[{"_1":2,"_142":-5,"_143":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_140":141},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.r.$namespace.$reponame",{"_22":23,"_24":-5,"_25":11,"_26":11,"_27":28,"_29":30,"_31":-5,"_32":11,"_33":34,"_83":-5,"_84":85,"_133":-5,"_134":11,"_135":17,"_136":11,"_137":-5,"_138":139},"canonicalUrl","https://hub.docker.com/r/thunderspb/docker-scanner/builds","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","thunderspb","reponame","docker-scanner","cloudBuildSource","isAutobuildsAvailable","repo",{"_35":36,"_37":38,"_40":41,"_42":43,"_44":11,"_45":46,"_47":48,"_49":50,"_52":30,"_27":28,"_53":54,"_55":39,"_56":57,"_58":59,"_60":61,"_62":-5,"_63":57,"_64":65,"_66":11,"_67":28,"_68":69,"_74":11,"_75":76,"_80":28,"_81":82},"categories",[],"content_types",[39],"image","date_registered","2021-01-19T11:18:08.833101Z","description","","is_private","last_updated","2021-02-08T14:04:37.267788Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[51],"application/vnd.docker.container.image.v1+json","name","pull_count",494,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Docker Container Scanner\n\n[![GitHub last commit](https://img.shields.io/github/last-commit/thunder-spb/dh-docker-scanner?style=flat-square)](https://github.com/thunder-spb/dh-docker-scanner/commits/master)\n[![Docker Image Version (latest semver)](https://img.shields.io/docker/v/thunderspb/docker-scanner?style=flat-square&sort=semver)](https://hub.docker.com/r/thunderspb/docker-scanner/tags)\n[![Docker Image Size (latest semver)](https://img.shields.io/docker/image-size/thunderspb/docker-scanner?style=flat-square&sort=semver)](https://hub.docker.com/r/thunderspb/docker-scanner)\n[![Docker Pulls](https://img.shields.io/docker/pulls/thunderspb/docker-scanner?style=flat-square)](https://hub.docker.com/r/thunderspb/docker-scanner)\n[![Docker Automated build](https://img.shields.io/docker/automated/thunderspb/docker-scanner?style=flat-square)](https://hub.docker.com/r/thunderspb/docker-scanner/builds)\n[![HitCount](http://hits.dwyl.com/thunderspb/dh-docker-scanner.svg)](http://hits.dwyl.com/thunderspb/dh-docker-scanner)\n[![Go Report Card](https://goreportcard.com/badge/github.com/thunder-spb/dh-docker-scanner?style=flat-square)](https://goreportcard.com/report/github.com/thunder-spb/dh-docker-scanner)\n\nThis container include Docker Image Scanner tools like [Trivy](https://github.com/aquasecurity/trivy/) and [Dockle](https://github.com/goodwithtech/dockle/). For Dockerfile linting this image include [hadolint](https://github.com/hadolint/hadolint/)\n\nAs a bonus, this image also has 2 binaries which help to convert Dockle and Hadolint JSON output into JUnit report -- `dockle2junit` and `hadolint2junit`. Both located in `/usr/bin`. See usage examples below.\n\nSource code of those tools you can find under `scripts/convert2junit` directory.\n\nImage available on DockerHub:\n\n```\ndocker pull thunderspb/docker-scanner:latest\n```\n\nand on GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\n# What is Trivy\n\n> A Simple and Comprehensive Vulnerability Scanner for Containers and other Artifacts, Suitable for CI.\n\nProject homepage and documentation is here: https://github.com/aquasecurity/trivy/\n\nIn addition, this image include JUnit report template to generate JUnit XML Report, which could be consumed by CI system, like Jenkins.\n\n# What is Dockle\n\n> Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start\n\nThis tool do two types of checks:\n\n- Following official [Best Practices](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/)\n- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/)\n\nProject homepage and documentation is here: https://github.com/goodwithtech/dockle/\n\n# What is Hadolint\n\n> A smarter Dockerfile linter that helps you build [best practice](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices) Docker images. The linter is parsing the Dockerfile into an AST and performs rules on top of the AST. It is standing on the shoulders of [ShellCheck](https://github.com/koalaman/shellcheck) to lint the Bash code inside `RUN` instructions.\n\nProject homepage and documentation is here: https://github.com/hadolint/hadolint/\n\n# Versions\n\n- Alpine version: _3.12_\n- Trivy (`trivy`) version: _0.15.0_, Home: https://github.com/aquasecurity/trivy/\n- Dockle (`dockle`) version: _0.3.1_, Home: https://github.com/goodwithtech/dockle/\n- Hadolint (`hadolint`) version: _1.19.0_, Home: https://github.com/hadolint/hadolint/\n- Dockle and Hadolint converters (`dockle2junit`, `hadolint2junit`) -- not versioned, Home: https://github.com/thunder-spb/dh-docker-scanner/tree/master/scripts/convert2junit\n\n# Usage\n\nHere is some examples on how to run scans within this container.\n\n## Trivy scan\n\nPull this image from DockerHub by invoking this command:\n\n```\ndocker pull thunderspb/docker-scanner\n```\n\nor you can pull it from GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\nAttach to pulled container with mounting docker socket:\n\n```\ndocker run -ti --rm --name docker-scanner \\\n -v ${PWD}:/work -w /work \\\n -v /var/run/docker.sock:/var/run/docker.sock \\\n thunderspb/docker-scanner /bin/bash\n```\n\nand then, inside container, run:\n\n```\ntrivy image --format template --template \"@${TRIVY_TPL_JUNIT}\" -o junit-report.xml \n```\n\n## Dockle scan\n\nPull this image from DockerHub by invoking this command:\n\n```\ndocker pull thunderspb/docker-scanner\n```\n\nor you can pull it from GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\nAttach to pulled container with mounting docker socket:\n\n```\ndocker run -ti --rm --name docker-scanner \\\n -v ${PWD}:/work -w /work \\\n -v /var/run/docker.sock:/var/run/docker.sock \\\n thunderspb/docker-scanner /bin/bash\n```\n\nand then, inside container, just run:\n\n```\ndockle thunderspb/docker-scanner\n```\n\n### `dockle2junit` converter\n\nIn order to use this tool, you must run `dockle` with `--format json --output filename.json` arguments.\n\nAfter you got Dockle report in JSON, you can invoke `dockle2junit`:\n\n```\ndockle2junit -in-file filename.json -out-file junit-report.xml -image-name my/imagename:tag\n```\n\n`-image-name` -- to add scanned image name into report for convenience.\n\nHere is an example of Dockle scan results in JSON format for this (`thunderspb/docker-scanner`) image:\n\n```json\n{\n \"summary\": {\n \"fatal\": 0,\n \"warn\": 2,\n \"info\": 2,\n \"skip\": 0,\n \"pass\": 12\n },\n \"details\": [\n {\n \"code\": \"CIS-DI-0001\",\n \"title\": \"Create a user for the container\",\n \"level\": \"WARN\",\n \"alerts\": [\"Last user should not be root\"]\n },\n {\n \"code\": \"DKL-DI-0006\",\n \"title\": \"Avoid latest tag\",\n \"level\": \"WARN\",\n \"alerts\": [\"Avoid 'latest' tag\"]\n },\n {\n \"code\": \"CIS-DI-0005\",\n \"title\": \"Enable Content trust for Docker\",\n \"level\": \"INFO\",\n \"alerts\": [\"export DOCKER_CONTENT_TRUST=1 before docker pull/build\"]\n },\n {\n \"code\": \"CIS-DI-0006\",\n \"title\": \"Add HEALTHCHECK instruction to the container image\",\n \"level\": \"INFO\",\n \"alerts\": [\"not found HEALTHCHECK statement\"]\n }\n ]\n}\n```\n\nAnd an example of generated JUnit report by `dockle2junit` binary:\n\n```xml\n\n\n \n \n \n Last user should not be root\n \n \n Avoid 'latest' tag\n \n \n export DOCKER_CONTENT_TRUST=1 before docker pull/build\n \n \n not found HEALTHCHECK statement\n \n \n\n```\n\nNow, you can order your CI system consume this file :)\n\n## Hadolint scan\n\nThis tool scans Dockerfile, not the image, so working directory should contain your Dockerfile.\n\nPull this image from DockerHub by invoking this command:\n\n```\ndocker pull thunderspb/docker-scanner\n```\n\nor you can pull it from GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\nAttach to pulled container with mounting docker socket:\n\n```\ndocker run -ti --rm --name docker-scanner \\\n -v ${PWD}:/work -w /work \\\n thunderspb/docker-scanner /bin/bash\n```\n\nand then, inside container, just run:\n\n```\nhadolint Dockerfile\n```\n\n### `hadolint2junit` converter\n\nIn order to use this tool, you must run `hadolint` with `--format json` arguments and redirect its output to some file, like this:\n\n```\nhadolint --format json Dockerfile > hadolint-docker-scanner.json\n```\n\nAfter you got Hadolint report in JSON, you can invoke `hadolint2junit`:\n\n```\nhadolint2junit -in-file hadolint-docker-scanner.json -out-file junit-hadolint-docker-scanner.xml\n```\n\nHere is an example of Hadolint scan results in JSON format for `Dockerfile` of this (`thunderspb/docker-scanner`) image:\n\n```json\n[\n {\n \"line\": 16,\n \"code\": \"DL3018\",\n \"message\": \"Pin versions in apk add. Instead of `apk add ` use `apk add =`\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 20,\n \"code\": \"DL3003\",\n \"message\": \"Use WORKDIR to switch to a directory\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 20,\n \"code\": \"DL4006\",\n \"message\": \"Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 26,\n \"code\": \"DL3003\",\n \"message\": \"Use WORKDIR to switch to a directory\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 26,\n \"code\": \"DL4006\",\n \"message\": \"Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 34,\n \"code\": \"DL3003\",\n \"message\": \"Use WORKDIR to switch to a directory\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n }\n]\n```\n\nAnd an example of generated JUnit report by `hadolint2junit` binary:\n\n```xml\n\n\n \n \n \n Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`\n \n \n Use WORKDIR to switch to a directory\n \n \n Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\n \n \n Use WORKDIR to switch to a directory\n \n \n Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\n \n \n Use WORKDIR to switch to a directory\n \n \n\n```\n\nNow, you can order your CI system consume this file :)\n\n# Github home\n\nSources: https://github.com/thunder-spb/dh-docker-scanner\n\n# GitHub Registry\n\nHere is the link on GitHub Container Registry: https://github.com/users/thunder-spb/packages/container/package/docker-scanner\n\n# Docker Hub home\n\nHere is the link on Docker Hub: https://hub.docker.com/r/thunderspb/docker-scanner\n","has_starred","hub_user","immutable_tags_settings",{"_70":11,"_71":72},"enabled","rules",[73],".*","is_automated","permissions",{"_77":17,"_78":11,"_79":11},"read","write","admin","user","storage_size",332849923,"orgData","recentTags",[86,123],{"_87":39,"_88":89,"_90":91,"_92":93,"_94":95,"_45":112,"_113":89,"_114":28,"_115":51,"_52":116,"_117":118,"_119":103,"_120":112,"_121":61,"_122":17},"content_type","creator",3594436,"full_size",26544200,"id",133803452,"images",[96],{"_97":98,"_99":100,"_101":43,"_102":103,"_104":105,"_106":107,"_108":43,"_109":-5,"_110":91,"_58":61,"_111":-5},"architecture","amd64","digest","sha256:a6b6b6a7053eae352ad6f15d7fa841a7761bd1916cc2498a42f875bcb64cc92c","features","last_pulled","2026-09-15T06:17:55.157249292Z","last_pushed","2021-02-08T12:22:05Z","os","linux","os_features","os_version","size","variant","2021-02-08T14:04:36.997411Z","last_updater","last_updater_username","media_type","latest","repository",10804105,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_87":39,"_88":89,"_90":124,"_92":125,"_94":126,"_45":131,"_113":89,"_114":28,"_115":51,"_52":132,"_117":118,"_119":129,"_120":131,"_121":61,"_122":17},26543382,134931711,[127],{"_97":98,"_99":128,"_101":43,"_102":129,"_104":130,"_106":107,"_108":43,"_109":-5,"_110":124,"_58":61,"_111":-5},"sha256:374afbcdab00c003863e55286bc891ea9c9b38b402a7b02b80afe6acbe9f32a2","2026-09-15T14:40:44.112981505Z","2021-01-27T11:02:54Z","2021-01-27T11:02:53.754155Z","1.0.0","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.builds",{"_26":11,"_31":-5},"actionData","errors"]