mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
54 lines
1.4 KiB
Bash
54 lines
1.4 KiB
Bash
#!/bin/bash
|
|
# Container Image Vulnerability Scanner
|
|
# Usage: ./scan-images.sh <image> [--severity HIGH,CRITICAL] [--format json|table]
|
|
|
|
set -euo pipefail
|
|
|
|
IMAGE="${1:-}"
|
|
SEVERITY="${2:-HIGH,CRITICAL}"
|
|
FORMAT="${3:-table}"
|
|
|
|
if [ -z "$IMAGE" ]; then
|
|
echo "Usage: $0 <image> [--severity HIGH,CRITICAL] [--format json|table]"
|
|
exit 1
|
|
fi
|
|
|
|
echo "========================================="
|
|
echo "Scanning Image: $IMAGE"
|
|
echo "Severity Filter: $SEVERITY"
|
|
echo "========================================="
|
|
echo ""
|
|
|
|
# Check which scanner is available
|
|
if command -v trivy &>/dev/null; then
|
|
echo "Using Trivy scanner..."
|
|
trivy image \
|
|
--severity "$SEVERITY" \
|
|
--format "$FORMAT" \
|
|
--ignore-unfixed \
|
|
"$IMAGE"
|
|
|
|
elif command -v grype &>/dev/null; then
|
|
echo "Using Grype scanner..."
|
|
grype "$IMAGE" \
|
|
--only-fixed \
|
|
--fail-on high \
|
|
-o "$FORMAT"
|
|
|
|
elif command -v docker &>/dev/null && docker scout version &>/dev/null 2>&1; then
|
|
echo "Using Docker Scout..."
|
|
docker scout cves "$IMAGE" \
|
|
--only-severity critical,high \
|
|
--format "$FORMAT"
|
|
|
|
else
|
|
echo "Error: No vulnerability scanner found."
|
|
echo "Install one of: trivy, grype, or docker scout"
|
|
exit 1
|
|
fi
|
|
|
|
echo ""
|
|
echo "========================================="
|
|
echo "Scan complete"
|
|
echo "========================================="
|