Ctrlk
WebsiteBlog
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Scanning Docker images

Learn how to scan Docker images with Fortify SCA.

Fortify SCA doesn't have official Docker image support yet, but scanning is possible using the following workaround.

To scan Docker images with Fortify SCA:

  1. Install and run the Docker SBOM CLI plugin from https://github.com/docker/sbom-cli-plugin in order to generate a CycloneDX report. Make sure to change the format to CycloneDX, for example, docker sbom username/imagename:latest --format cyclonedx-json --output imagename.sbom.json

  2. Run Fortify SCA CLI from https://github.com/debricked/cli, and it will automatically pick up the CycloneDX report files. You can view the results in pipeline and Fortify SCA UI.

Last updated

Was this helpful?