Docker Vulnerability Scanning CLI Cheat Sheet
Getting Started

Common Docker Scanning Options

Docker Desktop now includes container vulnerability
scanning, powered by Snyk!

Run a single test on an image tagged myapp:mytag:$ docker scan myapp:mytag

Download and install the latest version of Docker Desktop.

Use the Dockerfile to generate a more detailed analysis:$ docker scan myapp:mytag --file path/to/Dockerfile
For popular official images on Docker Hub, this will provide baseimage recommendations and alternate base images that can help
reduce vulnerabilities.

Once installed, login to your Docker Hub account, and you
can verify the vulnerability scanning is installed two ways.
First, the “About Docker Desktop” screen will now show theSnyk version:

In addition, if RUN commands in the Dockerfile install packages that
introduce vulnerabilities, that Dockerfile command is provided aspart of the vulnerability details.

Ignore any vulnerabilities from the base image. The --excludebase option requires the --file option.
$ docker scan myapp:mytag --exclude-base \--file path/to/Dockerfile
Provides a package dependency tree for the image, in addition to thevulnerability findings.
$ docker scan myapp:mytag --dependency-tree
Show only vulnerabilities with a severity rating of high or above(medium or low are also options):$ docker scan myapp:mytag --severity highVulnerability Data & Advanced CLI Usage
Using the --json output is a powerful way to filter and display scan results. A subset of the vulnerability output is shown below with some examples
using the jq utility to filter results.
{"title": "Out-of-bounds Read","packageName": "curl","language": "linux","packageManager": "alpine:3.7","description": "## Overview\nlibcurl versions from...
"identifiers": {"ALTERNATIVE": [],"CVE": ["CVE-2019-3823"],"CWE": ["CWE-125"]},"severity": "high","cvssScore": 7.5,
"CVSSv3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","creationTime": "2020-07-21T16:54:36.291584Z","modificationTime": "2020-07-23T10:26:06.499683Z","publicationTime": "2019-02-06T20:29:00Z","disclosureTime": "2019-02-06T20:29:00Z","id": "SNYK-ALPINE37-CURL-343582","nvdSeverity": "high","semver": {"vulnerable": ["<7.61.1-r2"]},"from": ["docker-image|purpledobie/utilities@curl.alp37","curl/libcurl@7.60.0-r1"],"name": "curl/libcurl","version": "7.60.0-r1","nearestFixedInVersion": "7.61.1-r2","dockerfileInstruction": "RUN apk add --no-cache curl","dockerBaseImage": "alpine:3.7"

You can also check the Snyk version at the command line:$ docker scan --version
Version:v0.5.0
Git commit: 5a09266
Provider:Snyk (1.432.0)

You can run up to 10 tests per month without any additional
configuration. To unlock additional free monthly tests, signup for a free Snyk account, if you do not already have one, andauthenticate in the Docker client.
Once you have a Snyk account you can authenticate in theDocker CLI using either of the commands below.
If you want to use the --token method, you can manage Snyk
API tokens in the Snyk console under “Settings --> Serviceaccounts”.
# opens a browser window to authenticate:$ docker scan --login# Login directly using your Snyk API token:$ docker scan --login --token 1234567-abcd-456
Updated 2021-Jan-12}

Vulnerability Key

Description

packageName
severityidSimple name of the top-level package
Severity rating based on CVSS score
Snyk-specific vulnerability to look up vulnerabilties in Snyk’s
database
Specific name of the vulnerable binary
Version installed in the container image
Minimum version required to fix the vulnerability
Line in the Dockerfile that installed the vulnerable package(requires --file)
Parent image detected in the scan (requires --file)

nameversionnearestFixedInVersion
dockerfileInstruction
dockerBaseImage

Shown only high severity vulnerabilities from layers other than thebase image:$ docker scan myapp:mytag --exclude-base --severity high \--file path/to/Dockerfile
High severity vulnerabilities with an CVSSv3 network attack vector:$ docker scan myapp:mytag --severity high --json | \jq '[.vulnerabilities[]|
select(.CVSSv3 | contains("AV:N")))'High severity vulnerabilities with a fix available:$ docker scan myapp:mytag --severity high --json
jq '[.vulnerabilities[]
select(.nearestFixedInVersion)'| \|The über example! De-duplicate the high severity vulnerabilities
instead of listing each detection separately, and show the mostrecent fix required to address the issues:$ docker scan myapp:mytag --file Dockerfile --json \--severity high --group-issues| \jq '[.vulnerabilities[]|
select(.nearestFixedInVersion) ] |group_by(.packageName)[]|sort_by(.nearestFixedInVersion) | .[0] |{packageName, dockerfileInstruction, version,nearestFixedInVersion}'