Skip to main content
Skip table of contents

Docker Containers Integration

Overview

You can scan Docker containers by running the Unified Agent in Docker mode using the docker.scanContainers parameter. 

In this mode, the Linux packages are detected, and a general scan of the container file system is performed for package managers' based resolution and identification of source files/binaries.

For scanning an RPM-based Docker container, RPM database compatibility between the container and the machine in which the scan is performed will increase the accuracy of the results.

Prerequisites

NOTE: When scanning a Docker container on Windows, the CMD tool must be executed with the Run as Administrator option.

Configurations

  • Set the Boolean property docker.scanContainers in the config file to true. By default, the Unified Agent will scan all your running Docker containers.

  • If you want to be more specific about which containers to scan, set the GLOB pattern property for docker.containerIncludes and docker.containerExcludes

Examples

CODE
docker.scanContainers=true
docker.containerIncludes=.*alpine.*
docker.containerExcludes=.*2017.10.01.* .*2017.06.01.*


The above example configures the Unified Agent to scan all the docker containers containing an image named *alpine.*, except for the 2 image tags in the 'excludes' section.

CODE
docker.scanContainers=true
docker.containerIncludes=.*4c01db0b339c.*
docker.containerExcludes=

The above example configures the Unified Agent to scan all the docker containers containing a container with id 4c01db0b339c.

CODE
docker.scanContainers=true
docker.containerIncludes=.*webapp.*
docker.containerExcludes=.*webapp-dev.*

The above example configures the Unified Agent to scan all the docker containers containing the name webapp, except for the containers including the name webapp-dev.

The scanner saves your required containers and scans all the file systems and installed packages.

The Docker container is saved to the temporary directory defined in your environment and is deleted immediately after the scan.

The scanning results are presented in a new Mend project identified by the name of the container in the following format:  <container id> <container name> (<repository name>).
The project is created in the Mend product specified in the config file or command line.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.