Initial commit

Dockerfile

@@ -0,0 +1,29 @@
+# syntax=docker/dockerfile:1
+
+# Trivy is a single static binary, so it can be copied into a slim base image.
+ARG TRIVY_IMAGE=aquasec/trivy:latest
+FROM ${TRIVY_IMAGE} AS trivy
+
+FROM python:3.12-slim
+
+LABEL org.opencontainers.image.title="docker-vuln-scan" \
+      org.opencontainers.image.description="Trivy image vulnerability scanner with Apprise alerts" \
+      org.opencontainers.image.licenses="MIT"
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends ca-certificates \
+ && rm -rf /var/lib/apt/lists/* \
+ && pip install --no-cache-dir "apprise>=1.8,<2"
+
+COPY --from=trivy /usr/local/bin/trivy /usr/local/bin/trivy
+COPY scan.py /usr/local/bin/scan.py
+RUN chmod 0755 /usr/local/bin/scan.py
+
+ENV REPORT_DIR=/reports \
+    TRIVY_CACHE_DIR=/var/lib/trivy \
+    TRIVY_NO_PROGRESS=true \
+    PYTHONUNBUFFERED=1
+
+VOLUME ["/reports"]
+
+ENTRYPOINT ["/usr/local/bin/scan.py"]