.

security/scanning/vulnerability-scanning/scripts/scan-images.sh

@@ -0,0 +1,53 @@
+#!/bin/bash
+# Container Image Vulnerability Scanner
+# Usage: ./scan-images.sh <image> [--severity HIGH,CRITICAL] [--format json|table]
+
+set -euo pipefail
+
+IMAGE="${1:-}"
+SEVERITY="${2:-HIGH,CRITICAL}"
+FORMAT="${3:-table}"
+
+if [ -z "$IMAGE" ]; then
+    echo "Usage: $0 <image> [--severity HIGH,CRITICAL] [--format json|table]"
+    exit 1
+fi
+
+echo "========================================="
+echo "Scanning Image: $IMAGE"
+echo "Severity Filter: $SEVERITY"
+echo "========================================="
+echo ""
+
+# Check which scanner is available
+if command -v trivy &>/dev/null; then
+    echo "Using Trivy scanner..."
+    trivy image \
+        --severity "$SEVERITY" \
+        --format "$FORMAT" \
+        --ignore-unfixed \
+        "$IMAGE"
+        
+elif command -v grype &>/dev/null; then
+    echo "Using Grype scanner..."
+    grype "$IMAGE" \
+        --only-fixed \
+        --fail-on high \
+        -o "$FORMAT"
+        
+elif command -v docker &>/dev/null && docker scout version &>/dev/null 2>&1; then
+    echo "Using Docker Scout..."
+    docker scout cves "$IMAGE" \
+        --only-severity critical,high \
+        --format "$FORMAT"
+        
+else
+    echo "Error: No vulnerability scanner found."
+    echo "Install one of: trivy, grype, or docker scout"
+    exit 1
+fi
+
+echo ""
+echo "========================================="
+echo "Scan complete"
+echo "========================================="