container-scanner
Scans containers and Dockerfiles for security issues. Wraps Hadolint for Dockerfile linting and Trivy for container image scanning. Use when user asks to "scan Dockerfile", "lint Dockerfile", "container security", "image scan", "Dockerセキュリティ", "コンテナスキャン".
When & Why to Use This Skill
The Container Scanner Claude skill is a specialized DevSecOps tool designed to automate security audits for containerized environments. By integrating industry-standard tools like Hadolint for Dockerfile linting and Trivy for image scanning, it empowers developers to identify critical vulnerabilities (CVEs) and enforce infrastructure-as-code best practices. This skill ensures that container deployments are secure, optimized, and compliant with modern security standards.
Use Cases
- Dockerfile Best Practice Enforcement: Automatically lint Dockerfiles using Hadolint to detect anti-patterns such as running as root, missing version pins, or inefficient layer management.
- Vulnerability Scanning (CVE): Scan container images with Trivy to identify known security vulnerabilities in OS packages and application dependencies before deployment.
- CI/CD Security Gates: Generate structured JSON security reports that can be integrated into automated pipelines to prevent insecure images from reaching production environments.
- Infrastructure Compliance Auditing: Quickly assess the security posture of existing container images to ensure they meet organizational security policies and regulatory requirements.
- Shift-Left Security: Enable developers to perform instant security checks during the local development phase, reducing the cost and complexity of fixing security issues later in the lifecycle.
| name | container-scanner |
|---|---|
| description | Scans containers and Dockerfiles for security issues. Wraps Hadolint for Dockerfile linting and Trivy for container image scanning. Use when user asks to "scan Dockerfile", "lint Dockerfile", "container security", "image scan", "Dockerセキュリティ", "コンテナスキャン". |
Container Scanner
Wrapper for Hadolint and Trivy to scan Dockerfiles and container images.
Prerequisites
# Hadolint (Dockerfile linting)
brew install hadolint
# or
docker pull hadolint/hadolint
# Trivy (container image scanning)
brew install trivy
# or
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
Usage
# Lint Dockerfile
npx container-scanner lint Dockerfile
# Scan container image
npx container-scanner image nginx:latest
# Both operations with JSON output
npx container-scanner lint Dockerfile --json
npx container-scanner image myapp:v1 --json
# Check available tools
npx container-scanner --check
Hadolint Rules
Common Dockerfile best practices checked:
| Rule | Description |
|---|---|
| DL3000 | Use absolute WORKDIR |
| DL3001 | For some POSIX utilities, you can skip using apt-get |
| DL3002 | Last USER should not be root |
| DL3003 | Use WORKDIR to switch directories |
| DL3006 | Always tag the version of an image explicitly |
| DL3007 | Using latest is prone to errors |
| DL3008 | Pin versions in apt get install |
| DL3009 | Delete apt-get lists after installing |
| DL3018 | Pin versions in apk add |
| DL4006 | Set SHELL option -o pipefail |
Output Format
Dockerfile Lint
{
"tool": "hadolint",
"scanPath": "Dockerfile",
"findings": [
{
"id": "DL3007",
"severity": "warning",
"line": 1,
"message": "Using latest is prone to errors...",
"file": "Dockerfile"
}
],
"summary": { "total": 1, "error": 0, "warning": 1, "info": 0 }
}
Image Scan
{
"tool": "trivy",
"image": "nginx:latest",
"findings": [
{
"id": "CVE-2024-1234",
"severity": "critical",
"package": "openssl",
"installedVersion": "1.1.1",
"fixedVersion": "1.1.2",
"title": "Buffer Overflow"
}
],
"summary": { "total": 5, "critical": 1, "high": 2, "medium": 2 }
}
Exit Codes
0: No issues found1: Issues detected2: Tool not installed or error