Skip to main content

Scanning containers with agent-based scanning

Container scanning extends the Veracode vulnerability database and SCA technology to system libraries in Docker containers.

For the latest Veracode container scanning functionality, see Veracode Container Security.

Veracode Software Composition Analysis agent-based scanning supports container scanning for these Linux distributions:

  • RHEL 7
  • CentOS 6 and 7
  • Alpine 3
  • Debian 8, 9, and 10
  • Ubuntu 16.04, 18.04, 20.04, 20.10, and 21.04

You must have one of these package managers installed on your machine:

  • yum
  • pip
  • NPM
  • gem
  • apk
  • apt

When using yum, Veracode recommends you have the permissions to run yum updates in the container without root privileges.

For RHEL Linux containers, agent-based scanning only supports official RHEL Docker images, which require a RHEL subscription.

CLI container scanning


To scan a Docker image, use --image:

$ docker images --format '{{.Repository}}:{{.Tag}}'

$ srcclr scan --image centos:7


To scan a container running locally, pass the container ID or name to --container:

$ docker ps --format '{{.ID}}'
srcclr scan --container 2ca861ab7e85

$ docker ps --format '{{.Names}}'

$ srcclr scan --container compassionate_shirley

These repository-specific features are not available for container scanning: vulnerable methods, lines of code, and SCM-specific concepts such as branches.

Continuous integration container scanning

To scan a Docker image using the continuous integration (CI) agent, modify the existing cURL script for the Veracode SCA agent to:

curl -sSL | sh -s scan --image <image name>

The Travis CI addon, which does not use this cURL script, does not support scanning Docker images.

Viewing container scanning results

After your agent-based scan is complete, you can view the vulnerabilities in your container from the project page in the Veracode Platform.