mirror of https://github.com/docker/docs.git
126 lines
5.5 KiB
Markdown
126 lines
5.5 KiB
Markdown
---
|
||
title: Analyze local files with Docker Scout
|
||
description: Analyze and compare local code using Docker Scout on the command line
|
||
keywords: scout, vulnerabilities, analyze, analysis, cli, packages, sbom, cve, security, local, source, code, supply chain
|
||
---
|
||
|
||
You can use the `fs://` protocol prefix with Docker Scout CLI commands to
|
||
analyze your local source code directly, without having to build and push
|
||
container images. The following commands support the `fs://` prefix:
|
||
|
||
- `docker scout quickview`
|
||
- `docker scout cves`
|
||
- `docker scout compare`
|
||
|
||
This feature is available in Docker Scout CLI plugin version 1.0.3 and later.
|
||
|
||
## Summary
|
||
|
||
To get an at-a-glance vulnerability summary of the source code in the current
|
||
working directory:
|
||
|
||
```console
|
||
$ docker scout quickview fs://.
|
||
```
|
||
|
||
## Details
|
||
|
||
To view the details of vulnerabilities found in your local source code, you can
|
||
use the `docker scout cves --details fs://.` command. Combine it with
|
||
other flags to narrow down the results to the packages and vulnerabilities that
|
||
you're interested in.
|
||
|
||
```console
|
||
$ docker scout cves --details --only-severity high fs://.
|
||
✓ File system read
|
||
✓ Indexed 323 packages
|
||
✗ Detected 1 vulnerable package with 1 vulnerability
|
||
|
||
## Overview
|
||
|
||
│ Analyzed path
|
||
────────────────────┼──────────────────────────────
|
||
Path │ /Users/david/demo/scoutfs
|
||
vulnerabilities │ 0C 1H 0M 0L
|
||
|
||
## Packages and Vulnerabilities
|
||
|
||
0C 1H 0M 0L fastify 3.29.0
|
||
pkg:npm/fastify@3.29.0
|
||
|
||
✗ HIGH CVE-2022-39288 [OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities]
|
||
https://scout.docker.com/v/CVE-2022-39288
|
||
|
||
fastify is a fast and low overhead web framework, for Node.js. Affected versions of
|
||
fastify are subject to a denial of service via malicious use of the Content-Type
|
||
header. An attacker can send an invalid Content-Type header that can cause the
|
||
application to crash. This issue has been addressed in commit fbb07e8d and will be
|
||
included in release version 4.8.1. Users are advised to upgrade. Users unable to
|
||
upgrade may manually filter out http content with malicious Content-Type headers.
|
||
|
||
Affected range : <4.8.1
|
||
Fixed version : 4.8.1
|
||
CVSS Score : 7.5
|
||
CVSS Vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
||
|
||
1 vulnerability found in 1 package
|
||
LOW 0
|
||
MEDIUM 0
|
||
HIGH 1
|
||
CRITICAL 0
|
||
```
|
||
|
||
## Compare
|
||
|
||
With `docker scout compare`, you can compare the analysis of source code on
|
||
your local filesystem with the analysis of a container image. The following
|
||
example compares local source code for the Docker Scout CLI plugin with the
|
||
`docker/scout-cli:latest` image on Docker Hub.
|
||
|
||
```console
|
||
$ docker scout compare fs://. --to docker/scout-cli:latest --ignore-unchanged
|
||
WARN 'docker scout compare' is experimental and its behaviour might change in the future
|
||
✓ File system read
|
||
✓ Indexed 268 packages
|
||
✓ SBOM of image already cached, 234 packages indexed
|
||
|
||
|
||
## Overview
|
||
|
||
│ Analyzed File System │ Comparison Image
|
||
─────────────────────────┼────────────────────────────────────────────────┼─────────────────────────────────────────────
|
||
Path / Image reference │ /Users/david/src/docker/scout-cli-plugin │ docker/scout-cli:latest
|
||
│ │ bb0b01303584
|
||
platform │ │ linux/arm64
|
||
provenance │ https://github.com/dvdksn/scout-cli-plugin.git │ https://github.com/docker/scout-cli-plugin
|
||
│ 6ea3f7369dbdfec101ac7c0fa9d78ef05ffa6315 │ 67cb4ef78bd69545af0e223ba5fb577b27094505
|
||
vulnerabilities │ 0C 0H 1M 1L │ 0C 0H 1M 1L
|
||
│ │
|
||
size │ 7.4 MB (-14 MB) │ 21 MB
|
||
packages │ 268 (+34) │ 234
|
||
│ │
|
||
|
||
|
||
## Packages and Vulnerabilities
|
||
|
||
|
||
+ 55 packages added
|
||
- 21 packages removed
|
||
213 packages unchanged
|
||
```
|
||
|
||
The previous example is truncated. The full output also includes a full package
|
||
delta for the comparison. The delta shows what packages were added, removed,
|
||
and changed between the versions.
|
||
|
||
The compare output includes VCS provenance for both the local source code and
|
||
the compare target, when available.
|
||
|
||
## Learn more
|
||
|
||
Read about the commands and supported flags in the CLI reference documentation:
|
||
|
||
- [`docker scout quickview`](../engine/reference/commandline/scout_compare.md)
|
||
- [`docker scout cves`](../engine/reference/commandline/scout_compare.md)
|
||
- [`docker scout compare`](../engine/reference/commandline/scout_compare.md)
|