Docker image reference

Build args, bundled tools, worker mode, GHCR publish

The Docker image bundles the CLI (scan) and optional worker (platform queue processing).

For scanning repos locally or in CI, start with the product guide: scan-product.md.

Commands

Command	Purpose
`scan /repo [flags]`	Scan a mounted directory (no platform required)
`worker`	Poll Postgres for queued scans (platform)
`worker --drain`	Process all queued jobs, then exit

Build

From the repository root:

pnpm docker:build

Or:

docker build -f infrastructure/docker/Dockerfile -t security-scanner:local .

Build args (defaults in Dockerfile):

Arg	Default	Tool
`TRIVY_VERSION`	`0.71.2`	Dependency & CVE scanner
`SEMGREP_VERSION`	`1.95.0`	SAST (pip)
`SYFT_VERSION`	`1.18.1`	SBOM generator
`GITLEAKS_VERSION`	`8.21.2`	Secret scanner
`CHECKOV_VERSION`	`3.2.428`	IaC scanner (pip)
`SEGREP_SAST_VERSION`	`0.1.0`	Native SAST engine (Go build)

The image includes segrep-sast at /usr/local/bin/segrep-sast with rules at /usr/local/share/segrep-sast/rules. See segrep-sast.md.

Example with pinned versions:

docker build -f infrastructure/docker/Dockerfile \
  --build-arg TRIVY_VERSION=0.71.2 \
  --build-arg GITLEAKS_VERSION=8.21.2 \
  -t security-scanner:local .

Scan (see scan-product.md for full guide)

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local scan /repo
docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners all --format json --fail-on high

Syft writes .segrep/sbom.cyclonedx.json inside the scan target — use a read-write mount if you need the file on the host:

docker run --rm -v "$(pwd):/repo" security-scanner:local scan /repo --scanners syft

segrep-sbom (opt-in) writes the same SBOM artifact and can emit a parity report when shadow mode is enabled:

docker run --rm -v "$(pwd):/repo" -e SEGREP_SBOM_PARITY_SHADOW=true security-scanner:local scan /repo --scanners segrep-sbom
# parity report: .segrep/segrep-sbom-parity.json

# segrep-vuln parity report (opt-in)
docker run --rm -v "$(pwd):/repo" -e SEGREP_VULN_PARITY_SHADOW=true security-scanner:local scan /repo --scanners segrep-vuln
# parity report: .segrep/segrep-vuln-parity.json

Worker (platform only)

Process scans queued by the hosted dashboard/API:

docker run --rm --env-file .env security-scanner:local worker --drain

Required in .env:

DATABASE_URL=postgresql://...@neon.tech/neondb?sslmode=require
DASHBOARD_URL=https://your-app.vercel.app

For GitHub PR scans, also set GITHUB_APP_ID and GITHUB_APP_PRIVATE_KEY.

See vercel-neon-local-worker.md.

Publish to GHCR

Tag a release:

git tag v0.1.0
git push origin v0.1.0

Workflow: .github/workflows/docker-publish.yml → ghcr.io/szaranger/security-scanner:latest

Image contents

Tool	Installed as
Trivy	Binary (`TRIVY_VERSION`)
Semgrep	pip (`SEMGREP_VERSION`)
Syft	Binary (`SYFT_VERSION`)
segrep-sbom	TypeScript local lockfile SBOM scanner (opt-in)
segrep-license	TypeScript local license compliance scanner (opt-in)
segrep-secrets	TypeScript native secret detection scanner (opt-in)
Gitleaks	Binary (`GITLEAKS_VERSION`)
Checkov	pip (`CHECKOV_VERSION`)
segrep-sast	Go binary (`SEGREP_SAST_VERSION`) + bundled rules
git	PR clone in worker mode

Scanners use binaries inside the container (not Docker-in-Docker).

Troubleshooting

Issue	Fix
Permission denied on volume	Path must exist; Docker must be able to read the mount
Worker finds no jobs	Same `DATABASE_URL` as Vercel; queue a scan via API or webhook first
PR scan fails	Set GitHub App credentials in `--env-file`
Slow first scan	Trivy/Semgrep download rule DBs on first run
No SBOM file on host	Syft writes under `.segrep/` in the mount — use read-write volume
segrep-sbom parity not generated	Set `SEGREP_SBOM_PARITY_SHADOW=true`; report path is `.segrep/segrep-sbom-parity.json`
segrep-vuln parity not generated	Set `SEGREP_VULN_PARITY_SHADOW=true`; report path is `.segrep/segrep-vuln-parity.json`
Checkov skipped	No IaC files detected under scan root (expected for pure app repos)
Self-hosted CI without Docker daemon	Install local scanner binaries (`trivy`, `syft`, `gitleaks`) before running `segrep scan` steps