Docker Security Scan

Comprehensively scans Docker containers and images for vulnerabilities, misconfigurations, and security best practices violations. Identifies CVEs in base images and dependencies, insecure configurations, exposed secrets, and privilege escalation risks.

What This Command Does

Complete Container Security Analysis:

• Scans images for known CVEs (vulnerabilities in OS packages and dependencies)
• Detects insecure Dockerfile configurations
• Identifies exposed secrets (API keys, passwords, tokens)
• Checks for privileged containers and excessive permissions
• Validates security best practices (non-root user, minimal base image)
• Analyzes running containers for runtime security issues

Output: Detailed security report with severity-rated findings and remediation steps

Time: 5-10 minutes per image/container

When to Use This Command

Perfect For:

• Pre-deployment container security validation
• CI/CD pipeline security gates
• Production container audits
• Kubernetes pod security review
• Docker Compose security assessment

Use This When:

• Building new container images
• Before deploying to production
• After updating base images
• Regular security audits (weekly/monthly)
• Investigating security incidents

Usage

# Scan a Docker image
/docker-security-scan myapp:latest

# Scan running container
/docker-security-scan --container myapp-prod

# Scan all images
/docker-security-scan --all-images

# Scan with detailed output
/docker-security-scan myapp:latest --verbose

# Scan and generate report
/docker-security-scan myapp:latest --output report.md

Shortcut:

/dss myapp:latest  # Quick scan

What Gets Scanned

1. Image Vulnerabilities (CVEs)

Scans For:

• Operating system package vulnerabilities
• Application dependency vulnerabilities
• Known exploits in installed software
• Outdated packages with security patches available

Example Findings:

 CRITICAL: CVE-2024-12345 in openssl
Package: openssl 1.1.1k
Severity: Critical (CVSS 9.8)
Impact: Remote code execution via crafted TLS handshake
Fixed in: openssl 1.1.1w

Remediation:
FROM ubuntu:22.04  # Update base image
RUN apt-get update && apt-get upgrade -y openssl

Example Output:

Image: myapp:latest
Base: node:16 (debian:bullseye)

Vulnerabilities Found: 47
   Critical: 3
   High: 12
   Medium: 18
   Low: 14

Top Critical CVEs:
1. CVE-2024-12345 (openssl) - RCE via TLS
2. CVE-2024-23456 (curl) - Buffer overflow
3. CVE-2024-34567 (libc6) - Privilege escalation

2. Dockerfile Security Issues

Checks:

• Running as root user
• Hardcoded secrets in layers
• Exposed sensitive ports
• Unnecessary packages installed
• Missing health checks
• Outdated base images

Example Findings:

#  BAD: Running as root
FROM node:16
WORKDIR /app
COPY . .
RUN npm install
CMD ["node", "server.js"]  # Runs as root!

#  GOOD: Non-root user
FROM node:16
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
USER node  # Drop to non-root user
CMD ["node", "server.js"]

#  BAD: Hardcoded secrets
FROM node:16
ENV DATABASE_PASSWORD="MySecretPassword123"  # Exposed in image layers!

#  GOOD: Runtime secrets
FROM node:16
# Pass secrets at runtime via environment variables or secrets management
CMD ["node", "server.js"]

#  BAD: Unnecessary packages
FROM ubuntu:latest
RUN apt-get update && apt-get install -y \
    build-essential \
    python3 \
    curl \
    wget \
    vim \
    emacs \
    git \
    # Unnecessary packages increase attack surface!

#  GOOD: Minimal image
FROM node:16-alpine  # Minimal base image
RUN apk add --no-cache curl  # Only necessary packages

3. Container Runtime Configuration

Scans For:

• Privileged containers (--privileged)
• Dangerous capabilities (CAP_SYS_ADMIN, CAP_NET_ADMIN)
• Host network mode
• Mounted sensitive host paths
• No resource limits (CPU, memory)

Example Findings:

#  CRITICAL: Privileged container
docker run --privileged myapp:latest
# Allows container to access all host devices, escape container!

#  SAFE: Non-privileged with minimal capabilities
docker run --cap-drop=ALL --cap-add=NET_BIND_SERVICE myapp:latest

# ️ HIGH: Host network mode
docker run --network=host myapp:latest
# Container can access all host network interfaces

#  SAFE: Bridge network
docker run --network=bridge myapp:latest