• Skip to primary navigation
  • Skip to main content
Alexandre Vazquez
  • Home
  • TIBCO
    • TIBCO BusinessWorks
    • Flogo
    • TIBFAQS
  • Architecture
    • API
    • Security
    • Integration
    • Event Processing
  • Kubernetes
  • Monitoring
    • Observability
    • Prometheus
    • Log Aggregation
      • Loki
  • Service Mesh
    • Istio
  • Helm
  • Editorial
  • About Me

How to Scan Docker Images in Your Local Machine

Published on 2020-11-13. Last Updated on 2022-05-09 by Alexandre Vazquez

Learn how you can leverage the use of Snyk inside your Docker engine installation

View From A Mountain
Photo by Alberto Restifo on Unsplash.

Security is the most relevant topic in modern architecture. It needs to be handled from all different perspectives. Having a single team auditing the platforms and the developments that we built is not enough.

The introduction of DevSecOps as the new normal, including the security teams and policies being part of the development process to avoid security becoming a blocker of innovation and make sure that the artifacts we deploy are secured, have made this clear.

Docker image scanning is one of the most important topics we can cover regarding the container images to know that all the internal components that are part of the image are safe from vulnerabilities. We usually rely on some systems to do so.

I wrote an article regarding the usage of one of the most relevant options (Harbor) from the open source world to do this job.

And this is also being done by different Docker repositories from cloud providers like Amazon ECR as of this year. But why do we need to wait until we push the images to an external Docker registry? Why can’t we do it in our local environment?

Now we can. Version 2.5.0.1 of the Docker engine also includes the Snyk components needed to inspect the Docker images directly from the command line:

Combining Snyk Scans in Docker Desktop and Docker Hub to Deploy Secure Containers


Scanning Your Local Images

So, let’s start. Let’s open a new terminal and type the following command:

docker scan <image-name>

As soon as we type this, the command will tell us that this scanning process will use Snyk to do that and we need to authorize access to those services to do the scanning process.

After that, we get a list of all the vulnerabilities detected, as you can see in the picture below:

Vulnerability Scanning
Vulnerability Scanning Using Your Local Docker&Nbsp;Client

For each of the vulnerabilities, you can see the following data:

Vulnerability Info
Detailed Information Provided For Each Of The Vulnerabilities Detected

We get the library with the vulnerability, the severity level, and a short description of it. If you need more details, you can also check the provided URL that is linked to a description page for that vulnerability:

Vulnerabilities Page
Vulnerability Detailed Page From&Nbsp;Snyk

Finally, it also provides the sources introducing this library in your image so this can be solved quickly.

It provides a high-level view of the whole image too, as you can see here:

Overview Of Docker Images
Overview Of Your Docker Images With All The Vulnerabilities Detected

So, now you don’t have any excuse to not have all your images safe and secure before pushing to your local repository. Let’s do it!

If you find this content interesting please think about making a contribution using the button below to keep this content updated and increased!


Related articles:

Improving Development Security With These Open Source ToolsImproving Development Security With These Open Source Tools Harbor Registry: How To Use To Increase Security On Your Platform?Harbor Registry: How to use to increase security on your platform? From Docker Desktop To Rancher Desktop: Quick And SimpleFrom Docker Desktop to Rancher Desktop: Quick and Simple How To Analyze And Improve The Size Of Your Docker Images?How to analyze and improve the size of your docker images?

Copyright © 2023 · Custom on Genesis Framework · WordPress · Log in