snyk container test [<OPTIONS>] [<IMAGE>]
snyk container testcommand tests container images for any known vulnerabilities.
Possible exit codes and their meaning:
0: success (scan completed), no vulnerabilities found 1: action_needed (scan completed), vulnerabilities found 2: failure, try to re-run command 3: failure, no supported projects detected
You can use environment variables to configure the Snyk CLI and set variables for connecting with the Snyk API.
-doption to output the debug logs.
Print the dependency tree before sending it for analysis.
<ORG_ID>to run Snyk commands tied to a specific organization. The
<ORG_ID>influences some features availability and private test limits.
If you have multiple organizations, you can set a default from the CLI using:
$ snyk config set org=<ORG_ID>
Set a default to ensure all newly tested and monitored projects are tested and monitored under your default organization. If you need to override the default, use the
Note that you can also use
ORG_IDworks in both the CLI and the API. The organization slug name works in the CLI, but not in the API.
For more detailed advice, include the path to the Dockerfile for the image.
Specify a custom Snyk project name.
Manually pass a path to a
Print results ion the console as a JSON data structure.
$ snyk container test --json
Save test output in JSON format as a JSON data structure directly to the specified file, regardless of whether or not you use the
Use to display the human-readable test output using stdout and at the same time save the JSON data structure output to a file.
$ snyk container test --json-file-output=vuln.json
Return results in SARIF format. Note this requires the test to be run with
Save test output in SARIF format directly to the
<OUTPUT_FILE_PATH>file, regardless of whether or not you use the
This is especially useful if you want to display the human-readable test output using stdout and at the same time save the SARIF format output to a file.
Report only vulnerabilities at the specified level or higher.
Fail only when there are vulnerabilities that can be fixed.
all: fail when there is at least one vulnerability that can be either upgraded or patched.
upgradable: fail when there is at least one vulnerability that can be upgraded.
To fail on any vulnerability (the default behavior), do not use the
--fail-onoption. If vulnerabilities do not have a fix and this option is being used, tests pass.
Allow detection of vulnerabilities in your application dependencies from container images, as well as from the operating system, all in one single scan.
In CLI version 1.962.0 and higher, use the
--app-vulnsoption with the the
--jsonoption to see the operating system as well as application vulnerabilities in JSON format in the results.
Allow disabling scans for app vulnerabilities in advance of
app-vulnsbeing enabled by default.
Cannot be used with
--nested-jars-depthoption to set how many levels of nested jars Snyk is to unpack. Depth must be a number.
Do not show vulnerabilities introduced only by the base image. Available when using
snyk container testonly.
For multi-architecture images, specify the platform to test.
Supported platforms are:
Specify a username to use when connecting to a container registry. This is ignored in favor of local Docker binary credentials when Docker is present.
Specify a password to use when connecting to a container registry. This is ignored in favor of local Docker binary credentials when Docker is present.
$ snyk container test <image>
$ snyk container test app:latest --file=Dockerfile
$ snyk container test app:latest --file=Dockerfile --policy-path=path/to/.snyk