oscap-docker(8) System Administration Utilities oscap-docker(8)

# [NAME](#NAME)

oscap-docker - Tool for running oscap within docker container or image

# [DESCRIPTION](#DESCRIPTION)

oscap-docker tool can asses vulnerabilities or security compliance of running Docker containers or cold Docker images. OpenSCAP tool [**oscap(8)**](/man/os/openscap/oscap.8) is used underneath. Definition of vulnerabilities (CVE stream) is downloaded from product vendor.

## [Compliance scan of Docker image](#Compliance_scan_of_Docker_image)

Usage: oscap-docker image IMAGE\_NAME OSCAP\_ARGUMENT \[OSCAP\_ARGUMENT...]

Run any OpenSCAP [**oscap(8)**](/man/os/openscap/oscap.8) command within chroot of mounted docker image. Learn more about arguments in [**oscap(8)**](/man/os/openscap/oscap.8) man page.

## [Compliance scan of Docker container](#Compliance_scan_of_Docker_container)

Usage: oscap-docker container CONTAINER\_NAME OSCAP\_ARGUMENT \[OSCAP\_ARGUMENT...]

Run any OpenSCAP [**oscap(8)**](/man/os/openscap/oscap.8) command within chroot of mounted docker container. Result of this command may differ from scanning just an image due to defined mount points.

## [Vulnerability scan of Docker image](#Vulnerability_scan_of_Docker_image)

Usage: oscap-docker image-cve IMAGE\_NAME \[--results oval-results-file.xml \[--report report.html]]

Attach docker image, determine OS variant/version, download CVE stream applicable to the given OS, and finally run vulnerability scan.

## [Vulnerability scap of Docker container](#Vulnerability_scap_of_Docker_container)

Usage: oscap-docker container-cve CONTAINER\_NAME \[--results oval-results-file.xml \[--report report.html]]

Chroot to running container, determine OS variant/version, download CVE stream applicable to the given OS and finally run a vulnerability scan.

In order to use different [**oscap(8)**](/man/os/openscap/oscap.8) binary pass it like --oscap=<path/to/oscap>, as the first argument.

# [SECURITY POLICIES](#SECURITY_POLICIES)

[**SCAP-Security-Guide** package contains multiple configuration policies.](#SCAP_Security_Guide)

[**Red Hat CVE stream can be found online** - *https://www.redhat.com/security/data/metrics/*](#Red)

# [REPORTING BUGS](#REPORTING_BUGS)

```
Please report bugs using https://github.com/OpenSCAP/openscap/issues
```

# [AUTHORS](#AUTHORS)

```
Šimon Lukašík <slukasik@redhat.com>
```

January 2016 Red Hat, Inc.

---

Document: oscap-docker(8) from openscap 1.4.5-r0 (Chainguard OS)
Source: https://github.com/OpenSCAP/openscap