Initial commit

docker-compose.yml

@@ -0,0 +1,45 @@
+services:
+  vulnscan:
+    build: .
+    image: docker-vuln-scan:latest
+    environment:
+      # Leave IMAGES empty to scan the images used by running containers.
+      IMAGES: ${IMAGES:-}
+      APPRISE_URLS: ${APPRISE_URLS:-}
+      APPRISE_CONFIG: ${APPRISE_CONFIG:-}
+      APPRISE_TITLE_PREFIX: ${APPRISE_TITLE_PREFIX:-Vulnerability scan}
+      NOTIFY_MIN_SEVERITY: ${NOTIFY_MIN_SEVERITY:-HIGH}
+      FAIL_ON: ${FAIL_ON:-HIGH}
+      IGNORE_UNFIXED: ${IGNORE_UNFIXED:-false}
+      TRIVY_SEVERITIES: ${TRIVY_SEVERITIES:-}
+      MAX_FINDINGS_IN_BODY: ${MAX_FINDINGS_IN_BODY:-15}
+      NOTIFY_ON_SCAN_ERROR: ${NOTIFY_ON_SCAN_ERROR:-true}
+      TRIVY_TIMEOUT: ${TRIVY_TIMEOUT:-15m}
+      # Optional: also scan the scanner's own image (default: false).
+      INCLUDE_SELF: ${INCLUDE_SELF:-false}
+      # Optional: scan a list of images instead of IMAGES (mount the file).
+      IMAGES_FILE: ${IMAGES_FILE:-}
+      # Path of the Docker socket *inside* the container (same as on the host,
+      # see the volume below). Empty means "auto-detect".
+      DOCKER_SOCK: ${DOCKER_SOCK:-}
+      # Optional: private registry credentials / TLS settings for Trivy.
+      TRIVY_USERNAME: ${TRIVY_USERNAME:-}
+      TRIVY_PASSWORD: ${TRIVY_PASSWORD:-}
+      TRIVY_INSECURE: ${TRIVY_INSECURE:-}
+    volumes:
+      # Used to discover the images in use and to read images that exist only
+      # in the local Docker daemon. The socket is mounted at the same path it
+      # has on the host, so DOCKER_SOCK works unchanged inside the container.
+      # Rootless Docker: DOCKER_SOCK=/run/user/<uid>/docker.sock
+      - ${DOCKER_SOCK:-/var/run/docker.sock}:${DOCKER_SOCK:-/var/run/docker.sock}:ro
+      # Rootless Docker/Podman keep the socket under /run/user/<uid>/. Mounting
+      # that directory lets the scanner find it without extra configuration.
+      # Remove this line if you do not want the host's runtime dirs exposed.
+      # - /run/user:/run/user:ro
+      - ./reports:/reports
+      # Keep the Trivy DB between runs (much faster repeat scans).
+      - trivy-cache:/var/lib/trivy
+    restart: "no"
+
+volumes:
+  trivy-cache: