# Docker Scanning Knowledge > Docker image scanning knowledge base. Provides vulnerability detection, compliance checking, and SBOM generation for PHP container images. Use when this capability is needed. - Skill: `tomevault-io/docker-scanning-knowledge` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/docker-scanning-knowledge` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/docker-scanning-knowledge/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: DevOps & Infra - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/docker-scanning-knowledge --- # Docker Image Scanning Knowledge Base Quick reference for vulnerability scanning and compliance checking in PHP container images. ## Scanning Tools Comparison | Tool | Type | License | Strengths | |------|------|---------|-----------| | **Trivy** | CLI, CI, Operator | Apache 2.0 | OS + app deps, IaC, SBOM, fast | | **Grype** | CLI, CI | Apache 2.0 | Fast, Syft integration, accurate | | **Snyk** | CLI, CI, IDE, Web | Commercial | Deep analysis, fix suggestions | | **Docker Scout** | CLI, Desktop | Commercial | Docker-native, real-time, policy | ## Trivy ### Basic Scanning ```bash # Scan image for vulnerabilities trivy image myapp:latest # Scan with severity filter trivy image --severity HIGH,CRITICAL myapp:latest # Scan and fail on threshold (for CI) trivy image --exit-code 1 --severity CRITICAL myapp:latest # Scan with specific format trivy image --format json --output results.json myapp:latest trivy image --format table myapp:latest trivy image --format sarif --output results.sarif myapp:latest ``` ### Scanning Dockerfile ```bash # Scan Dockerfile for misconfigurations trivy config Dockerfile # Scan entire project config trivy config . ``` ### SBOM Generation ```bash # Generate SBOM in CycloneDX format trivy image --format cyclonedx --output sbom.json myapp:latest # Generate SBOM in SPDX format trivy image --format spdx-json --output sbom.spdx.json myapp:latest ``` ## Grype ### Basic Scanning ```bash # Scan image grype myapp:latest # Fail on severity grype myapp:latest --fail-on high # Output as JSON grype myapp:latest -o json > results.json # Scan from SBOM syft myapp:latest -o spdx-json > sbom.json grype sbom:sbom.json ``` ### Syft SBOM Generation ```bash # Generate SBOM with Syft syft myapp:latest -o cyclonedx-json > sbom.cyclonedx.json syft myapp:latest -o spdx-json > sbom.spdx.json syft myapp:latest -o table ``` ## Docker Scout ```bash # Analyze image vulnerabilities docker scout cves myapp:latest # Get fix recommendations docker scout recommendations myapp:latest # Compare two images docker scout compare myapp:latest myapp:previous # View SBOM docker scout sbom myapp:latest ``` ## CI Integration Patterns ### GitHub Actions ```yaml name: Security Scan on: push: branches: [main] pull_request: branches: [main] jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Build image run: docker build -t myapp:${{ github.sha }} . - name: Trivy vulnerability scan uses: aquasecurity/trivy-action@master with: image-ref: myapp:${{ github.sha }} format: sarif output: trivy-results.sarif severity: CRITICAL,HIGH exit-code: 1 - name: Upload scan results uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: trivy-results.sarif - name: Generate SBOM uses: aquasecurity/trivy-action@master with: image-ref: myapp:${{ github.sha }} format: cyclonedx output: sbom.json - name: Upload SBOM uses: actions/upload-artifact@v4 with: name: sbom path: sbom.json ``` ### GitLab CI ```yaml container_scanning: stage: test image: name: aquasec/trivy:latest entrypoint: [""] variables: IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA script: - trivy image --exit-code 0 --format template --template "@/contrib/gitlab.tpl" --output gl-container-scanning-report.json $IMAGE - trivy image --exit-code 1 --severity CRITICAL $IMAGE artifacts: reports: container_scanning: gl-container-scanning-report.json allow_failure: false ``` ## SBOM Formats | Format | Standard | Use Case | |--------|----------|----------| | **CycloneDX** | OWASP | Security-focused, VEX support | | **SPDX** | Linux Foundation | License compliance, legal | | **Syft JSON** | Anchore | Tool-specific, detailed | ### PHP-Specific SBOM Content An SBOM for a PHP container should include: | Component | Source | Example | |-----------|--------|---------| | OS packages | Alpine apk / Debian apt | `libzip`, `icu-libs` | | PHP extensions | `docker-php-ext-install` | `pdo_mysql`, `opcache` | | Composer packages | `composer.lock` | `symfony/http-kernel` | | Node packages | `package-lock.json` | Build-time only | | Binary tools | Installed in Dockerfile | `composer`, `nginx` | ## Compliance Policies ### Severity Classification | Severity | CVSS | Action | SLA | |----------|------|--------|-----| | **Critical** | 9.0-10.0 | Block deployment, fix immediately | 24 hours | | **High** | 7.0-8.9 | Block deployment, prioritize fix | 7 days | | **Medium** | 4.0-6.9 | Allow deployment, schedule fix | 30 days | | **Low** | 0.1-3.9 | Allow deployment, backlog | 90 days | | **Negligible** | 0.0 | Allow deployment, info only | N/A | ### Policy Configuration (Trivy) ```yaml # .trivy.yaml severity: - CRITICAL - HIGH exit-code: 1 ignore-unfixed: true ignorefile: .trivyignore ``` ``` # .trivyignore # Accepted risks with justification CVE-2023-XXXXX # Mitigated by WAF rules, not exploitable in our context CVE-2023-YYYYY # Fix not available, monitoring for update ``` ## Fix Strategies | Strategy | When | Example | |----------|------|---------| | **Upgrade base image** | OS-level CVE | `FROM php:8.4-fpm-alpine3.20` | | **Update PHP version** | PHP CVE | `FROM php:8.4.3-fpm-alpine` | | **Update Composer deps** | Library CVE | `composer update --with-dependencies` | | **Pin fixed version** | Specific package | `apk add libcurl=8.5.0-r0` | | **Remove package** | Unnecessary dep | Remove from Dockerfile | | **Accept risk** | No fix available | Document in `.trivyignore` | ## Automated Scanning Workflow ``` +---------------------------------------------------------------------------+ | SCANNING WORKFLOW | +---------------------------------------------------------------------------+ | | | Developer Push | | | | | v | | Build Image --> Scan Image --> Generate SBOM --> Policy Check | | | | | | | | | +----+----+ | +----+----+ | | | | Pass | Fail | | Pass | Fail | | | v v | v v | | | Continue Block PR | Deploy Block Deploy | | | | | | | | v v v v | | Push to Merge to Store SBOM Production | | Registry Main Branch in Registry Monitoring | | | +---------------------------------------------------------------------------+ ``` ## Detection Patterns ```bash # Find scanning configurations Glob: **/.trivy.yaml Glob: **/.trivyignore Glob: **/.grype.yaml Glob: **/.snyk # Check CI for scanning steps Grep: "trivy|grype|snyk|docker scout" --glob "**/.github/workflows/*.yml" Grep: "container_scanning|security_scan" --glob "**/.gitlab-ci.yml" # Find SBOM artifacts Glob: **/sbom*.json Glob: **/*.spdx.json Glob: **/*.cyclonedx.json ``` --- > Converted and distributed by [TomeVault](https://tomevault.io/claim/dykyi-roman) — claim your Tome and manage your conversions.