Overview
Container scanning in Shieldome checks two things: the Docker image itself (installed OS packages, known CVEs) and the Dockerfile (build instructions that can introduce security problems even in a clean image).
No credentials required for public images. Shieldome queries the Docker Hub API and public vulnerability databases without needing a registry login. For private registries, provide a token in the scan form.
Image scanning
When you provide a Docker image reference (e.g. nginx:1.25 or ghcr.io/yourorg/app:latest), Shieldome:
- Queries Docker Hub (or the registry API) for the image manifest and layer information
- If Trivy is installed on the Shieldome server, runs a full CVE scan and returns structured results
- Falls back to a lightweight CVE database check when Trivy is not available
- Reports findings by CVE ID, severity (CRITICAL / HIGH / MEDIUM / LOW), affected package, fixed version, and remediation advice
Image reference formats
| Format | Example |
|---|---|
| Docker Hub (official) | nginx:1.25 |
| Docker Hub (user/org) | myorg/myapp:v2.1 |
| GitHub Container Registry | ghcr.io/myorg/myapp:latest |
| Custom registry | registry.example.com/myapp:sha256-abc123 |
Dockerfile scanning
Upload a Dockerfile and Shieldome runs 10 static analysis rules without pulling or building the image:
| Rule | Severity | What it checks |
|---|---|---|
| Running as root | HIGH | No USER instruction, or USER root |
| No HEALTHCHECK | LOW | Missing HEALTHCHECK instruction - container orchestrators cannot detect unhealthy containers |
| Privileged ports | MEDIUM | EXPOSE on ports below 1024 (requires root or capabilities) |
| Hardcoded secrets in ENV | CRITICAL | Patterns like ENV PASSWORD=... or ENV API_KEY=... |
| curl pipe shell | HIGH | curl ... | bash or wget ... | sh in RUN commands |
| ADD instead of COPY | LOW | ADD with a URL or tar - prefer COPY for predictable behavior |
| No pinned base image | MEDIUM | Using :latest tag instead of a pinned digest or version |
| SSH daemon | HIGH | Installing or starting sshd inside the container |
| Apt without --no-install-recommends | LOW | Unnecessarily large image footprint increases attack surface |
| COPY --chown missing | INFO | Files copied as root when a non-root USER is set later |
How to run a container scan
- In the app sidebar, click Container Scan
- Choose the scan type: Image or Dockerfile
- For an image scan: enter the image reference in the input field and click Scan Image
- For a Dockerfile scan: click Upload Dockerfile, select the file, and click Scan Dockerfile
- Results appear in the panel below and are saved to your scan history
API
Container scans are also available via the REST API:
# Scan an image
curl -X POST https://app.shieldome.com/api/container-scan \
-H "X-API-Key: YOUR_KEY" \
-H "Content-Type: application/json" \
-d '{"scan_type":"image","target":"nginx:1.25"}'
# Scan a Dockerfile
curl -X POST https://app.shieldome.com/api/container-scan \
-H "X-API-Key: YOUR_KEY" \
-F "scan_type=dockerfile" \
-F "file=@./Dockerfile"Remediation guidance
Every finding includes a plain-English remediation step. Common fixes:
- CVEs in base image: update to a newer tag or switch to a minimal base (e.g.
distroless) - Root user: add
USER 1001(or a named non-root user) after installing packages - Hardcoded secrets: use Docker build arguments (
ARG) or runtime secrets - neverENV - Pinned tags: use
FROM nginx:1.25.3@sha256:abc123for reproducible builds