30 lines
1.0 KiB
Docker
30 lines
1.0 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# Trivy is a single static binary, so it can be copied into a slim base image.
|
|
ARG TRIVY_IMAGE=aquasec/trivy:latest@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c
|
|
FROM ${TRIVY_IMAGE} AS trivy
|
|
|
|
FROM python:3.12-slim@sha256:a0f57064cbdcd6285fa45f51237ab0b35ea8ebaed06a1f5973e89e19dfb86704
|
|
|
|
LABEL org.opencontainers.image.title="docker-vuln-scan" \
|
|
org.opencontainers.image.description="Trivy image vulnerability scanner with Apprise alerts" \
|
|
org.opencontainers.image.licenses="MIT"
|
|
|
|
RUN apt-get update \
|
|
&& apt-get install -y --no-install-recommends ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/* \
|
|
&& pip install --no-cache-dir "apprise>=1.8,<2"
|
|
|
|
COPY --from=trivy /usr/local/bin/trivy /usr/local/bin/trivy
|
|
COPY scan.py /usr/local/bin/scan.py
|
|
RUN chmod 0755 /usr/local/bin/scan.py
|
|
|
|
ENV REPORT_DIR=/reports \
|
|
TRIVY_CACHE_DIR=/var/lib/trivy \
|
|
TRIVY_NO_PROGRESS=true \
|
|
PYTHONUNBUFFERED=1
|
|
|
|
VOLUME ["/reports"]
|
|
|
|
ENTRYPOINT ["/usr/local/bin/scan.py"]
|