services:
  vulnscan:
    build: .
    image: docker-vuln-scan:latest
    environment:
      # Leave IMAGES empty to scan the images used by running containers.
      IMAGES: ${IMAGES:-}
      APPRISE_URLS: ${APPRISE_URLS:-}
      APPRISE_CONFIG: ${APPRISE_CONFIG:-}
      APPRISE_TITLE_PREFIX: ${APPRISE_TITLE_PREFIX:-Vulnerability scan}
      NOTIFY_MIN_SEVERITY: ${NOTIFY_MIN_SEVERITY:-HIGH}
      FAIL_ON: ${FAIL_ON:-HIGH}
      IGNORE_UNFIXED: ${IGNORE_UNFIXED:-false}
      TRIVY_SEVERITIES: ${TRIVY_SEVERITIES:-}
      # Optional: "repo", "oci", "sbom-ref" or local VEX file paths.
      TRIVY_VEX: ${TRIVY_VEX:-}
      MAX_FINDINGS_IN_BODY: ${MAX_FINDINGS_IN_BODY:-15}
      NOTIFY_ON_SCAN_ERROR: ${NOTIFY_ON_SCAN_ERROR:-true}
      TRIVY_TIMEOUT: ${TRIVY_TIMEOUT:-15m}
      # Optional: also scan the scanner's own image (default: false).
      INCLUDE_SELF: ${INCLUDE_SELF:-false}
      # Optional: containers that get a full per-container CVE notification.
      IMPORTANT_CONTAINERS: ${IMPORTANT_CONTAINERS:-}
      # Optional: scan a list of images instead of IMAGES (mount the file).
      IMAGES_FILE: ${IMAGES_FILE:-}
      # Path of the Docker socket *inside* the container (same as on the host,
      # see the volume below). Empty means "auto-detect".
      DOCKER_SOCK: ${DOCKER_SOCK:-}
      # Optional: private registry credentials / TLS settings for Trivy.
      TRIVY_USERNAME: ${TRIVY_USERNAME:-}
      TRIVY_PASSWORD: ${TRIVY_PASSWORD:-}
      TRIVY_INSECURE: ${TRIVY_INSECURE:-}
    volumes:
      # Used to discover the images in use and to read images that exist only
      # in the local Docker daemon. The socket is mounted at the same path it
      # has on the host, so DOCKER_SOCK works unchanged inside the container.
      # Rootless Docker: DOCKER_SOCK=/run/user/<uid>/docker.sock
      - ${DOCKER_SOCK:-/var/run/docker.sock}:${DOCKER_SOCK:-/var/run/docker.sock}:ro
      # Rootless Docker/Podman keep the socket under /run/user/<uid>/. Mounting
      # that directory lets the scanner find it without extra configuration.
      # Remove this line if you do not want the host's runtime dirs exposed.
      # - /run/user:/run/user:ro
      - ${KOMODO_CACHE_DIR:-.}/cves/reports:/reports
      # Optional: local VEX documents, referenced as /vex/<file> in TRIVY_VEX.
      # - ./vex:/vex:ro
      # Keep the Trivy DB between runs (much faster repeat scans).
      - trivy-cache:/var/lib/trivy
    restart: "no"

volumes:
  trivy-cache: