container-scan

# Vulnetix Container Scan Skill ## Use when - Pre-build: scan a Dockerfile for misconfigurations and base-image CVEs. - PR review: detect EOL base images, missing USER, root processes, exposed secrets. - `--image registry/img:tag`: scan a built image for installed-package CVEs via Trivy/Grype if available. - Compose with Syft to produce a container SBOM (CycloneDX JSON). - Hardening checklist: USER directive present, healthcheck defined, pinned versions, layer minimisation. ## Don't use for - Source-code SAST — use `sast-scan`. - Cloud-config (Terraform / k8s manifests) — use `iac-scan`. - Vulnetix CLI itself does not pull images; for `--image` you need `binaries.docker` or `binaries.podman`. ## Conventions Follows `skills/_lib/contract.md`. In short: use the `vulnetix_*` MCP tools when the agent has them and the CLI otherwise — both shape their own output, so there is no jq step any more. Independent calls go out as concurrent Bash tool calls in one message. One trailing suggestion, not a playbook. See the contract for surface selection, output style and memory writes. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Note: `binaries.{docker,podman,trivy,grype,syft}`, `repo.{dockerfile,containerfile,compose,docker_compose}`. If no container artifacts found AND no `--image` argument, abort with a one-liner. ## Step 2: Run Vulnetix container analysis ```bash vulnetix containers --paths "$DOCKERFILE_PATHS" -o json > .vulnetix/containers.${TIMESTAMP}.json ``` Or: ```bash vulnetix scan --enable-containers --paths "$DOCKERFILE_PATHS" -o json ``` Captures: base-image risk, EOL bases, exposed secrets, missing `USER`, root processes, missing healthchecks, vulnerable system packages. ## Step 3: Compose with installed scanners (conditional) For each available binary: - `binaries.trivy: true` → ```bash trivy config "$DOCKERFILE_PATH" --format json > .vulnetix/containers/trivy.config.json trivy image "$IMAGE" --format json > .vulnetix/containers/trivy.image.json # if --image ``` - `binaries.grype: true` AND `--image` → ```bash grype "$IMAGE" -o json > .vulnetix/containers/grype.json ``` - `binaries.syft: true` AND `--image` → ```bash syft "$IMAGE" -o cyclonedx-json > .vulnetix/containers/${IMAGE//[\/:]/_}.cdx.json ``` Merge findings into a unified table; de-dup by CVE+package. ## Step 4: Render ``` | Severity | Source | Issue | File / Layer | Fix | | Critical | trivy | CVE-... in libxml2 2.9.10 | layer 3 | bump base to alpine:3.19 | ``` Plus a "Hardening checklist" section: USER directive, healthcheck, pinned versions, reduced layers. ## Memory update Write `.vulnetix/containers/<timestamp>.summary.yaml` with finding counts by severity. ## Edge cases & gotchas - Trivy/Grype/Syft are optional. If absent, the skill runs Vulnetix-only checks (Dockerfile lint + base-image known-CVE list). - Compose files (docker-compose.yml) are scanned per-service; results are split per service-name. - `--image` requires the image to be pullable (registry auth via `docker login` / `podman login` first). - Trivy DB updates can take 30s on first run; subsequent invocations are cached. - EOL base-image detection uses `vulnetix vdb product` — same eol-status as `eol-check`. - Layer reordering recommendations are heuristic; if your build has a legitimate reason for the current order, the recommendation may be incorrect.