[{"_1":2,"_151":-5,"_152":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_149":150},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_138":-5,"_139":11,"_140":21,"_141":11,"_142":-5,"_143":11,"_144":-5,"_145":146,"_147":91,"_148":-7},"canonicalUrl","https://hub.docker.com/r/thunderspb/docker-scanner/builds","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","thunderspb","reponame","docker-scanner","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2021-01-19T11:18:08.833101Z","description","","is_private","last_updated","2021-02-08T14:04:37.267788Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.container.image.v1+json","name","pull_count",505,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Docker Container Scanner\n\n[![GitHub last commit](https://img.shields.io/github/last-commit/thunder-spb/dh-docker-scanner?style=flat-square)](https://github.com/thunder-spb/dh-docker-scanner/commits/master)\n[![Docker Image Version (latest semver)](https://img.shields.io/docker/v/thunderspb/docker-scanner?style=flat-square&sort=semver)](https://hub.docker.com/r/thunderspb/docker-scanner/tags)\n[![Docker Image Size (latest semver)](https://img.shields.io/docker/image-size/thunderspb/docker-scanner?style=flat-square&sort=semver)](https://hub.docker.com/r/thunderspb/docker-scanner)\n[![Docker Pulls](https://img.shields.io/docker/pulls/thunderspb/docker-scanner?style=flat-square)](https://hub.docker.com/r/thunderspb/docker-scanner)\n[![Docker Automated build](https://img.shields.io/docker/automated/thunderspb/docker-scanner?style=flat-square)](https://hub.docker.com/r/thunderspb/docker-scanner/builds)\n[![HitCount](http://hits.dwyl.com/thunderspb/dh-docker-scanner.svg)](http://hits.dwyl.com/thunderspb/dh-docker-scanner)\n[![Go Report Card](https://goreportcard.com/badge/github.com/thunder-spb/dh-docker-scanner?style=flat-square)](https://goreportcard.com/report/github.com/thunder-spb/dh-docker-scanner)\n\nThis container include Docker Image Scanner tools like [Trivy](https://github.com/aquasecurity/trivy/) and [Dockle](https://github.com/goodwithtech/dockle/). For Dockerfile linting this image include [hadolint](https://github.com/hadolint/hadolint/)\n\nAs a bonus, this image also has 2 binaries which help to convert Dockle and Hadolint JSON output into JUnit report -- `dockle2junit` and `hadolint2junit`. Both located in `/usr/bin`. See usage examples below.\n\nSource code of those tools you can find under `scripts/convert2junit` directory.\n\nImage available on DockerHub:\n\n```\ndocker pull thunderspb/docker-scanner:latest\n```\n\nand on GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\n# What is Trivy\n\n> A Simple and Comprehensive Vulnerability Scanner for Containers and other Artifacts, Suitable for CI.\n\nProject homepage and documentation is here: https://github.com/aquasecurity/trivy/\n\nIn addition, this image include JUnit report template to generate JUnit XML Report, which could be consumed by CI system, like Jenkins.\n\n# What is Dockle\n\n> Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start\n\nThis tool do two types of checks:\n\n- Following official [Best Practices](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/)\n- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/)\n\nProject homepage and documentation is here: https://github.com/goodwithtech/dockle/\n\n# What is Hadolint\n\n> A smarter Dockerfile linter that helps you build [best practice](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices) Docker images. The linter is parsing the Dockerfile into an AST and performs rules on top of the AST. It is standing on the shoulders of [ShellCheck](https://github.com/koalaman/shellcheck) to lint the Bash code inside `RUN` instructions.\n\nProject homepage and documentation is here: https://github.com/hadolint/hadolint/\n\n# Versions\n\n- Alpine version: _3.12_\n- Trivy (`trivy`) version: _0.15.0_, Home: https://github.com/aquasecurity/trivy/\n- Dockle (`dockle`) version: _0.3.1_, Home: https://github.com/goodwithtech/dockle/\n- Hadolint (`hadolint`) version: _1.19.0_, Home: https://github.com/hadolint/hadolint/\n- Dockle and Hadolint converters (`dockle2junit`, `hadolint2junit`) -- not versioned, Home: https://github.com/thunder-spb/dh-docker-scanner/tree/master/scripts/convert2junit\n\n# Usage\n\nHere is some examples on how to run scans within this container.\n\n## Trivy scan\n\nPull this image from DockerHub by invoking this command:\n\n```\ndocker pull thunderspb/docker-scanner\n```\n\nor you can pull it from GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\nAttach to pulled container with mounting docker socket:\n\n```\ndocker run -ti --rm --name docker-scanner \\\n -v ${PWD}:/work -w /work \\\n -v /var/run/docker.sock:/var/run/docker.sock \\\n thunderspb/docker-scanner /bin/bash\n```\n\nand then, inside container, run:\n\n```\ntrivy image --format template --template \"@${TRIVY_TPL_JUNIT}\" -o junit-report.xml \n```\n\n## Dockle scan\n\nPull this image from DockerHub by invoking this command:\n\n```\ndocker pull thunderspb/docker-scanner\n```\n\nor you can pull it from GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\nAttach to pulled container with mounting docker socket:\n\n```\ndocker run -ti --rm --name docker-scanner \\\n -v ${PWD}:/work -w /work \\\n -v /var/run/docker.sock:/var/run/docker.sock \\\n thunderspb/docker-scanner /bin/bash\n```\n\nand then, inside container, just run:\n\n```\ndockle thunderspb/docker-scanner\n```\n\n### `dockle2junit` converter\n\nIn order to use this tool, you must run `dockle` with `--format json --output filename.json` arguments.\n\nAfter you got Dockle report in JSON, you can invoke `dockle2junit`:\n\n```\ndockle2junit -in-file filename.json -out-file junit-report.xml -image-name my/imagename:tag\n```\n\n`-image-name` -- to add scanned image name into report for convenience.\n\nHere is an example of Dockle scan results in JSON format for this (`thunderspb/docker-scanner`) image:\n\n```json\n{\n \"summary\": {\n \"fatal\": 0,\n \"warn\": 2,\n \"info\": 2,\n \"skip\": 0,\n \"pass\": 12\n },\n \"details\": [\n {\n \"code\": \"CIS-DI-0001\",\n \"title\": \"Create a user for the container\",\n \"level\": \"WARN\",\n \"alerts\": [\"Last user should not be root\"]\n },\n {\n \"code\": \"DKL-DI-0006\",\n \"title\": \"Avoid latest tag\",\n \"level\": \"WARN\",\n \"alerts\": [\"Avoid 'latest' tag\"]\n },\n {\n \"code\": \"CIS-DI-0005\",\n \"title\": \"Enable Content trust for Docker\",\n \"level\": \"INFO\",\n \"alerts\": [\"export DOCKER_CONTENT_TRUST=1 before docker pull/build\"]\n },\n {\n \"code\": \"CIS-DI-0006\",\n \"title\": \"Add HEALTHCHECK instruction to the container image\",\n \"level\": \"INFO\",\n \"alerts\": [\"not found HEALTHCHECK statement\"]\n }\n ]\n}\n```\n\nAnd an example of generated JUnit report by `dockle2junit` binary:\n\n```xml\n\n\n \n \n \n Last user should not be root\n \n \n Avoid 'latest' tag\n \n \n export DOCKER_CONTENT_TRUST=1 before docker pull/build\n \n \n not found HEALTHCHECK statement\n \n \n\n```\n\nNow, you can order your CI system consume this file :)\n\n## Hadolint scan\n\nThis tool scans Dockerfile, not the image, so working directory should contain your Dockerfile.\n\nPull this image from DockerHub by invoking this command:\n\n```\ndocker pull thunderspb/docker-scanner\n```\n\nor you can pull it from GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\nAttach to pulled container with mounting docker socket:\n\n```\ndocker run -ti --rm --name docker-scanner \\\n -v ${PWD}:/work -w /work \\\n thunderspb/docker-scanner /bin/bash\n```\n\nand then, inside container, just run:\n\n```\nhadolint Dockerfile\n```\n\n### `hadolint2junit` converter\n\nIn order to use this tool, you must run `hadolint` with `--format json` arguments and redirect its output to some file, like this:\n\n```\nhadolint --format json Dockerfile > hadolint-docker-scanner.json\n```\n\nAfter you got Hadolint report in JSON, you can invoke `hadolint2junit`:\n\n```\nhadolint2junit -in-file hadolint-docker-scanner.json -out-file junit-hadolint-docker-scanner.xml\n```\n\nHere is an example of Hadolint scan results in JSON format for `Dockerfile` of this (`thunderspb/docker-scanner`) image:\n\n```json\n[\n {\n \"line\": 16,\n \"code\": \"DL3018\",\n \"message\": \"Pin versions in apk add. Instead of `apk add ` use `apk add =`\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 20,\n \"code\": \"DL3003\",\n \"message\": \"Use WORKDIR to switch to a directory\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 20,\n \"code\": \"DL4006\",\n \"message\": \"Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 26,\n \"code\": \"DL3003\",\n \"message\": \"Use WORKDIR to switch to a directory\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 26,\n \"code\": \"DL4006\",\n \"message\": \"Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 34,\n \"code\": \"DL3003\",\n \"message\": \"Use WORKDIR to switch to a directory\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n }\n]\n```\n\nAnd an example of generated JUnit report by `hadolint2junit` binary:\n\n```xml\n\n\n \n \n \n Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`\n \n \n Use WORKDIR to switch to a directory\n \n \n Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\n \n \n Use WORKDIR to switch to a directory\n \n \n Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\n \n \n Use WORKDIR to switch to a directory\n \n \n\n```\n\nNow, you can order your CI system consume this file :)\n\n# Github home\n\nSources: https://github.com/thunder-spb/dh-docker-scanner\n\n# GitHub Registry\n\nHere is the link on GitHub Container Registry: https://github.com/users/thunder-spb/packages/container/package/docker-scanner\n\n# Docker Hub home\n\nHere is the link on Docker Hub: https://hub.docker.com/r/thunderspb/docker-scanner\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",332849923,"orgData","recentTags",[91,128],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":117,"_118":94,"_119":33,"_120":56,"_57":121,"_122":123,"_124":108,"_125":117,"_126":66,"_127":21},"content_type","creator",3594436,"full_size",26544200,"id",133803452,"images",[101],{"_102":103,"_104":105,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":96,"_63":66,"_116":-5},"architecture","amd64","digest","sha256:a6b6b6a7053eae352ad6f15d7fa841a7761bd1916cc2498a42f875bcb64cc92c","features","last_pulled","2026-10-06T19:12:56.082287097Z","last_pushed","2021-02-08T12:22:05Z","os","linux","os_features","os_version","size","variant","2021-02-08T14:04:36.997411Z","last_updater","last_updater_username","media_type","latest","repository",10804105,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_92":44,"_93":94,"_95":129,"_97":130,"_99":131,"_50":136,"_118":94,"_119":33,"_120":56,"_57":137,"_122":123,"_124":134,"_125":136,"_126":66,"_127":21},26543382,134931711,[132],{"_102":103,"_104":133,"_106":48,"_107":134,"_109":135,"_111":112,"_113":48,"_114":-5,"_115":129,"_63":66,"_116":-5},"sha256:374afbcdab00c003863e55286bc891ea9c9b38b402a7b02b80afe6acbe9f32a2","2026-10-06T19:12:39.783372616Z","2021-01-27T11:02:54Z","2021-01-27T11:02:53.754155Z","1.0.0","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.builds",{"_31":11,"_36":-5},"actionData","errors"]