NNarlawar349527 (Community Member) asked a question.
Does Veracode SCA able to scan multi-layer Docker images.
Can Veracode SCA able to scan multi-layer Docker images. For example:
BASE_IMAGE Dockerfile:
FROM centos:7
ENV ......
RUN .....
Now APP1 Dockerfile: [image name = app_img]
FROM ${BASE_IMAGE}
ENV .....
RUN ......
If I ran srcclr scan --image <app_img>
then does Veracode SCA scan and find vulnerabilities in both BASE_IMAGE and app_img ?
.png){kind=logo}
Hello @NNarlawar349527 (Community Member) ,
Yes, you are able to scan multi-layer Docker images. The way scanning is done is by executing commands in a running container (that the agent obtained by running the image when --image option is used), regardless on whether the image is layered or not.
Jason
Veracode Support Engineer