[{"_1":2,"_175":-5,"_176":-5},"loaderData",{"_3":4,"_17":18,"_24":25,"_150":151},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":11,"_23":21},"username","isAskGordonEnabled",true,"showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_26":27,"_28":-5,"_29":11,"_30":11,"_31":32,"_33":34,"_35":-5,"_36":11,"_37":38,"_87":-5,"_88":89,"_137":-5,"_138":11,"_139":21,"_140":11,"_141":11,"_142":11,"_143":-5,"_144":11,"_145":-5,"_146":147,"_148":90,"_149":-7},"canonicalUrl","https://hub.docker.com/r/thunderspb/docker-scanner/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","thunderspb","reponame","docker-scanner","cloudBuildSource","isAutobuildsAvailable","repo",{"_39":40,"_41":42,"_44":45,"_46":47,"_48":11,"_49":50,"_51":52,"_53":54,"_56":34,"_31":32,"_57":58,"_59":43,"_60":61,"_62":63,"_64":65,"_66":-5,"_67":61,"_68":69,"_70":11,"_71":32,"_72":73,"_78":11,"_79":80,"_84":32,"_85":86},"categories",[],"content_types",[43],"image","date_registered","2021-01-19T11:18:08.833101Z","description","","is_private","last_updated","2021-02-08T14:04:37.267788Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[55],"application/vnd.docker.container.image.v1+json","name","pull_count",556,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Docker Container Scanner\n\n[![GitHub last commit](https://img.shields.io/github/last-commit/thunder-spb/dh-docker-scanner?style=flat-square)](https://github.com/thunder-spb/dh-docker-scanner/commits/master)\n[![Docker Image Version (latest semver)](https://img.shields.io/docker/v/thunderspb/docker-scanner?style=flat-square&sort=semver)](https://hub.docker.com/r/thunderspb/docker-scanner/tags)\n[![Docker Image Size (latest semver)](https://img.shields.io/docker/image-size/thunderspb/docker-scanner?style=flat-square&sort=semver)](https://hub.docker.com/r/thunderspb/docker-scanner)\n[![Docker Pulls](https://img.shields.io/docker/pulls/thunderspb/docker-scanner?style=flat-square)](https://hub.docker.com/r/thunderspb/docker-scanner)\n[![Docker Automated build](https://img.shields.io/docker/automated/thunderspb/docker-scanner?style=flat-square)](https://hub.docker.com/r/thunderspb/docker-scanner/builds)\n[![HitCount](http://hits.dwyl.com/thunderspb/dh-docker-scanner.svg)](http://hits.dwyl.com/thunderspb/dh-docker-scanner)\n[![Go Report Card](https://goreportcard.com/badge/github.com/thunder-spb/dh-docker-scanner?style=flat-square)](https://goreportcard.com/report/github.com/thunder-spb/dh-docker-scanner)\n\nThis container include Docker Image Scanner tools like [Trivy](https://github.com/aquasecurity/trivy/) and [Dockle](https://github.com/goodwithtech/dockle/). For Dockerfile linting this image include [hadolint](https://github.com/hadolint/hadolint/)\n\nAs a bonus, this image also has 2 binaries which help to convert Dockle and Hadolint JSON output into JUnit report -- `dockle2junit` and `hadolint2junit`. Both located in `/usr/bin`. See usage examples below.\n\nSource code of those tools you can find under `scripts/convert2junit` directory.\n\nImage available on DockerHub:\n\n```\ndocker pull thunderspb/docker-scanner:latest\n```\n\nand on GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\n# What is Trivy\n\n> A Simple and Comprehensive Vulnerability Scanner for Containers and other Artifacts, Suitable for CI.\n\nProject homepage and documentation is here: https://github.com/aquasecurity/trivy/\n\nIn addition, this image include JUnit report template to generate JUnit XML Report, which could be consumed by CI system, like Jenkins.\n\n# What is Dockle\n\n> Dockle - Container Image Linter for Security, Helping build the Best-Practice Docker Image, Easy to start\n\nThis tool do two types of checks:\n\n- Following official [Best Practices](https://docs.docker.com/develop/develop-images/dockerfile_best-practices/)\n- [CIS Benchmarks](https://www.cisecurity.org/cis-benchmarks/)\n\nProject homepage and documentation is here: https://github.com/goodwithtech/dockle/\n\n# What is Hadolint\n\n> A smarter Dockerfile linter that helps you build [best practice](https://docs.docker.com/engine/userguide/eng-image/dockerfile_best-practices) Docker images. The linter is parsing the Dockerfile into an AST and performs rules on top of the AST. It is standing on the shoulders of [ShellCheck](https://github.com/koalaman/shellcheck) to lint the Bash code inside `RUN` instructions.\n\nProject homepage and documentation is here: https://github.com/hadolint/hadolint/\n\n# Versions\n\n- Alpine version: _3.12_\n- Trivy (`trivy`) version: _0.15.0_, Home: https://github.com/aquasecurity/trivy/\n- Dockle (`dockle`) version: _0.3.1_, Home: https://github.com/goodwithtech/dockle/\n- Hadolint (`hadolint`) version: _1.19.0_, Home: https://github.com/hadolint/hadolint/\n- Dockle and Hadolint converters (`dockle2junit`, `hadolint2junit`) -- not versioned, Home: https://github.com/thunder-spb/dh-docker-scanner/tree/master/scripts/convert2junit\n\n# Usage\n\nHere is some examples on how to run scans within this container.\n\n## Trivy scan\n\nPull this image from DockerHub by invoking this command:\n\n```\ndocker pull thunderspb/docker-scanner\n```\n\nor you can pull it from GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\nAttach to pulled container with mounting docker socket:\n\n```\ndocker run -ti --rm --name docker-scanner \\\n -v ${PWD}:/work -w /work \\\n -v /var/run/docker.sock:/var/run/docker.sock \\\n thunderspb/docker-scanner /bin/bash\n```\n\nand then, inside container, run:\n\n```\ntrivy image --format template --template \"@${TRIVY_TPL_JUNIT}\" -o junit-report.xml \n```\n\n## Dockle scan\n\nPull this image from DockerHub by invoking this command:\n\n```\ndocker pull thunderspb/docker-scanner\n```\n\nor you can pull it from GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\nAttach to pulled container with mounting docker socket:\n\n```\ndocker run -ti --rm --name docker-scanner \\\n -v ${PWD}:/work -w /work \\\n -v /var/run/docker.sock:/var/run/docker.sock \\\n thunderspb/docker-scanner /bin/bash\n```\n\nand then, inside container, just run:\n\n```\ndockle thunderspb/docker-scanner\n```\n\n### `dockle2junit` converter\n\nIn order to use this tool, you must run `dockle` with `--format json --output filename.json` arguments.\n\nAfter you got Dockle report in JSON, you can invoke `dockle2junit`:\n\n```\ndockle2junit -in-file filename.json -out-file junit-report.xml -image-name my/imagename:tag\n```\n\n`-image-name` -- to add scanned image name into report for convenience.\n\nHere is an example of Dockle scan results in JSON format for this (`thunderspb/docker-scanner`) image:\n\n```json\n{\n \"summary\": {\n \"fatal\": 0,\n \"warn\": 2,\n \"info\": 2,\n \"skip\": 0,\n \"pass\": 12\n },\n \"details\": [\n {\n \"code\": \"CIS-DI-0001\",\n \"title\": \"Create a user for the container\",\n \"level\": \"WARN\",\n \"alerts\": [\"Last user should not be root\"]\n },\n {\n \"code\": \"DKL-DI-0006\",\n \"title\": \"Avoid latest tag\",\n \"level\": \"WARN\",\n \"alerts\": [\"Avoid 'latest' tag\"]\n },\n {\n \"code\": \"CIS-DI-0005\",\n \"title\": \"Enable Content trust for Docker\",\n \"level\": \"INFO\",\n \"alerts\": [\"export DOCKER_CONTENT_TRUST=1 before docker pull/build\"]\n },\n {\n \"code\": \"CIS-DI-0006\",\n \"title\": \"Add HEALTHCHECK instruction to the container image\",\n \"level\": \"INFO\",\n \"alerts\": [\"not found HEALTHCHECK statement\"]\n }\n ]\n}\n```\n\nAnd an example of generated JUnit report by `dockle2junit` binary:\n\n```xml\n\n\n \n \n \n Last user should not be root\n \n \n Avoid 'latest' tag\n \n \n export DOCKER_CONTENT_TRUST=1 before docker pull/build\n \n \n not found HEALTHCHECK statement\n \n \n\n```\n\nNow, you can order your CI system consume this file :)\n\n## Hadolint scan\n\nThis tool scans Dockerfile, not the image, so working directory should contain your Dockerfile.\n\nPull this image from DockerHub by invoking this command:\n\n```\ndocker pull thunderspb/docker-scanner\n```\n\nor you can pull it from GitHub Container Registry:\n\n```\ndocker pull ghcr.io/thunder-spb/docker-scanner:latest\n```\n\nAttach to pulled container with mounting docker socket:\n\n```\ndocker run -ti --rm --name docker-scanner \\\n -v ${PWD}:/work -w /work \\\n thunderspb/docker-scanner /bin/bash\n```\n\nand then, inside container, just run:\n\n```\nhadolint Dockerfile\n```\n\n### `hadolint2junit` converter\n\nIn order to use this tool, you must run `hadolint` with `--format json` arguments and redirect its output to some file, like this:\n\n```\nhadolint --format json Dockerfile > hadolint-docker-scanner.json\n```\n\nAfter you got Hadolint report in JSON, you can invoke `hadolint2junit`:\n\n```\nhadolint2junit -in-file hadolint-docker-scanner.json -out-file junit-hadolint-docker-scanner.xml\n```\n\nHere is an example of Hadolint scan results in JSON format for `Dockerfile` of this (`thunderspb/docker-scanner`) image:\n\n```json\n[\n {\n \"line\": 16,\n \"code\": \"DL3018\",\n \"message\": \"Pin versions in apk add. Instead of `apk add ` use `apk add =`\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 20,\n \"code\": \"DL3003\",\n \"message\": \"Use WORKDIR to switch to a directory\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 20,\n \"code\": \"DL4006\",\n \"message\": \"Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 26,\n \"code\": \"DL3003\",\n \"message\": \"Use WORKDIR to switch to a directory\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 26,\n \"code\": \"DL4006\",\n \"message\": \"Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n },\n {\n \"line\": 34,\n \"code\": \"DL3003\",\n \"message\": \"Use WORKDIR to switch to a directory\",\n \"column\": 1,\n \"file\": \"Dockerfile\",\n \"level\": \"warning\"\n }\n]\n```\n\nAnd an example of generated JUnit report by `hadolint2junit` binary:\n\n```xml\n\n\n \n \n \n Pin versions in apk add. Instead of `apk add <package>` use `apk add <package>=<version>`\n \n \n Use WORKDIR to switch to a directory\n \n \n Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\n \n \n Use WORKDIR to switch to a directory\n \n \n Set the SHELL option -o pipefail before RUN with a pipe in it. If you are using /bin/sh in an alpine image or if your shell is symlinked to busybox then consider explicitly setting your SHELL to /bin/ash, or disable this check\n \n \n Use WORKDIR to switch to a directory\n \n \n\n```\n\nNow, you can order your CI system consume this file :)\n\n# Github home\n\nSources: https://github.com/thunder-spb/dh-docker-scanner\n\n# GitHub Registry\n\nHere is the link on GitHub Container Registry: https://github.com/users/thunder-spb/packages/container/package/docker-scanner\n\n# Docker Hub home\n\nHere is the link on Docker Hub: https://hub.docker.com/r/thunderspb/docker-scanner\n","has_starred","hub_user","immutable_tags_settings",{"_74":11,"_75":76},"enabled","rules",[77],".*","is_automated","permissions",{"_81":21,"_82":11,"_83":11},"read","write","admin","user","storage_size",332849923,"orgData","recentTags",[90,127],{"_91":43,"_92":93,"_94":95,"_96":97,"_98":99,"_49":116,"_117":93,"_118":32,"_119":55,"_56":120,"_121":122,"_123":107,"_124":116,"_125":65,"_126":21},"content_type","creator",3594436,"full_size",26544200,"id",133803452,"images",[100],{"_101":102,"_103":104,"_105":47,"_106":107,"_108":109,"_110":111,"_112":47,"_113":-5,"_114":95,"_62":65,"_115":-5},"architecture","amd64","digest","sha256:a6b6b6a7053eae352ad6f15d7fa841a7761bd1916cc2498a42f875bcb64cc92c","features","last_pulled","2026-11-09T13:08:26.081766567Z","last_pushed","2021-02-08T12:22:05Z","os","linux","os_features","os_version","size","variant","2021-02-08T14:04:36.997411Z","last_updater","last_updater_username","media_type","latest","repository",10804105,"tag_last_pulled","tag_last_pushed","tag_status","v2",{"_91":43,"_92":93,"_94":128,"_96":129,"_98":130,"_49":135,"_117":93,"_118":32,"_119":55,"_56":136,"_121":122,"_123":133,"_124":135,"_125":65,"_126":21},26543382,134931711,[131],{"_101":102,"_103":132,"_105":47,"_106":133,"_108":134,"_110":111,"_112":47,"_113":-5,"_114":128,"_62":65,"_115":-5},"sha256:374afbcdab00c003863e55286bc891ea9c9b38b402a7b02b80afe6acbe9f32a2","2026-11-10T08:05:30.558069118Z","2021-01-27T11:02:54Z","2021-01-27T11:02:53.754155Z","1.0.0","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxRunInCloud","showSbxAgenticPlatformBadge","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_37":152,"_159":160,"_146":173,"_174":11},{"_39":153,"_41":154,"_44":45,"_46":47,"_48":11,"_49":50,"_51":52,"_53":155,"_56":34,"_31":32,"_57":58,"_59":43,"_60":61,"_62":63,"_64":65,"_66":-5,"_67":61,"_68":69,"_70":11,"_71":32,"_72":156,"_78":11,"_79":158,"_84":32,"_85":86},[],[43],[55],{"_74":11,"_75":157},[77],{"_81":21,"_82":11,"_83":11},"tags",{"_161":162,"_163":-5,"_164":-5,"_165":166},"count",2,"next","previous","results",[167,170],{"_91":43,"_92":93,"_94":95,"_96":97,"_98":168,"_49":116,"_117":93,"_118":32,"_119":55,"_56":120,"_121":122,"_123":107,"_124":116,"_125":65,"_126":21},[169],{"_101":102,"_103":104,"_105":47,"_106":107,"_108":109,"_110":111,"_112":47,"_113":-5,"_114":95,"_62":65,"_115":-5},{"_91":43,"_92":93,"_94":128,"_96":129,"_98":171,"_49":135,"_117":93,"_118":32,"_119":55,"_56":136,"_121":122,"_123":133,"_124":135,"_125":65,"_126":21},[172],{"_101":102,"_103":132,"_105":47,"_106":133,"_108":134,"_110":111,"_112":47,"_113":-5,"_114":128,"_62":65,"_115":-5},[],"canDeleteTags","actionData","errors"]

thunderspb/docker-scanner

Tags for thunderspb/docker-scanner