Container monitor
snyk container monitor [<OPTIONS>] [<IMAGE>]
The
snyk container monitor
command captures the container image layers and dependencies and monitor for vulnerabilities on snyk.ioPossible exit codes and their meaning:
0: success, image layers and dependencies captured
2: failure, try to re-run command
3: failure, no supported projects detected
You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API.
Use the
-d
option to output the debug logs.Specify the
<ORG_ID>
to run Snyk commands tied to a specific organization. The <ORG_ID>
influences some features availability and private test limits.If you have multiple organizations, you can set a default from the CLI using:
$ snyk config set org=<ORG_ID>
Set a default to ensure all newly tested and monitored projects are tested and monitored under your default organization. If you need to override the default, use the
--org=<ORG_ID>
option.Note that you can also use
--org=<orgslugname>
. The ORG_ID
works in both the CLI and the API. The organization slug name works in the CLI, but not in the API.For more detailed advice, include the path to the Dockerfile for the image.
Specify a custom Snyk project name.
Manually pass a path to a
.snyk
policy file.Print results on the console as a JSON data structure.
Example:
$ snyk container test --json
Note: If you use an option that sets project attributes and your role lacks permission to edit project attributes the
monitor
command fails. For instructions on how to proceed see Editing project attributes from the Snyk CLISet the project environment to one or more values (comma-separated). To clear the project environment set
--project-environment=
Allowed values:
frontend
, backend
, internal
, external
, mobile
, saas
, onprem
, hosted
, distributed
Set the project lifecycle to one or more values (comma-separated). To clear the project lifecycle set
--project-lifecycle=
Allowed values:
production, development, sandbox
Set the project business criticality to one or more values (comma-separated). To clear the project business criticality set
--project-business-criticality=
Allowed values:
critical
, high
, medium
, low
Set the project tags to one or more values (comma-separated key value pairs with an "=" separator).
Example:
--project-tags=department=finance,team=alpha
To clear the project tags set
--project-tags=
This is an alias for
--project-tags
Allow detection of vulnerabilities in your application dependencies from container images, as well as from the operating system, all in one single scan.
In CLI versions 1.1090.0 (2023-01-24) and higher, Snyk scans for application dependencies in your image by default; you do not need to specify the
--app-vulns
option.In CLI versions 1.962.0 through v1.1089.0, use the
--app-vulns
option with the the --json
option to see the operating system as well as application vulnerabilities in JSON format in the results.Allow disabling scans for app vulnerabilities; in CLI versions 1.1090.0 (2023-01-24) and higher,
app-vulns
is enabled by default.In earlier releases, cannot be used with
--app-vulns
.When
app-vulns
is enabled, use the --nested-jars-depth=n
option to set how many levels of nested jars Snyk is to unpack. Depth must be a number.Do not show vulnerabilities introduced only by the base image. Works for operating system packages only. Available when using
snyk container test
only. Provided for compatibility with snyk container test
. Using this option with snyk container monitor
will not have any effectFor multi-architecture images, specify the platform to test.
Supported platforms are:
linux/amd64
, linux/arm64
, linux/riscv64
, linux/ppc64le
, linux/s390x
, linux/386
, linux/arm/v7
, or linux/arm/v6
Specify a username to use when connecting to a container registry. This is ignored in favor of local Docker binary credentials when Docker is present.
Specify a password to use when connecting to a container registry. This is ignored in favor of local Docker binary credentials when Docker is present.
Scan and monitor Docker images
$ snyk container monitor <image>
Last modified 25d ago