Now you can scan an image directly after building it with docker build by using the docker:// prefix. This is ideal for local development and CI/CD pipelines that want to ensure images do not contain leaked secrets before pushing to an image registry.
This resolves "Add support for scanning images from the Docker daemon" #4275.
This reverts commit 562dd7242b, which reverted the original version of this change that had some issues with its tests that we did not notice until after we merged it.
- Now you can scan an image directly after building it with `docker build` by using the `docker://` prefix.
This is ideal for local development and CI/CD pipelines that want to ensure images do not contain leaked secrets before pushing to an image registry.
- Resolves#4275
Description:
Add support for excluding paths in Docker source scanning:
Add ExcludePaths field to Docker protobuf
Implement path exclusion logic in docker.go
Add comprehensive test coverage for exact and wildcard path matching
Update engine to pass exclude paths configuration
Add CLI support for --exclude-paths flag
The implementation supports:
Exact path matching (e.g., /var/log/test)
Wildcard path matching (e.g., /var/log/test/*)
Multiple exclude paths
Tests ensure proper handling of:
Exact path exclusions
Wildcard exclusions
Edge cases and similar paths
References:
https://github.com/trufflesecurity/trufflehog/issues/2216?utm_source=chatgpt.com
* feat: support docker image history scanning
* refactor: collapse error handling into return
Style suggestion from review feedback.
* fix: associate layers with history entries
Where possible, add the associated layer to the history entry record. This may help tracing any issues discovered.
This also changes the entry reference format to `image-metadata:history:%d:created-by` which _may_ be more self-explanatory.
* added functionality to scan docker images with digests instead of tags
* cleaned import statement
* added unit test for baseAndTag parsing + remote digest scan
Mustansir
Nabeel Alam
Kashif KhanandShahzad Haider
Stephen Aghaulor
Cody Rose
Tanner Jones
James Telfer
joeleonjr
Dustin Decker