Overview

You can scan Docker containers by running the Unified Agent in Docker mode using the docker.scanContainers parameter. 

In this mode, the Linux packages are detected, and a general scan of the container file system is performed for package managers' based resolution and identification of source files/binaries.

Prerequisites

• Docker installed

• Unified Agent version 19.1.2 and above 

NOTE: When scanning a Docker container on Windows, the CMD tool must be executed with the Run as Administrator option.

Configurations

• Set the Boolean property docker.scanContainers in the config file to true. By default, the Unified Agent will scan all your Docker containers.

• If you want to be more specific about which containers to scan, set the GLOB pattern property for docker.containerIncludes and docker.containerExcludes. 

Examples

docker.scanContainers=true
docker.containerIncludes=.*alpine.*
docker.containerExcludes=.*2017.10.01.* .*2017.06.01.*

The above example configures the Unified Agent to scan all the docker containers containing an image named *alpine.*, except for the 2 image tags in the 'excludes' section.

docker.scanContainers=true
docker.containerIncludes=.*4c01db0b339c.*
docker.containerExcludes=

The above example configures the Unified Agent to scan all the docker containers containing a container with id 4c01db0b339c.

docker.scanContainers=true
docker.containerIncludes=.*webapp.*
docker.containerExcludes=.*webapp-dev.*

The above example configures the Unified Agent to scan all the docker containers containing the name webapp, except for the containers including the name webapp-dev.

The scanner saves your required containers and scans all the file systems and installed packages.

The Docker container is saved to the temporary directory defined in your environment and is deleted immediately after the scan.

The scanning results are presented in a new WhiteSource project identified by the name of the container in the following format:  <container id> <container name> (<repository name>).
The project is created in the WhiteSource product specified in the config file or command line.