Endor Labs Container Security Scanner

Scan container images and analyze Dockerfiles for security issues.

Workflow

Dockerfile Analysis

Step 1: Find Dockerfiles

Search for Dockerfile, Dockerfile.*, docker/Dockerfile, *.dockerfile.

Step 2: Check for Security Issues

Critical:

High:

Medium:

Step 3: Present Analysis

Report issues by severity with line numbers, then provide a secured Dockerfile version:

FROM node:20-alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
WORKDIR /app
COPY --chown=appuser:appgroup package*.json ./
RUN npm ci --only=production && npm cache clean --force
COPY --chown=appuser:appgroup . .
USER appuser
HEALTHCHECK --interval=30s --timeout=3s \
  CMD wget -q --spider http://localhost:3000/health || exit 1
EXPOSE 3000
CMD ["node", "server.js"]

Include checklist: specific base image tag, non-root user, health check, clean package cache, multi-stage build, .dockerignore, COPY over ADD, no secrets in build args/env.

Docker Compose Analysis

Step 1: Find Compose Files

Search for docker-compose.yml, docker-compose.*.yml, compose.yml, compose.*.yml.

Step 2: Check for Issues

Step 3: Present Analysis

Report issues per service, then provide secured compose example:

version: '3.8'
services:
  app:
    image: app:1.0.0
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    deploy:
      resources:
        limits:
          cpus: '0.5'
          memory: 512M
    secrets:
      - db_password
    ports:
      - "127.0.0.1:3000:3000"

secrets:
  db_password:
    external: true

Image Scanning

The MCP scan tool accepts a repository path only; it does not accept a container image reference. For images, use the CLI:

npx -y endorctl container scan --image {image_name}:{tag} --output-type summary

Present results similar to /endor-scan output.

Next Steps

1. /endor-scan for application-level vulnerabilities
2. /endor-cicd for automated container scanning in CI
3. /endor-policy to enforce container security standards

For data source policy, read references/data-sources.md.

Error Handling