# docker-image-scanner

Utility for scanning Docker images for security vulnerabilities.

Scans are implemented using the [ScanSbom](https://docs.aws.amazon.com/inspector/v2/APIReference/API_scan_ScanSbom.html) Inspector API, in conjunction with the 
[Amazon Inspector SBOM Generator](https://docs.aws.amazon.com/inspector/latest/user/sbom-generator.html). The results produced are consistent with the results of the scans performed by Amazon Inspector when an image is pushed to ECR, whilst also allowing for exceptions to be made based on various conditions.

## Usage

Save the Docker image to be scanned to a tarball:

```
docker save 086679231553.dkr.ecr.us-east-1.amazonaws.com/docker-parent-images:debian12 -o image.tar
```

Copy `.env.shadow` to `.env` and set `IMAGE_PATH` to the local path of the tarball (can be relative or absolute).

Generate AWS credentials using e.g. `awsume`.

Scan the Docker image:

```
docker compose run --rm docker-image-scanner
```

Optionally, set `FINDINGS_OUTPUT_FILE` in `.env` to also write the findings table to a file at the given path.