Docker Image Scanning Knowledge Base

Quick reference for vulnerability scanning and compliance checking in PHP container images.

Scanning Tools Comparison

Trivy

Basic Scanning

# Scan image for vulnerabilities
trivy image myapp:latest

# Scan with severity filter
trivy image --severity HIGH,CRITICAL myapp:latest

# Scan and fail on threshold (for CI)
trivy image --exit-code 1 --severity CRITICAL myapp:latest

# Scan with specific format
trivy image --format json --output results.json myapp:latest
trivy image --format table myapp:latest
trivy image --format sarif --output results.sarif myapp:latest

Scanning Dockerfile

# Scan Dockerfile for misconfigurations
trivy config Dockerfile

# Scan entire project config
trivy config .

SBOM Generation

# Generate SBOM in CycloneDX format
trivy image --format cyclonedx --output sbom.json myapp:latest

# Generate SBOM in SPDX format
trivy image --format spdx-json --output sbom.spdx.json myapp:latest

Grype

Basic Scanning

# Scan image
grype myapp:latest

# Fail on severity
grype myapp:latest --fail-on high

# Output as JSON
grype myapp:latest -o json > results.json

# Scan from SBOM
syft myapp:latest -o spdx-json > sbom.json
grype sbom:sbom.json

Syft SBOM Generation

# Generate SBOM with Syft
syft myapp:latest -o cyclonedx-json > sbom.cyclonedx.json
syft myapp:latest -o spdx-json > sbom.spdx.json
syft myapp:latest -o table

Docker Scout

# Analyze image vulnerabilities
docker scout cves myapp:latest

# Get fix recommendations
docker scout recommendations myapp:latest

# Compare two images
docker scout compare myapp:latest myapp:previous

# View SBOM
docker scout sbom myapp:latest

CI Integration Patterns

GitHub Actions

name: Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL,HIGH
          exit-code: 1

      - name: Upload scan results
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: trivy-results.sarif

      - name: Generate SBOM
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: cyclonedx
          output: sbom.json

      - name: Upload SBOM
        uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

GitLab CI

container_scanning:
  stage: test
  image:
    name: aquasec/trivy:latest
    entrypoint: [""]
  variables:
    IMAGE: $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
  script:
    - trivy image --exit-code 0 --format template --template "@/contrib/gitlab.tpl" --output gl-container-scanning-report.json $IMAGE
    - trivy image --exit-code 1 --severity CRITICAL $IMAGE
  artifacts:
    reports:
      container_scanning: gl-container-scanning-report.json
  allow_failure: false

SBOM Formats

PHP-Specific SBOM Content

An SBOM for a PHP container should include:

libzip

icu-libs

docker-php-ext-install

pdo_mysql

opcache

composer.lock

symfony/http-kernel

package-lock.json

composer

nginx

Compliance Policies

Severity Classification

Policy Configuration (Trivy)

# .trivy.yaml
severity:
  - CRITICAL
  - HIGH

exit-code: 1

ignore-unfixed: true

ignorefile: .trivyignore

# .trivyignore
# Accepted risks with justification
CVE-2023-XXXXX  # Mitigated by WAF rules, not exploitable in our context
CVE-2023-YYYYY  # Fix not available, monitoring for update

Fix Strategies

FROM php:8.4-fpm-alpine3.20

FROM php:8.4.3-fpm-alpine

composer update --with-dependencies

apk add libcurl=8.5.0-r0

.trivyignore

Automated Scanning Workflow

+---------------------------------------------------------------------------+
|                    SCANNING WORKFLOW                                        |
+---------------------------------------------------------------------------+
|                                                                            |
|   Developer Push                                                           |
|       |                                                                    |
|       v                                                                    |
|   Build Image --> Scan Image --> Generate SBOM --> Policy Check             |
|       |               |               |               |                    |
|       |          +----+----+          |          +----+----+               |
|       |          | Pass    | Fail     |          | Pass    | Fail          |
|       |          v         v          |          v         v               |
|       |       Continue   Block PR     |       Deploy    Block Deploy       |
|       |          |                    |          |                          |
|       v          v                    v          v                          |
|   Push to    Merge to            Store SBOM   Production                   |
|   Registry   Main Branch         in Registry  Monitoring                   |
|                                                                            |
+---------------------------------------------------------------------------+

Detection Patterns

# Find scanning configurations
Glob: **/.trivy.yaml
Glob: **/.trivyignore
Glob: **/.grype.yaml
Glob: **/.snyk

# Check CI for scanning steps
Grep: "trivy|grype|snyk|docker scout" --glob "**/.github/workflows/*.yml"
Grep: "container_scanning|security_scan" --glob "**/.gitlab-ci.yml"

# Find SBOM artifacts
Glob: **/sbom*.json
Glob: **/*.spdx.json
Glob: **/*.cyclonedx.json