oscap-docker (8) - Linux Manuals

oscap-docker: Tool for running oscap within docker container or image

NAME

oscap-docker - Tool for running oscap within docker container or image

DESCRIPTION

oscap-docker tool can asses vulnerabilities or security compliance of running Docker containers or cold Docker images. OpenSCAP tool (oscap) is used underneath. Definition of vulnerabilities (CVE stream) is downloaded from product vendor.

Compliance scan of Docker image

Usage: oscap-docker image IMAGE_NAME [OSCAP_ARGUMENTS]

Run any OpenSCAP (oscap) command within chroot of mounted docker image. Learn more about OSCAP_ARGUMENTS in oscap(8) man page.

Compliance scan of Docker container

Usage: oscap-docker container CONTAINER_NAME [OSCAP_ARGUMENTS]

Run any OpenSCAP (oscap) command within chroot of mounted docker container. Result of this command may differ from scanning just an image due to defined mount points.

Vulnerability scan of Docker image

Usage: oscap-docker image-cve IMAGE_NAME [--results oval-results-file.xml [--report report.html]]

Attach docker image, determine OS variant/version, download CVE stream applicable to the given OS, and finally run vulnerability scan.

Vulnerability scap of Docker container

Usage: oscap-docker container-cve CONTAINER_NAME [--results oval-results-file.xml [--report report.html]]

Chroot to running container, determine OS variant/version, download CVE stream applicable to the given OS and finally run a vulnerability scan.

SECURITY POLICIES

SCAP-Security-Guide package contains multiple configuration policies.

Red Hat CVE stream can be found online - https://www.redhat.com/security/data/metrics/

REPORTING BUGS

Please report bugs using https://github.com/OpenSCAP/openscap/issues

AUTHORS

Šimon Lukašík <slukasik [at] redhat.com>