50 lines
2.3 KiB
YAML
50 lines
2.3 KiB
YAML
services:
|
|
vulnscan:
|
|
build: .
|
|
image: docker-vuln-scan:latest
|
|
environment:
|
|
# Leave IMAGES empty to scan the images used by running containers.
|
|
IMAGES: ${IMAGES:-}
|
|
APPRISE_URLS: ${APPRISE_URLS:-}
|
|
APPRISE_CONFIG: ${APPRISE_CONFIG:-}
|
|
APPRISE_TITLE_PREFIX: ${APPRISE_TITLE_PREFIX:-Vulnerability scan}
|
|
NOTIFY_MIN_SEVERITY: ${NOTIFY_MIN_SEVERITY:-HIGH}
|
|
FAIL_ON: ${FAIL_ON:-HIGH}
|
|
IGNORE_UNFIXED: ${IGNORE_UNFIXED:-false}
|
|
TRIVY_SEVERITIES: ${TRIVY_SEVERITIES:-}
|
|
# Optional: "repo", "oci", "sbom-ref" or local VEX file paths.
|
|
TRIVY_VEX: ${TRIVY_VEX:-}
|
|
MAX_FINDINGS_IN_BODY: ${MAX_FINDINGS_IN_BODY:-15}
|
|
NOTIFY_ON_SCAN_ERROR: ${NOTIFY_ON_SCAN_ERROR:-true}
|
|
TRIVY_TIMEOUT: ${TRIVY_TIMEOUT:-15m}
|
|
# Optional: also scan the scanner's own image (default: false).
|
|
INCLUDE_SELF: ${INCLUDE_SELF:-false}
|
|
# Optional: scan a list of images instead of IMAGES (mount the file).
|
|
IMAGES_FILE: ${IMAGES_FILE:-}
|
|
# Path of the Docker socket *inside* the container (same as on the host,
|
|
# see the volume below). Empty means "auto-detect".
|
|
DOCKER_SOCK: ${DOCKER_SOCK:-}
|
|
# Optional: private registry credentials / TLS settings for Trivy.
|
|
TRIVY_USERNAME: ${TRIVY_USERNAME:-}
|
|
TRIVY_PASSWORD: ${TRIVY_PASSWORD:-}
|
|
TRIVY_INSECURE: ${TRIVY_INSECURE:-}
|
|
volumes:
|
|
# Used to discover the images in use and to read images that exist only
|
|
# in the local Docker daemon. The socket is mounted at the same path it
|
|
# has on the host, so DOCKER_SOCK works unchanged inside the container.
|
|
# Rootless Docker: DOCKER_SOCK=/run/user/<uid>/docker.sock
|
|
- ${DOCKER_SOCK:-/var/run/docker.sock}:${DOCKER_SOCK:-/var/run/docker.sock}:ro
|
|
# Rootless Docker/Podman keep the socket under /run/user/<uid>/. Mounting
|
|
# that directory lets the scanner find it without extra configuration.
|
|
# Remove this line if you do not want the host's runtime dirs exposed.
|
|
# - /run/user:/run/user:ro
|
|
- ${KOMODO_CACHE_DIR:-.}/cves/reports:/reports
|
|
# Optional: local VEX documents, referenced as /vex/<file> in TRIVY_VEX.
|
|
# - ./vex:/vex:ro
|
|
# Keep the Trivy DB between runs (much faster repeat scans).
|
|
- trivy-cache:/var/lib/trivy
|
|
restart: "no"
|
|
|
|
volumes:
|
|
trivy-cache:
|