Docker Containers Integration
Overview
You can scan Docker containers by running the Unified Agent in Docker mode using the docker.scanContainers
parameter.
In this mode, the Linux packages are detected, and a general scan of the container file system is performed for package managers' based resolution and identification of source files/binaries.
For scanning an RPM-based Docker container, RPM database compatibility between the container and the machine in which the scan is performed will increase the accuracy of the results.
Prerequisites
Docker installed
Unified Agent version 19.1.2 and above
The relevant package manager must be installed. For details, see https://docs.mend.io/legacy-sca/latest/getting-started-with-the-unified-agent#GettingStartedwiththeUnifiedAgent-Prerequisites .
NOTE: When scanning a Docker container on Windows, the CMD tool must be executed with the Run as Administrator option.
Configurations
Set the Boolean property
docker.scanContainers
in the config file to true. By default, the Unified Agent will scan all your running Docker containers.If you want to be more specific about which containers to scan, set the GLOB pattern property for
docker.containerIncludes
anddocker.containerExcludes
.
Examples
CODE
|
The above example configures the Unified Agent to scan all the docker containers containing an image named *alpine.*, except for the 2 image tags in the 'excludes' section.
CODE
|
The above example configures the Unified Agent to scan all the docker containers containing a container with id 4c01db0b339c.
CODE
|
The above example configures the Unified Agent to scan all the docker containers containing the name webapp, except for the containers including the name webapp-dev.
The scanner saves your required containers and scans all the file systems and installed packages.
The Docker container is saved to the temporary directory defined in your environment and is deleted immediately after the scan.
The scanning results are presented in a new Mend project identified by the name of the container in the following format: <container id> <container name> (<repository name>).
The project is created in the Mend product specified in the config file or command line.