Scan with the Docker CLI

Support API docs Product updates Sign up for free
Search…
Using Docker Desktop? The Docker CLI provides native vulnerability detection and fixes, powered by Snyk.
Lab Meta
Difficulty: Beginner
Time: Approximately 15 minutes
As part of Snyk's partnership with Docker, scanning container images for vulnerabilities is built into Docker Desktop and as simple as docker scan. This lab shows how it works.
You will complete the following steps:
Step 1 - Clone a the sample application's GitHub Repo
Step 2 - Build some Docker images
Step 3 - Scan the images for vulnerabilities
Step 4 - Review scan results
Step 5 - Dig into provided Base Image recommendations
Step 6 - Apply a more secure Base Image and re-build the Image
Step 7 - Re-scan for Vulnerabilities
Prerequisites
Download and install Docker Desktop.
​Download for Mac​
​Download for Windows​
[Optional] Fork the Docker Goof Repo to your GitHub Account.
A Snyk account is not necessary, however, you can only scan 10 times without logging in. Sign up for Snyk using your Docker ID, then run docker scan --loginand sign in to unlock 200 free scans per month.
Check your installation by running docker scan --version, it should print the current version of docker scan and the Snyk engine version.
1
docker scan --version
Copied!
Step 1: Clone the Docker Goof Application, or BYO App
This lab uses the Docker Goof application, but feel free to bring your own application! If you do, you're responsible for ensuring the application builds!
Clone the Docker Goof application to your workstation, then change to the top level directory of the app. Don't have Git? You can download the Docker-Goof repo as a Zip file.
1
git clone https://github.com/snyk/docker-goof && cd docker-goof
2
# If you forked the repo, clone your fork.
Copied!
Step 2: Build one (or many) docker-goof Images
The Docker Goof repo has many Dockerfiles. You can build some, or all, of them out.
Use the included easy button ./build.sh to build them all at once.
1
# Easy button? Yes please. Build all images at once with:
2
./build.sh
Copied!
If you'd rather build the images one-by-one, remember to pass -f pointing at the Dockerfile.
1
# Build your images with docker build.
2
docker build -t docker-goof-slim -f slim.Dockerfile .
3
docker build -t docker-goof -f Dockerfile .
Copied!
The images are now in our local Docker cache. Run docker images to list them out.
1
docker images
Copied!
We'll use these images in the next step.
Step 3: Scan your Image for vulnerabilities with Snyk
Use docker scan to scan for vulnerabilities. It's a best practice to pass the Dockerfile used to build the image with --file to get more robust results that include vulnerabilities from Dockerfile instruction and base image upgrade guidance. For example,
To scan docker-goof, and pass the Dockerfile:
1
# Scanning the docker-goof image and passing the Dockerfile 
2
docker scan docker-goof --file=Dockerfile
Copied!
To scan docker-goof-app, and pass the Dockerfile:
1
# Scanning the docker-goof-app image and passing the Dockerfile
2
docker scan docker-goof-app --file=app.Dockerfile
Copied!
To scan docker-goof-n6-slim, without passing the Dockerfile:
1
# Scanning an image without passing the Dockerfile
2
docker scan docker-goof-n6-slim
Copied!
Check out the Docker Scan documentation for all possible CLI options.
Scanning images for Open Source vulnerabilities with Snyk is that easy! When finished, scan results are displayed in the Terminal, along with fix advice.
Step 4: Review Vulnerability Scan Results
Vulnerabilities are broken up into sections, based on how they were introduced:
Vulnerable Base Image Packages
Vulnerabilities introduced by the container's base image can be identified by the presence of the Introduced by your base image line. (Line 9 below)
1
✗ High severity vulnerability found in curl/libcurl3
2
  Description: Buffer Overflow
3
  Info: https://snyk.io/vuln/SNYK-DEBIAN8-CURL-466507
4
  Introduced through: [email protected]+deb8u11, curl/[email protected]+deb8u11, [email protected]:2.1.4-2.1+deb8u6
5
  From: [email protected]+deb8u11 > curl/[email protected]+deb8u11
6
  From: curl/[email protected]+deb8u11 > curl/[email protected]38.0-4+deb8u11
7
  From: [email protected]+deb8u11
8
  and 2 more...
9
  Introduced by your base image (node:10.4.0)
10
  Fixed in: 7.38.0-4+deb8u16
Copied!
User Instruction Vulnerabilities
Some vulnerabilities are introduced by User Instruction in the Dockerfile. Snyk highlights the command that introduced the vulnerability, with the Introduced in your Dockerfile by line. (Line 9)
1
✗ High severity vulnerability found in bzip2/bzip2
2
  Description: Out-of-bounds Write
3
  Info: https://snyk.io/vuln/SNYK-DEBIAN8-BZIP2-450781
4
  Introduced through: bzip2/[email protected]+b3, dpkg/[email protected], bzip2/[email protected]+b3, imagemagick/[email protected]:6.8.9.9-5+deb8u12, [email protected]
5
  From: bzip2/[email protected]+b3
6
  From: dpkg/[email protected] > bzip2/[email protected]+b3
7
  From: bzip2/[email protected]+b3
8
  and 2 more...
9
  Introduced in your Dockerfile by 'RUN apt-get install -y imagemagick'
10
  Fixed in: 1.0.6-7+deb8u1
Copied!
Vulnerable App Dependencies
The last kind of vulnerability your images might contain are introduced by your application dependencies. Snyk highlights the package manifest Target File that introduced it. (Line 14)
1
Issues to fix by upgrading:
2
​
3
  Upgrade @tryghost/[email protected] to @tryghost/[email protected] to fix
4
  ✗ Remote Code Execution (RCE) [Medium Severity][https://snyk.io/vuln/SNYK-JS-BUNYAN-573166] in [email protected]
5
    introduced by [email protected] > [email protected] and 8 other path(s)
6
​
7
  Upgrade @tryghost/[email protected] to @tryghost/[email protected] to fix
8
  ✗ Remote Code Execution (RCE) [Medium Severity][https://snyk.io/vuln/SNYK-JS-BUNYAN-573166] in [email protected]
9
    introduced by [email protected] > [email protected] and 8 other path(s)
10
​
11
​
12
Organization:      demo-inc
13
Package manager:   yarn
14
Target file:       /var/lib/ghost/versions/2.37.2/package.json
15
Project name:      ghost
16
Docker image:      docker-goof-app
Copied!
Check out the Snyk Documentation for Info around Container CLI Results​
Step 5: Review Base Image Recommendations
Snyk's fix advice helps developers spend less time fixing, and more time developing! One way to tackle vulnerabilities is by choosing a more secure base image. By providing the Dockerfile to docker scan , Snyk can suggest other Base Images that can be used in the Dockerfile's FROM statement to bring down those vulnerability counts.
These are grouped by how likely they are to be compatible with your application:
Minor upgrades are the most likely to be compatible with little work,
Major upgrades can introduce breaking changes depending on image usage,
Alternative architecture images are shown for more technical users to investigate.
These suggestions are not a substitute for proper integration testing. They are intended to help you narrow down potential base image choices.
1
Organization:      demo-inc
2
Package manager:   deb
3
Target file:       Dockerfile
4
Project name:      docker-image|docker-goof
5
Docker image:      docker-goof
6
Base image:        node:10.4.0
7
Licenses:          enabled
8
​
9
Tested 382 dependencies for known issues, found 459 issues.
10
​
11
Base Image   Vulnerabilities  Severity
12
node:10.4.0  951              451 high, 480 medium, 20 low
13
​
14
Recommendations for base image upgrade:
15
​
16
Minor upgrades
17
Base Image  Vulnerabilities  Severity
18
node:10.22  498              53 high, 48 medium, 397 low
19
​
20
Major upgrades
21
Base Image  Vulnerabilities  Severity
22
node:14.13  497              53 high, 47 medium, 397 low
23
​
24
Alternative image types
25
Base Image                 Vulnerabilities  Severity
26
node:14.13-buster-slim     51               9 high, 4 medium, 38 low
27
node:14.12.0-slim          70               17 high, 7 medium, 46 low
28
node:14.11.0-stretch-slim  70               17 high, 7 medium, 46 low
29
node:14.13.1-buster        254              31 high, 30 medium, 193 low
Copied!
Step 6: Apply a more Secure Base Image
Let's choose a more secure base image for docker-goof. We'll do this by applying the Minor upgrade recommended by Snyk. Change the FROM statement in the Dockerfile:
1
# Comment out the old FROM Statement
2
# FROM node:10.4.0
3
​
4
# Write in the new one
5
FROM node:10.22
6
​
7
RUN apt-get install -y imagemagick
Copied!
Now build the new Image. To compare results side-by-side with the previous scan, we'll specify a different tag when building the image.
1
docker build -t docker-goof:v2 -f Dockerfile .
Copied!
Step 7: Scan your Image for vulnerabilities with Snyk
Now let's use docker scan to scan for vulnerabilities. Once again, pass the Dockerfile used to build the image with --file to get more robust results.
1
# Scanning the docker-goof image and passing the Dockerfile 
2
docker scan docker-goof:v2 --file=Dockerfile
Copied!
Check out the Docker Scan documentation for all possible CLI options.
Continue this cycle of build-scan-push until you're running the most secure base image.
Recap: Additional Resources & Docker Hub Promotion!
We hope you enjoyed this Lab! In this pattern, we checked for vulnerabilities in Images using the Docker CLI, and saw vulnerabilities introduced by our Base Image, Dockerfile instructions, and application dependencies.
Applying a more secure base image is a great first step toward making your images more secure. As noted above, vulnerabilities can come from your application dependencies and Dockerfile user instructions as well. Check out other courses in the Snyk Academy to learn how Snyk can help you fix and reduce the other vulnerabilities in your images.
As we continue to evolve our Partnership with Docker, we'll keep adding new capabilities that help developers build their container images securely and deploy with confidence. Try out this workflow on your own applications, and let us know what you think!
Other courses in the Snyk Academy may require a Snyk Account. Don't forget - new accounts that Sign in with Docker Hub unlock a promotional free tier limit of 200 scans per month!