by digest. The final runtime image runs as non-root, uses a direct Java entrypoint, removes common interactive tools, keeps product files read-only, and writes scanner output only to the mounted /reports folder.

⁠Supported Platforms

The supported Linux container platforms are:

• linux/amd64
• linux/arm64

Windows and macOS users run the Linux image through Docker Desktop, Docker Engine, or Podman machine. Native Windows container images are not part of the current release target.