Docker image security analysis
Docker Analyzer
Run Docker image checks as a reproducible workflow, not a pile of scanner output. Docker Analyzer is publicly available on GitHub and starts locally with Docker Compose. The implemented pipeline links a policy template, Docker image digests, readiness checks, raw Trivy results, CWE enrichment, vulnerability cache data, and the final report under one request_id.
Raw scanner output loses context once policy, image set, enrichment, and remediation review are handled in different places.
Docker Analyzer keeps the selected policy template, submitted image digests, raw Trivy artifacts, CWE mapping, vulnerability cache, and final report under one request_id. The result can be reopened and reviewed without reconstructing the original run from separate files.
Policy, image digests, Trivy scan, CWE mapping, final report
- Flow: deterministic — fixed stages tied to one request_id
- Input: digests — one or more image@sha256 references
- Output: report — grouped findings with policy and CWE context
What the team gets
That makes it easier to compare multiple images in one run, distinguish policy-relevant findings, see mapping gaps, and retry or repair interrupted jobs without losing the original context.
- A request-linked analysis record for one or more Docker image digests.
- Raw Trivy artifacts plus normalized vulnerability and CWE context.
- A final read-only report with overview, findings, policy matches, and incomplete mapping states.
Practical use cases
- container image review before release
- repeatable AppSec and DevSecOps checks with explicit policy context
- triage workflows where raw evidence and CWE mapping must remain inspectable