oscap-docker(8)

💖 oscap-docker(8) 💖

okay bestie, pull up a chair, we're doing the <rainbow>System Administration Utilities</rainbow> thing today. this is oscap-docker, and it's lowkey one of the most useful little tools in the OpenSCAP universe, so let's get into it 🫶

✨ NAME ✨

oscap-docker — the tool that runs oscap inside a docker container or a docker image, no cap 🐳

🌸 DESCRIPTION 🌸

so here's the vibe: oscap-docker can assess vulnerabilities or security compliance on either your running Docker containers or your cold, unplugged Docker images. the actual scanning is done by the OpenSCAP tool oscap(8) running underneath, doing all the heavy lifting like the main character it is 👑

and where does the vuln info come from? the definition of vulnerabilities (that's the CVE stream, iykyk) gets downloaded straight from the product vendor. periodt.

🐳 Compliance scan of Docker image

usage:

oscap-docker image IMAGE_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]

this runs any OpenSCAP oscap(8) command inside the chroot of a mounted docker image. want the full tea on what arguments you can pass? go read the oscap(8) man page, it's all there 📖

🐳 Compliance scan of Docker container

usage:

oscap-docker container CONTAINER_NAME OSCAP_ARGUMENT [OSCAP_ARGUMENT...]

same deal — it runs any OpenSCAP oscap(8) command inside the chroot of a mounted docker container. heads up tho: the result of this can differ from scanning just an image, because of the defined mount points. so like, don't be shocked if the numbers move 💀

🐳 Vulnerability scan of Docker image

usage:

oscap-docker image-cve IMAGE_NAME [--results oval-results-file.xml [--report report.html]]

what happens here: it attaches the docker image, figures out the OS variant and version, downloads the CVE stream that actually applies to that OS, and then finally runs the vulnerability scan. the full pipeline, slay ✨

🐳 Vulnerability scap of Docker container

usage:

oscap-docker container-cve CONTAINER_NAME [--results oval-results-file.xml [--report report.html]]

this one chroots into the running container, figures out the OS variant/version, downloads the CVE stream applicable to that OS, and then runs the vulnerability scan.

and ooh, important: if you wanna use a different oscap(8) binary, you pass it like --oscap=<path/to/oscap>, and it has to go as the first argument. first. not second. we don't negotiate with argument order bestie 🙈

🔐 SECURITY POLICIES 🔐

• the SCAP-Security-Guide package contains multiple configuration policies 🎀
• the Red Hat CVE stream can be found online at https://www.redhat.com/security/data/metrics/

🐛 REPORTING BUGS 🐛

found a bug? please report it using https://github.com/OpenSCAP/openscap/issues — the maintainers wanna know, fr fr 💜

👑 AUTHORS 👑

• Šimon Lukašík <slukasik@redhat.com>

and that's the whole page, bestie. this one's brought to you by Red Hat, Inc. and it's dated January 2016 — yes, an elder, but still serving absolute cunt in your container runtime. go scan something, you got this 💅💖