Docker Security Scanning: A Complete Guide to Container Security

Container security scanning is crucial for identifying vulnerabilities and ensuring compliance in containerized applications. This guide explores tools and best practices for implementing comprehensive security scanning in your Docker environment.

Security Scanning Overview

Scanning Tools Comparison

Implementation Guide

Trivy Integration

# .github/workflows/security-scan.yml
name: Security Scan

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
          format: 'table'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'

Snyk Container Scanning

// snyk.config.js
module.exports = {
  docker: {
    baseImage: 'node:16-alpine',
    dockerfilePath: './Dockerfile',
    excludeBaseImageVulns: false,
    severityThreshold: 'high',
    ignorePatterns: [
      'SNYK-DEBIAN-OPENSSL-*',
      'SNYK-ALPINE-OPENSSL-*'
    ]
  },
  failOnIssues: true,
  org: 'my-org-name'
};

Vulnerability Management

Scanning Configuration

# trivy.yaml
scan:
  # Vulnerability scanning
  vulnerability:
    type:
      - os
      - library
    ignore-unfixed: true
    severity:
      - CRITICAL
      - HIGH
  
  # Misconfiguration scanning
  config:
    include:
      - kubernetes
      - dockerfile
    severity:
      - CRITICAL
      - HIGH
      - MEDIUM
  
  # Secret scanning
  secret:
    enable: true

Security Policies

CI/CD Integration

GitHub Actions Integration

# .github/workflows/container-security.yml
name: Container Security

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      
      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .
      
      - name: Scan with Trivy
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Upload scan results
        uses: github/codeql-action/upload-sarif@v1
        with:
          sarif_file: 'trivy-results.sarif'
      
      - name: Scan with Snyk
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: myapp:${{ github.sha }}
          args: --severity-threshold=high

Jenkins Pipeline

// Jenkinsfile
pipeline {
    agent any
    
    environment {
        DOCKER_IMAGE = 'myapp:${BUILD_NUMBER}'
    }
    
    stages {
        stage('Build') {
            steps {
                sh 'docker build -t ${DOCKER_IMAGE} .'
            }
        }
        
        stage('Security Scan') {
            parallel {
                stage('Trivy') {
                    steps {
                        sh '''
                            trivy image \
                                --exit-code 1 \
                                --severity HIGH,CRITICAL \
                                --no-progress \
                                ${DOCKER_IMAGE}
                        '''
                    }
                }
                
                stage('Snyk') {
                    steps {
                        snykSecurity(
                            snykInstallation: 'snyk',
                            snykTokenId: 'snyk-api-token',
                            targetFile: 'Dockerfile',
                            dockerImage: "${DOCKER_IMAGE}",
                            severity: 'high',
                            failOnIssues: true
                        )
                    }
                }
            }
        }
    }
}

Runtime Security

Container Runtime Scanning

# falco-rules.yaml
- rule: Detect Shell in Container
  desc: Alert on shell execution in container
  condition: >
    container.id != host and
    proc.name = bash
  output: Shell executed in container (user=%user.name container=%container.name)
  priority: WARNING

- rule: Package Management Execution
  desc: Package management execution in container
  condition: >
    container.id != host and
    (proc.name = apt or proc.name = apk or proc.name = yum)
  output: Package management command executed in container (user=%user.name command=%proc.cmdline)
  priority: WARNING

Runtime Monitoring

Compliance and Auditing

CIS Docker Benchmark

#!/bin/bash

# Run Docker Bench Security
docker run --rm -v /var:/var \
    -v /usr/bin/docker:/usr/bin/docker \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -v /etc:/etc --label docker_bench_security \
    docker/docker-bench-security

# Parse results
docker run --rm \
    -v $(pwd)/results:/results \
    docker/docker-bench-security -l /results/bench.log

Compliance Checks

Best Practices

Security Guidelines

1. Base Image Selection

   # Use specific version tags
   FROM alpine:3.17.0
   
   # Add security packages
   RUN apk add --no-cache \
       ca-certificates \
       tzdata \
       && update-ca-certificates
   
   # Create non-root user
   RUN addgroup -S appgroup && adduser -S appuser -G appgroup
   USER appuser
   

2. Dependency Management

   {
     "name": "secure-app",
     "version": "1.0.0",
     "dependencies": {
       "express": "4.18.2"
     },
     "scripts": {
       "security-audit": "npm audit",
       "update-deps": "npm update"
     }
   }
   

Troubleshooting Guide

Common Issues

References

1. Docker Security Documentation
2. Trivy Documentation
3. Snyk Container Security
4. CIS Docker Benchmark
5. Container Security Best Practices
6. NIST Container Security Guide

Related Posts

• Docker Desktop Alternatives - Development environment
• Docker Compose V2 - Container orchestration
• Docker Multi-stage Builds - Build optimization
• Docker Kubernetes Integration - Container orchestration