add IMPORTANT_CONTAINERS

README.md

@@ -25,8 +25,12 @@ host only needs Docker. JSON reports are kept on disk for auditing.
      alert.
    - `FAIL_ON` (default `HIGH`) – when the script should exit with code `1`
      (useful for CI).
-3. If any CVE reaches `NOTIFY_MIN_SEVERITY`, one notification is sent listing
-   each CVE with the affected packages and the containers/images that use them.
+3. If any CVE reaches `NOTIFY_MIN_SEVERITY`, notifications are sent. When
+   `IMPORTANT_CONTAINERS` is set, each named container gets its own complete
+   CVE list (split into fixable and unfixable), missing important containers
+   are reported, and every other container is summarised in one notification.
+   Without `IMPORTANT_CONTAINERS`, a single aggregated notification lists each
+   CVE with the affected packages, containers, and images.
 
 ## Quick start
 
@@ -67,10 +71,15 @@ For the last one the scanner asks the Docker Engine API on the Unix socket for
 listing order. Stopped containers are not included. The scanner's own container
 image is skipped so a scheduled run does not report on itself; set
 `INCLUDE_SELF=true` to include it. Scan logs still name the running container(s) that use each image (e.g.
-`Scanning nginx:1.27 (used by container web)`). Notifications are aggregated
-by CVE after all images are scanned: a single report lists each CVE with the
-containers and images it affects. Scan failures still notify per failed image
-with container context. Explicitly passed images omit container context.
+`Scanning nginx:1.27 (used by container web)`). Without `IMPORTANT_CONTAINERS`,
+notifications are aggregated by CVE after all images are scanned: a single
+report lists each CVE with the containers and images it affects. With
+`IMPORTANT_CONTAINERS`, each named container gets its own full CVE list and the
+remaining containers are summarised together (see
+[Important containers](#important-containers)). Scan failures still notify per
+failed image with container context. Explicitly passed images omit container
+context unless `IMPORTANT_CONTAINERS` is set, in which case running containers
+are looked up to match them to the scanned images.
 
 The socket is looked up in this order:
 
@@ -141,6 +150,7 @@ All configuration is done through environment variables.
 | `DOCKER_SOCK` | auto | Unix socket of the Docker daemon (or Podman). Also the Compose mount source. |
 | `DOCKER_HOST` | – | Standard Docker variable; `unix://` paths are used for discovery. |
 | `INCLUDE_SELF` | `false` | Also scan the scanner's own image when auto-discovering. |
+| `IMPORTANT_CONTAINERS` | – | Container names (space/comma separated) that get a full per-container CVE notification. Others are summarised together. |
 | `APPRISE_URLS` | – | Space separated Apprise URLs (quote the value). |
 | `APPRISE_CONFIG` | – | Alternative: path to an Apprise YAML config. |
 | `APPRISE_TITLE_PREFIX` | `Vulnerability scan` | Prefix of notification titles. |
@@ -153,7 +163,7 @@ All configuration is done through environment variables.
 | `REPORT_DIR` | `/reports` | Where JSON reports are written. |
 | `TRIVY_CACHE_DIR` | `/var/lib/trivy` | Trivy DB cache (mount a volume to avoid re-downloading). |
 | `TRIVY_TIMEOUT` | `15m` | Passed to `trivy --timeout`. |
-| `MAX_FINDINGS_IN_BODY` | `15` | How many findings are listed per notification. |
+| `MAX_FINDINGS_IN_BODY` | `15` | How many findings the single aggregated notification lists. Important-container notifications are not capped. |
 | `LOG_LEVEL` | `INFO` | `DEBUG`, `INFO`, `WARN` or `ERROR`. |
 
 Images can be passed as arguments, via `IMAGES`, or via `IMAGES_FILE`; the
@@ -233,7 +243,35 @@ docker run --rm \
   docker-vuln-scan:latest nginx:1.27-alpine
 ```
 
-## Exit codes
+## Important containers
+
+Set `IMPORTANT_CONTAINERS` to the containers that are reachable from outside
+(your public entry points). Names are matched against running containers, so
+leave `IMAGES` empty unless you also want to scan specific images explicitly.
+
+```dotenv
+IMPORTANT_CONTAINERS=traefik web-frontend
+```
+
+When the list is set, notifications are split into three groups:
+
+1. **One notification per important container**, titled
+   `Vulnerability scan: <container> (<image>)`. It lists every CVE at or above
+   `NOTIFY_MIN_SEVERITY`, with a total split into fixable and unfixable.
+2. **One notification for important containers that are missing** – either not
+   running, or running an image that was not part of the scan.
+3. **One summary notification for every other container**, listing the image,
+   container, total CVE count, and the fixable/unfixable split.
+
+A container can appear in only the important list or the summary, never both.
+If an important container shares its image with other containers, the others
+still appear in the summary. Important-container lists are never truncated: if
+a list is longer than the Apprise/Discord message limit it is sent in numbered
+parts. `FAIL_ON` and the exit codes are unchanged.
+
+Without `IMPORTANT_CONTAINERS`, the previous single aggregated notification is
+sent.
+
 
 | Code | Meaning |
 | --- | --- |