cr0hn/dockerscan

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

1710 stars · 248 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

DockerScan is a comprehensive Docker security scanner written in Go that scans containers, images, and registries using multiple techniques based on CIS Benchmarks, NIST SP 800-190, and recent supply chain attack research. It supports SARIF output and exit codes for CI/CD integration, plus a plugin architecture for extensibility.

Use cases

• scan docker images for vulnerabilities and misconfigurations
• audit a docker registry for security issues
• check containers against CIS benchmark and NIST SP 800-190
• find package CVEs in container images
• integrate container security scanning into CI/CD pipelines
• detect docker supply chain attack patterns
• generate SARIF reports from container scans

When to choose

• you need a single tool combining multiple Docker security scanning techniques
• you want SARIF output and automation-friendly exit codes for CI/CD
• you need registry and image scanning based on CIS/NIST standards
• you prefer a fast, concurrent scanner written in Go

When to avoid

• you need a permissively licensed tool, since the license is proprietary
• you rely on package CVE detection in versions 2.0.6 or earlier, which silently report zero CVEs
• you need mature ecosystem support like Trivy or Grype with broad vulnerability database coverage

Facets

cli-tool · maturity active

security vulnerability-scanning penetration-testing cli security developer-tools windows cli docker-security container-scanning image-scanning registry-scanning cis-benchmark sarif supply-chain-security containers devops linux macos docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cr0hn/dockerscan")